Security Management Unit for Host Controller Interface

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional host controller interfaces face performance degradation due to significant computational overhead when switching between different data security policies, especially when processing data with non-secure processors, as they often require encrypting data across all regions of a storage device.

Innovation Solution

Implementing a security management unit with a security policy table that allows for differential management of security policies across various regions of a storage device, using sector information to select appropriate security policies and control encryption operations, thereby minimizing overhead and optimizing performance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data encryption is applied to all regions of storage device, then data security is improved, but computational overhead increases significantly

Engineering Contradiction:

Improvedata securityVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The storage device is divided into multiple regions (secure region and non-secure region), and encryption is applied selectively to only the secure region. This segmentation allows the system to maintain data security for sensitive data while avoiding the computational overhead of encrypting all data, thus resolving the contradiction between security and performance.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different security policies are applied to different regions of the storage device. The secure region employs encryption while the non-secure region does not. This local differentiation allows the system to provide strong security where needed without sacrificing overall system performance, directly addressing the technical contradiction.

Inventive Principle:

Principle #3Local quality

2Reliability

If security policy switching is implemented between secure and non-secure processors, then data security is improved, but processing speed decreases

Engineering Contradiction:

Improvedata securityVSAvoidprocessing speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The system pre-establishes separate security policies for secure and non-secure processors and pre-configures the encryption/decryption operations for each region. When data is accessed, the appropriate security policy is already in place, eliminating the need for runtime policy switching and maintaining high processing speed while ensuring data security.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The host controller interface acts as an intermediary that automatically selects and applies the appropriate security policy based on the processor type and data region. This intermediary function eliminates the need for processors to switch security policies manually, maintaining processing speed while ensuring proper security enforcement.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If encryption operations are performed on all data, then unauthorized access is prevented, but computational overhead increases

Engineering Contradiction:

Improveaccess controlVSAvoidcomputational overhead

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

Instead of applying encryption to all data (excessive action), the system applies encryption only to the secure region where sensitive data is stored (partial action). This approach provides sufficient access control for protected data while significantly reducing computational overhead and energy consumption, resolving the technical contradiction.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS9785784B2Security management unit, host controller interface including same, method operating host controller interface, and devices including host controller interface

Publication Date: 2017.10.10 SAMSUNG ELECTRONICS CO LTD

AI summary

A method of operating a host controller interface includes receiving a buffer descriptor including sector information from a main memory, fetching data by using a source address included in the buffer descriptor, selecting one of a plurality of entries included in a security policy table by using the sector information, and determining whether to encrypt the fetched data by using a security policy included in the selected entry.