Flash Access Restriction Enforcer for Managed NAND
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional eMMC/UFS controllers provide limited access control features, making it difficult to achieve secure usage models, particularly in scenarios where trusted entities need to update data at runtime or require read protection for flash storage, as they lack fine-grained read/write access controls and do not support read protection for partitions.
Innovation Solution
The implementation of a managed flash controller with a flash access restriction enforcer that includes configuration tables for storing access control rules, an access rule configurer to define restrictions, and an access rule enforcer to enforce these rules, along with an ownership enforcer to manage access transactions, providing fine-grained read/write access controls and read protection for managed NAND flash devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional eMMC/UFS controllers are used, then device complexity is reduced, but access control security and fine-grained read/write protection are insufficient
Solution Approach 1:
The access control functionality is segmented into distinct modules: configuration tables for storing access control rules, access rule configurer for defining restrictions, access rule enforcer for enforcing rules, and ownership enforcer for managing access transactions. This segmentation allows each component to handle specific aspects of security without overwhelming complexity in a single unified system.
Solution Approach 2:
The patent introduces intermediary components between the host and flash memory that mediate access control. The access rule enforcer and ownership enforcer act as intermediaries that intercept and validate access transactions before they reach the flash memory, providing security without requiring changes to the fundamental controller architecture.
2Reliability
If fine-grained access control rules are implemented, then read protection for partitions is achieved, but device complexity increases
Solution Approach 1:
Access control rules are configured and stored in configuration tables before actual data access operations occur. The access rule configurer pre-defines restrictions on address ranges and data types, so that when access transactions occur, the access rule enforcer can quickly reference pre-configured rules without complex real-time decision-making, reducing operational complexity.
Solution Approach 2:
The system manages access control by changing parameter states rather than structural complexity. The ownership enforcer uses ownership bits and the access rule enforcer uses rule identifiers to manage access rights. These parameter-based approaches provide fine-grained control while maintaining simple hardware implementation through state management rather than complex logic.
3Adaptability or versatility
If trusted entities can update data at runtime, then system flexibility is improved, but security risks increase without proper access control
Solution Approach 1:
The ownership enforcer implements a feedback mechanism that tracks which entities have access to which data regions. When a trusted entity attempts to update data at runtime, the ownership enforcer verifies current ownership status and grants or denies access accordingly. This feedback loop enables runtime flexibility while continuously monitoring and preventing unauthorized access attempts.
Solution Approach 2:
The access control system is dynamic rather than static. The access rule configurer can define different access rights for different entities, and the ownership enforcer can grant or revoke access rights during runtime based on trust relationships. This dynamic capability allows the system to adapt to changing security requirements while maintaining protection against unauthorized access.
Data Source
AI summary
An embodiment of a memory apparatus may include a managed flash controller to control a managed flash device, and a flash access restriction enforcer communicatively coupled to the managed flash controller to enforce access controls on read and write transactions to the managed flash device. Other embodiments are disclosed and claimed.