Unique Device Credential Generation for Storage Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems for data storage devices face challenges in securely managing access to protected functionality, including the risk of credential compromise and the need for reliable network connections for authentication, especially in remote locations, and the inefficiency of maintaining unique credentials for large populations of devices.
Innovation Solution
A method that combines identification values associated with a data storage device using a secret symmetric encryption key to generate a unique device credential, which is then used to control access to protected functions through cryptographic processes, allowing for secure access without relying on a massive database or constant network connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unique credentials are stored in a centralized database for each device, then access control security is improved, but system complexity and storage requirements increase significantly
Solution Approach 1:
The patent extracts the credential verification process from a centralized database model and implements it locally within each storage device. Each device contains its own unique credential and the authentication logic, eliminating the need for a massive external database while maintaining security. This is achieved by storing individual identification values in non-volatile memory and using them to generate credentials locally.
Solution Approach 2:
Each storage device serves itself by generating and verifying its own credentials using locally stored identification values and cryptographic keys. The device autonomously performs authentication without requiring external database queries, making the system more efficient and reducing overall complexity while maintaining strong security guarantees.
2Ease of manufacture
If network connection is required for authentication, then centralized credential management is improved, but operational reliability in remote locations deteriorates
Solution Approach 1:
The patent performs preliminary action by pre-provisioning each storage device with unique identification values and cryptographic authentication keys during manufacturing. These credentials are stored in non-volatile memory, enabling the device to perform self-authentication independently of network availability. This preliminary credential setup eliminates the need for real-time network connections during authentication operations.
3Reliability
If individual credentials are generated for each device, then security against unauthorized access is improved, but credential management complexity increases
Solution Approach 1:
The patent implements a universal credential structure where all storage devices use the same cryptographic algorithm and authentication protocol, but with device-specific identification values. This universal approach simplifies management compared to device-specific custom credentials, as the same authentication logic applies to all devices while maintaining unique security credentials for each individual device through their distinct identification values.
Data Source
AI summary
Apparatus and method for controlling access to protected functionality of a data storage device. In some embodiments, a plurality of identification (ID) values associated with a data storage device are combined to form a combined ID value. The combined ID value is cryptographically processed using a secret symmetric encryption key in combination with a hash function or a key derivation function to generate a unique device credential for the data storage device. The unique device credential is used as an input to a selected cryptographic function to control access to a protected function of the data storage device.