Virtual Replay Protected Storage System Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices face security vulnerabilities in data storage due to insecure connections between client applications and data storage devices, particularly when data is stored across local networks or the internet, making them susceptible to replay attacks that can corrupt or steal data.
Innovation Solution
A virtual replay protected storage system maintains a trusted counter and secret key in a trusted client environment, encoding a hash message authentication code signature based on these elements and the data set, which is then sent to an agnostic data storage, allowing for secure write and read requests while verifying the integrity of the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is stored in a storage device separated by a local network or internet, then data accessibility and storage flexibility are improved, but security vulnerability to replay attacks increases
Solution Approach 1:
The system performs preliminary actions by maintaining a trusted counter and secret key in a trusted client environment before data transmission. The counter is incremented and used to generate unique authentication signatures for each write request, preventing replay attacks by ensuring that previously captured requests cannot be reused.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using hash message authentication code (HMAC) signatures. This intermediary layer verifies the authenticity of data transmissions between the client application and storage device, blocking replay attacks without preventing legitimate data access across networks.
2Reliability
If security protocols are implemented to protect stored data, then data security is improved, but system complexity increases
Solution Approach 1:
The patent extracts the complex security logic from the storage device and places it in the client environment. The trusted counter and secret key are maintained client-side, and the client generates authentication signatures independently. This reduces the security implementation complexity on the storage device while maintaining strong security guarantees.
Solution Approach 2:
The system uses cryptographic copying through HMAC signatures, where a compact authentication token is generated from the data, counter, and secret key. This copying mechanism provides comprehensive security verification without requiring complex security protocols at every layer of the storage system.
3Reliability
If authentication mechanisms are added to verify data integrity, then data integrity is improved, but processing time increases
Solution Approach 1:
The patent changes the authentication approach from complex multi-factor verification to a streamlined HMAC signature process. By using a trusted counter that increments with each write request, the system creates unique authentication parameters for each operation, enabling fast verification through simple cryptographic hashing without extensive processing.
Data Source
AI summary
In one embodiment, a data storage client may establish a virtual replay protected storage system with an agnostic data storage. The virtual replay protected storage system may maintain a trusted counter and a secret key in a trusted client environment. The virtual replay protected storage system may encode a hash message authentication code signature based on the trusted counter, the secret key, and a data set. The virtual replay protected storage system may send a write request of the data set with the hash message authentication code signature to an agnostic data storage.