Flash Storage Cryptographic Hash Verification After Error Correction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory storage systems lack robust cryptographic mechanisms to ensure data integrity and security, particularly in flash memory devices, where data can be inadvertently or maliciously altered, and existing protection mechanisms are insufficient in the face of increasing security demands.
Innovation Solution
Implementing a cryptographic engine within the memory device to generate and verify cryptographic tokens, such as HMAC-SHA256, ensuring that data read back matches the original data written, thereby providing real-time integrity checking without significant performance degradation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic integrity protection is implemented in flash memory devices, then data security and reliability are improved, but device complexity increases
Solution Approach 1:
The patent merges the cryptographic engine functionality directly into the flash memory device structure. The cryptographic engine includes a processor and memory that are integrated with the flash memory array, allowing integrity protection to be performed within the device itself rather than requiring external systems. This integration resolves the contradiction by embedding the complex cryptographic functions within the existing device architecture.
Solution Approach 2:
The patent introduces a controller as an intermediary component that manages the cryptographic operations between the host system and the flash memory device. The controller receives data from the host, processes it through the integrated cryptographic engine, and handles the integrity verification. This intermediary approach allows the cryptographic complexity to be managed separately from the core flash memory functionality.
2Reliability
If real-time integrity checking is performed, then data security is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary cryptographic actions by pre-computing and storing integrity information (such as hashes or authentication tags) along with the data in the flash memory device. When data is read, the system can quickly verify integrity by comparing pre-stored values rather than performing complex cryptographic operations in real-time. This preliminary preparation significantly reduces verification time while maintaining strong integrity protection.
Solution Approach 2:
The patent creates a copy of the integrity verification process within the flash memory device itself. By embedding the cryptographic engine and storing integrity data locally in the device, the system can perform rapid verification without requiring time-consuming external cryptographic computations. The local copy of the integrity checking mechanism enables real-time verification with minimal processing delay.
3Reliability
If cryptographic engine is integrated into memory device, then data protection capability is improved, but manufacturing complexity increases
Solution Approach 1:
The patent segments the flash memory device into distinct functional modules: the flash memory array for data storage, the cryptographic engine for integrity protection, and the controller for coordination. This segmentation allows each component to be designed, tested, and manufactured independently before being integrated into the final device. The cryptographic engine is implemented as a separate processor unit with its own memory, making it easier to manufacture than a fully integrated solution.
Data Source
AI summary
A storage device includes a memory storage region and a controller having a processor. The processor retrieves user data from the memory storage region using a physical block address corresponding to a logical block address (LBA), in response to a read command. The retrieved user data includes a first hash received through a host interface in a prior host data transmission. The processor further performs error correction on the user data to generate error-corrected user data. The processor further causes a cryptographic engine to produce a second hash of the error-corrected user data. The first hash is compared to the second hash associated with the error-corrected user data to determine a match result. A notification is generated in response to the match result.