Trusted Storage Authentication via Encrypted Key Hierarchy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital rights management systems face challenges in ensuring secure access and confidentiality of sensitive digital content, particularly due to the limitations of software-only security measures and the increasing sophistication of hardware attacks, which can compromise storage devices used in trusted computing systems.
Innovation Solution
A method for authenticating access to encrypted content on a storage medium using a full disk encryption key, where the storage medium includes an encrypted version of the FDE key and a PSA key, with an authenticated communication channel between the host and storage engine, hashing the pass code to derive a key, verifying authenticity, and decrypting the keys to access the content, incorporating an N-factor authentication scheme for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If software-only security measures are used for digital rights management, then the system is flexible and easy to implement, but the security is compromised due to increasing sophistication of hardware attacks
Solution Approach 1:
The patent divides the security system into two distinct components: a hardware security module (HSM) that provides cryptographic functions and a software application that uses these functions. The HSM contains security-critical operations like key generation, signing, and verification, while the software handles business logic. This segmentation allows the system to maintain software flexibility while incorporating hardware-based security to resist sophisticated attacks.
Solution Approach 2:
The hardware security module acts as an intermediary between the software application and the cryptographic operations. Instead of the software directly performing security-critical functions, it communicates with the HSM through standardized interfaces. This intermediary provides a secure boundary that protects against software-based attacks while maintaining ease of software development and deployment.
2Reliability
If hardware-based security measures are implemented to resist sophisticated attacks, then the security is improved, but the device complexity increases
Solution Approach 1:
The hardware security module is designed to provide multiple cryptographic functions (key generation, digital signing, verification, encryption) through a single unified device. This multi-functionality reduces the need for multiple separate hardware components, thereby limiting the increase in device complexity while maintaining strong security against sophisticated attacks.
Solution Approach 2:
The HSM is designed to be self-contained, managing its own security policies, key lifecycle, and operational parameters without requiring external intervention for security-critical functions. This self-service capability reduces the complexity of system integration and management, as the hardware module autonomously handles security operations while presenting a simple interface to the software application.
3Device complexity
If storage devices make no distinction between sensitive and non-sensitive information, then the storage system is simple, but the confidentiality of sensitive information cannot be ensured
Solution Approach 1:
The patent implements local quality by applying different security treatments to different data regions within the storage device. Sensitive information is encrypted using keys managed by the HSM, while non-sensitive information remains accessible without decryption. This allows the storage system to maintain simplicity in structure while ensuring confidentiality where needed through localized encryption of specific data regions.
Data Source
AI summary
In one embodiment, a method for authenticating access to encrypted content on a storage medium, wherein the encrypted content is encrypted according to a full disk encryption (FDE) key, the storage medium including an encrypted version of the FDE key and an encrypted version of a protected storage area (PSA) key, and wherein the encrypted version of the FDE key is encrypted according to the PSA key, the method comprising: providing an authenticated communication channel between a host and a storage engine associated with the storage medium; at the storage engine, receiving a pass code from the host over the authenticated communication channel; hashing the pass code to form a derived key, wherein the encrypted version of the PSA key is encrypted according to the derived key; verifying an authenticity of the pass code; if the pass code is authentic, decrypting the encrypted version of the PSA key to recover the PSA key; decrypting the encrypted FDE key using the recovered PSA key to recover the FDE key; and decrypting the encrypted content using the FDE key.