Flash Interface Access Control for Confidential Storage Modes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage devices lack effective mechanisms to protect confidential data from unauthorized access and copying when left unattended, particularly in scenarios where physical control of the device is compromised.
Innovation Solution
A data storage device with a flash interface module (FIM) that transitions between confidential and normal modes, using security data generated from a device and user identifier to validate access, encrypting data at the flash memory unit level, and controlling access paths to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in a data storage device without protection mechanisms, then data accessibility and ease of operation are improved, but security and protection from unauthorized access deteriorate
Solution Approach 1:
The patent segments data into confidential and non-confidential portions, storing them in separate storage locations within the data storage device. Confidential data is protected by requiring authentication credentials, while non-confidential data remains freely accessible. This segmentation allows the system to maintain ease of operation for non-sensitive data while providing strong security for sensitive data.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that mediates between the user and confidential data. The authentication credentials act as an intermediary layer that must be satisfied before access to confidential data is granted. This intermediary protects security while maintaining ease of operation through automated authentication processes.
2Reliability
If protection mechanisms are implemented to secure confidential data, then security is improved, but device complexity increases
Solution Approach 1:
The patent reduces device complexity by segmenting the storage system into distinct confidential and non-confidential portions. Each portion has its own access control rules, allowing the system to apply complex security measures only where needed rather than across the entire system. This selective application of security measures reduces overall complexity.
Solution Approach 2:
The patent extracts the security complexity from the general data access path and concentrates it only in the confidential data portion. Non-confidential data can be accessed through simple, direct paths without security overhead. This extraction of security requirements to specific data portions reduces the overall complexity burden on the system.
3Reliability
If authentication credentials are required for accessing confidential data, then security is improved, but access time and productivity are reduced
Solution Approach 1:
The patent implements preliminary authentication actions that are performed once during system initialization or user login. After the initial authentication credentials are verified and stored in secure memory, subsequent accesses to confidential data can proceed more quickly without requiring full re-authentication. This preliminary action reduces the time penalty for security checks.
Solution Approach 2:
The patent introduces dynamic access control where authentication credentials are verified initially and then cached or stored in secure memory for subsequent rapid verification. The system dynamically adjusts the authentication process based on whether it is an initial or subsequent access request, allowing faster access times after the initial security check while maintaining strong security.
Data Source
AI summary
A data storage device (DSD) (1) comprising: a storage medium (13); and at least one flash interface module (FIM) (27), wherein in response to a signal (4) of a switch (3) is configured to selectively transition operation of the DSD (1) between two modes. A confidential mode, in which security data (7) is stored with user data (9) as protected data (11) in the storage medium (13) of the DSD (1) during a write operation (15), and the security data (7) is used to validate subsequent requests to access (17), or modify, the corresponding stored user data (9). A normal mode, in which access to the protected data (11) is prevented.