Security Partition Slots for On-the-Fly Key Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems stall data transfer when modifying security parameters, which is not suitable for enterprise environments with strict quality of service (QoS) requirements due to complex and time-consuming firmware flows.
Innovation Solution
Incorporating multiple security partition slots in the device controller, where each slot holds security parameters and an IO counter, allowing on-the-fly modifications without stalling IO traffic by using the slots as ping-pong buffers to freeze values on one slot until previous queued commands are completed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the data storage device stops fetching new commands and waits to complete all pending commands before updating security parameters, then security parameter modification is ensured to be consistent, but data transfer is stalled and QoS deteriorates
Solution Approach 1:
The security parameters are segmented into two separate sets (first set and second set), allowing independent modification without affecting ongoing operations. The controller can switch between these sets atomically, ensuring consistency while maintaining data transfer continuity.
Solution Approach 2:
The second set of security parameters is prepared and validated in advance before being activated. This preliminary action ensures that when the switch occurs, the new parameters are ready and consistent, avoiding the need to stall data transfer for parameter validation.
2Manufacturing precision
If complex firmware flows are implemented to track all outstanding IOs and determine correct timing for changing security parameters, then security parameter modification accuracy is improved, but firmware complexity and processing time increase
Solution Approach 1:
The security parameter storage is divided into two distinct sets, eliminating the need for complex tracking of individual parameter states. The controller simply switches between set 1 and set 2,大幅 reducing firmware complexity while maintaining modification accuracy.
Solution Approach 2:
Instead of tracking and managing individual parameter changes during ongoing operations, the system inverts the approach by preparing alternative parameter sets in advance and switching between them. This inversion simplifies the control logic significantly.
3Productivity
If security parameters are modified during active data transfer, then QoS and system performance are improved, but risk of inconsistent security state increases
Solution Approach 1:
Security parameters are divided into two complete, independent sets. Each set represents a consistent security state, allowing the controller to switch between states atomically during data transfer without risking partial or inconsistent updates.
Solution Approach 2:
A complete copy of the security parameters is maintained in the second set before activation. This copying ensures that the new parameter set is fully validated and consistent before being switched to, eliminating the risk of inconsistent security states during modification.
Data Source
AI summary
The present disclosure generally relates to modifying support security parameters without stalling data transfer. Rather than stalling the data transfer when support security modification requests are received. The disclosure proposes incorporating multiple security partition slots in the device controller. Each slot holds security parameters and an IO counter that holds the current number of pending commands in the device that are going to use that slot. The security partition slots are used as ping-pong buffers allowing the device to modify a second slot while freezing the values on a first slot until completing the previous queued commands that are still under execution. The slots allow support security parameter on-the-fly modifications without stalling any IO traffic. The slots feature is very important for QoS and system performance.