Storage Controller Multi-Mode Security Protocol Transition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage devices face challenges in transitioning between different security protocols without incurring data loss, particularly when switching from a password-based or authentication-based protocol to an encryption-based protocol, as this often requires memory reformatting.
Innovation Solution
Implementing a multi-mode security engine that encrypts data according to an encryption-based security protocol before transitioning, allowing the data storage device to switch protocols without reformatting the memory, thus avoiding data loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a storage device operates using an encryption-based security protocol, then data security is improved, but device complexity increases due to encryption operations
Solution Approach 1:
The controller performs encryption operations on data before it is written to the memory device, and decryption operations on read data before it is transmitted to the host. This preliminary action ensures that data is always encrypted at rest while maintaining compatibility with hosts that expect unencrypted data streams, thereby improving security without requiring the host to implement encryption functionality.
Solution Approach 2:
The controller acts as an intermediary between the host and the memory device, implementing the encryption protocol internally while presenting a standard unencrypted interface to the host. This mediator role allows the system to achieve enhanced security through encryption without increasing the complexity of the host system or requiring changes to the memory device.
2Reliability
If the storage device transitions from a password-based security protocol to an encryption-based protocol, then data security is improved, but data loss occurs due to memory reformatting
Solution Approach 1:
The controller enables encryption functionality and transitions to an encryption-based security protocol before any data is written to the memory device. By performing this transition preliminarily, the system establishes encrypted storage from the outset, eliminating the need for subsequent memory reformatting operations that would cause data loss.
Solution Approach 2:
The system changes the security protocol parameter from password-based to encryption-based at the controller level without altering the physical memory structure or requiring reformatting. This parameter change is implemented through software/firmware configuration in the controller, allowing the transition to occur without affecting the stored data.
3Ease of operation
If the storage device uses an authentication-based security protocol, then ease of operation is improved, but data security deteriorates compared to encryption-based protocols
Solution Approach 1:
The controller serves as an intermediary that implements encryption internally while maintaining a simple authentication interface for the host. Users can continue to use straightforward authentication methods (passwords, PINs) at the host level, while the controller automatically handles the complex encryption operations, thus preserving ease of operation while achieving enhanced security.
Solution Approach 2:
The system replaces the reliance on host-based authentication mechanisms with controller-based encryption mechanisms. Instead of depending on the host's authentication security, the system substitutes a more secure encryption implementation at the storage device level, while maintaining the simple authentication interface for user convenience.
Data Source
AI summary
A data storage device includes a memory and a controller that is coupled to the memory. The controller includes an authentication engine, an interface, and an encryption engine. The authentication engine is configured to authenticate an accessing device based on a message received from the accessing device. The interface is configured to receive data from the accessing device. The message is associated with a first security protocol that does not specify that the data is to be encrypted. The encryption engine is configured to encrypt the data in accordance with a second security protocol, and the controller is configured to receive, after encrypting the data, a request from the accessing device to operate according to the second security protocol.