Secure Direct Platter Access for Disk Drives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional magnetic disk drives face limitations in secure bulk data transfers due to inadequate integrity verification and origin authentication, leading to speed reductions and increased costs, especially when handling large data volumes, as they rely on volatile RAM buffers and broad user access permissions.
Innovation Solution
The implementation of a system that uses the Protected Area Run Time Interface Extension Services (PARTIES) technology to create a secured storage sub-area within the magnetic disk drive, allowing direct platter access for bulk data transfers, bypassing operating system reliance and command payload limits, while ensuring data authenticity and confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password protection is used for User Area access, then access authorization is provided, but integrity verification and origin authentication are not performed
Solution Approach 1:
The storage medium is divided into distinct areas: User Area for normal storage and Hidden System Area for secure operations. This segmentation allows different security mechanisms to operate in different zones, with the Hidden System Area serving as a secure enclave for integrity verification and authentication operations independent of User Area access controls.
Solution Approach 2:
The Hidden System Area acts as an intermediary secure zone between the host system and User Area data. It provides a protected environment where authentication and integrity verification operations can be performed without exposing the verification mechanisms to the same access risks as the User Area, thereby ensuring reliable verification while maintaining authorization control.
2Reliability
If authorization is tested for each block transfer, then specific authorization protocol is provided, but read/write operation speed is reduced
Solution Approach 1:
Authorization and authentication are performed in advance by preparing authorized lists and cryptographic keys in the Hidden System Area before bulk data transfers begin. The host system loads authorized device lists and authentication credentials into the secure Hidden System Area upfront, allowing subsequent bulk operations to proceed without per-block verification overhead while maintaining security through pre-established trust relationships.
Solution Approach 2:
Once authorization is established in the Hidden System Area, bulk data transfers can proceed continuously without interruption for verification checks. The pre-loaded authorized lists enable uninterrupted high-speed data movement between storage locations, maintaining continuous useful action while the Hidden System Area periodically updates authorization states without halting transfer operations.
3Reliability
If volatile RAM buffer is used for data caching, then verification and authentication operations can be performed, but data buffer size is limited and cost increases
Solution Approach 1:
The Hidden System Area creates a persistent copy of the secure buffer functionality directly on the storage medium rather than relying on volatile RAM. Authentication keys, authorized device lists, and verification data are copied into this protected storage area, eliminating the need for large volatile memory allocations while maintaining verification capabilities through persistent storage of security-critical information.
Solution Approach 2:
The Hidden System Area provides a disposable secure buffer zone that can be cleared and reinitialized without expensive hardware modifications. Rather than investing in large amounts of expensive volatile RAM, the system uses a portion of the existing storage medium as a temporary secure buffer that can be wiped after use, providing cost-effective security operations without permanent hardware overhead.
4Reliability
If specialized buffer storage area is created on storage medium, then data verification can be performed, but operating system resources are significantly consumed
Solution Approach 1:
The Hidden System Area is designed to be self-sufficient, managing its own authentication keys, authorized device lists, and verification operations without requiring operating system intervention. It independently handles security-critical functions such as verifying device authorization, managing cryptographic keys, and controlling access to bulk transfer operations, thereby reducing operating system resource consumption while maintaining verification reliability.
Solution Approach 2:
Security verification functions are extracted from the operating system and relocated to the Hidden System Area. The authentication and authorization logic that would normally require OS-level privileges and resource management is removed from the OS kernel and embedded in the storage device's secure enclave, eliminating the need for complex OS resource allocation while ensuring verified data operations.
Data Source
AI summary
Bulk data transfers by directly accessing a persistent and secured area on the data storage device, e.g., a disk drive having a magnetic storage medium, without relying on the system operating system to execute its read/write operations. For a disk drive, the Protected Area Run Time Interface Extension (PARTIES) technology is applied to create and organize a secured sub-area within a secured storage area. The secured sub-area is a data buffer to and from which large data file transfers can be made with data authenticity and confidentiality. Since this new secured sub-area is not organized and protected by the operating system, it is inherently protected from attack by viruses or Trojan horse software whose effectiveness depends on their ability to maliciously direct the operating system. In addition, the read/write operations bypass command payload limits while reducing data and command validation costs.