NVMe Controller Memory Buffer Host Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Non-Volatile Memory Express (NVMe) virtualization systems, unauthorized access to controller memory buffers poses a significant security risk, potentially leading to data loss and theft, as multiple hosts interact without awareness of other virtual hosts, compromising user data stored in these buffers.
Innovation Solution
A storage system and method are implemented that include a controller memory buffer with a dedicated submission queue and completion queue for authorized hosts, where requests are authenticated by comparing host identifiers, ensuring only authorized hosts access the buffer, thereby denying unauthorized access in both direct and indirect access modes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple hosts access the controller memory buffer without authentication, then access speed and productivity are improved, but security and data protection deteriorate
Solution Approach 1:
The system performs preliminary authentication of the host identifier against the authorized host identifier in the controller memory buffer before allowing any data access. This preliminary check ensures that only authorized hosts can access the buffer, preventing unauthorized access while maintaining high access speeds for authenticated hosts.
2Object-affected harmful factors
If host authentication is implemented, then security is improved, but access time and device complexity increase
Solution Approach 1:
The controller memory buffer contains the authorized host identifier that is automatically compared with the requesting host's identifier during the memory access process. This self-service authentication mechanism eliminates the need for separate authentication steps, as the comparison occurs naturally within the existing memory access pathway, thus not adding significant access time delay.
3Reliability
If dedicated submission queue and completion queue are created for each host, then data protection is improved, but device complexity increases
Solution Approach 1:
The system segments the controller memory buffer by creating separate submission queues and completion queues for each authorized host. This segmentation ensures that each host can only access its own dedicated queues, preventing data leakage between hosts while maintaining a relatively simple implementation through identifier-based separation rather than complex access control mechanisms.
Data Source
AI summary
A storage system and method for secure host controller memory buffer access are provided. In one embodiment, a storage system is provided comprising a storage area configured to store a database comprising a submission queue and a completion queue dedicated for use by an authorized host, and a controller. The controller is configured to: receive a request to access the storage area; determine whether the request is from the authorized host or from an unauthorized host; in response to determining that the request is from the authorized host, grant the request; and in response to determining that the request is from an unauthorized host, deny the request. Other embodiments are provided.