Programmable Security Identifier for Storage Reversion Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing persistent storage devices lack efficient mechanisms for secure and scalable management of physical security identifiers, particularly in data storage facilities where ownership and usage may differ, leading to vulnerabilities and burdensome reversion processes.
Innovation Solution
Implementing a persistent storage device with a primary and secondary physical security identifier system, where the primary identifier is fixed at manufacture and the secondary is customizable, allowing for secure reversion and configuration management through distinct authorization levels, enabling secure data erasure and access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single physical security identifier is used in persistent storage devices, then the device structure remains simple, but security management becomes inefficient and vulnerable in large-scale data storage facilities
Solution Approach 1:
The patent segments the physical security identifier system into multiple identifiers (first physical security identifier and second physical security identifier) with different authorization levels. The first identifier is fixed at manufacture and stored in permanent persistent storage, while the second identifier is programmable and stored in reconfigurable persistent storage. This segmentation allows differentiated security management for different operational scenarios, improving security management efficiency without requiring complete system redesign.
Solution Approach 2:
The patent adds an authorization level dimension to the identifier system by assigning different authorization levels to different identifiers. The first identifier has a first authorization level that permits identifier programming commands, while the second identifier has a second authorization level that does not permit such commands. This dimensional addition enables hierarchical security management, allowing owners to delegate control to users with limited privileges while maintaining overall system security.
2Adaptability or versatility
If the persistent storage device allows identifier programming commands with any identifier, then flexibility in security management is improved, but security vulnerabilities increase due to unauthorized modifications
Solution Approach 1:
The patent applies local quality by associating different authorization levels with different identifiers and their corresponding operations. The first identifier with its higher authorization level permits identifier programming commands, while the second identifier with its lower authorization level does not permit such commands. This localized authorization approach allows flexible security management for specific operations while maintaining security boundaries, enabling owners to program identifiers but preventing users from doing so.
3Productivity
If a revert command can erase any namespace without verification, then the reversion process is fast and simple, but security is compromised allowing unauthorized data loss
Solution Approach 1:
The patent implements preliminary action by requiring the revert command to include a physical security identifier as verification before executing the erase operation. The controller checks whether the provided identifier matches the stored first or second physical security identifier before permitting the namespace erasure. This preliminary verification step ensures that only authorized users can trigger reversion, preventing unauthorized data loss while maintaining efficient processing for authorized operations.
Data Source
AI summary
A system and method using a programmable physical security identifier. In some embodiments, the method includes: receiving, by a persistent storage device including persistent storage, a first identifier programming command, the first identifier programming command being for defining a first physical security identifier; storing, by the persistent storage device, the first physical security identifier; receiving, by the persistent storage device, a revert command, the revert command including an input physical security identifier; and erasing, by the persistent storage device, based on the input physical security identifier matching the first physical security identifier, a portion of the persistent storage.