Hardware Switched Memory Partition Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage devices lack effective mechanisms to securely control access to memory partitions, particularly in preventing unauthorized access and malicious activities, as they rely on software-based logical controls that are vulnerable to attacks and inconvenient for users needing to read and write data.
Innovation Solution
A data storage device with a hardware-based solution that uses a switch to selectively connect and disconnect physical memory blocks of secure and non-secure partitions to the host via a data path, enabling secure mode transitions only upon user authentication and employing a cryptography engine for encryption and decryption of user data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If read-only memory protection is implemented to prevent data modification and deletion, then data integrity is improved, but data accessibility deteriorates since users cannot write or modify data
Solution Approach 1:
The storage medium is divided into multiple partitions with different security levels (secure and non-secure partitions). Each partition can be independently accessed or protected, allowing users to store sensitive data in secure partitions while maintaining read/write access to non-secure partitions, thus resolving the contradiction between data integrity and accessibility
Solution Approach 2:
The system dynamically transitions between secure mode and non-secure mode based on user authentication and switch actuation. In non-secure mode, data is accessible for reading and writing; in secure mode, data protection is enhanced. This dynamic switching allows the system to adapt between accessibility and integrity requirements
2Reliability
If software-based permission systems are implemented to control read and write operations, then data security is improved, but device complexity deteriorates due to multiple permission configurations needed for different hosts
Solution Approach 1:
The system extracts the security control mechanism from software-based permission systems and implements it through hardware components (physical switch and partition controller). This hardware-based approach simplifies the system by removing the need for complex software permission configurations for different hosts, while maintaining robust data security
Solution Approach 2:
A partition controller acts as an intermediary between the host and storage medium, managing secure mode transitions and partition access. This intermediary component handles security control centrally, eliminating the need for each host to implement its own permission system, thus reducing device complexity while maintaining security
3Reliability
If encryption is implemented to protect confidential data, then data confidentiality is improved, but vulnerability to attacks deteriorates since unauthorized users can still obtain encrypted data and attempt to break the encryption
Solution Approach 1:
The system applies preliminary protection by physically disconnecting secure partitions from the data path before unauthorized access can occur. The switch mechanism prevents encrypted data from being transmitted to the host in the first place, providing a first line of defense that complements encryption and prevents attackers from obtaining encrypted data to crack
Data Source
AI summary
A data storage device comprising a non-volatile storage medium configured to store user data, where the storage medium is organized as one or more partitions, including at least one secure partition. The partitions are defined by a corresponding set of pre-specified physical memory blocks of the storage medium. The data storage device also includes a data path configured to provide data communication between a host computer system and the storage medium of the data storage device. A partition controller of the data storage device is coupled to a switch. In response to an actuation of the switch, the partition controller is configured to cause the data storage device to selectively transition between: a secure mode in which the set of physical memory blocks of each secure partition is connected to the host via the data path; and a non-secure mode in which the set of physical memory blocks of each secure partition is disconnected from the host via the data path.