Secure HMB Initialization via Merkle Tree Path Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data storage devices face security threats due to external host memory buffers (HMBs) being vulnerable to network attacks, leading to delayed initialization and increased latency during initialization processes.
Innovation Solution
Implementing a secure HMB protocol by initializing only the necessary hashes along the path between the top hash and the target data block in a Merkle Tree, using non-initialized bits to mark irrelevant hashes and data blocks, thereby reducing the number of initialized components and accelerating initialization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all hashes and data blocks of the Merkle Tree are initialized during HMB initialization, then security is ensured, but initialization time increases causing delayed usage of the HMB
Solution Approach 1:
The Merkle Tree is segmented into multiple hash levels, and only the necessary segments (hashes along the path from root to target data block) are initialized. This segmentation allows the system to initialize a subset of the total hashes rather than all hashes, reducing initialization time while maintaining security for the specific data block being accessed.
Solution Approach 2:
Different parts of the Merkle Tree have different initialization states. The hashes along the path to the target data block are initialized with valid values, while other hashes remain uninitialized or are initialized on-demand. This local quality approach ensures that security is maintained for the specific data block being accessed without requiring full initialization of the entire tree.
2Ease of manufacture
If the HMB is used to reduce DRAM size and device cost, then device cost is reduced, but the device becomes vulnerable to network attacks such as replay attacks
Solution Approach 1:
The system performs preliminary initialization of only the necessary hashes along the path to the target data block before data access operations. This preliminary action ensures that the security-critical path is properly initialized and validated before use, protecting against replay attacks while maintaining the cost benefits of using HMB.
Solution Approach 2:
The system uses the Merkle Tree structure with hash verification as a feedback mechanism to validate data integrity and detect replay attacks. By verifying the hash path from the root to the target data block, the system can detect tampered or replayed data, thus protecting against network attacks while using the cost-effective HMB.
Data Source
AI summary
The present disclosure generally relates to data storage devices and related methods that use secure host memory buffers (HMBs) and low latency operations. A controller of the data storage device is configured to access the HMB, where the HMB stores a Merkle Tree. When the HMB is initialized, the controller determines a number of hash levels of the Merkle Tree. Each hash level of the Merkle Tree comprises one or more hashes. When storing location data in a target data block of the Merkle Tree, the controller is configured to initialize only the hashes along a path between a top hash and the target data block. Each hash along the path has a non-initialized hash coupled to a common hash. The non-initialized hash is programmed with a non-initialized bit, such that only the relevant hashes and data blocks are initialized.