Storage Controller Token Authentication for Command Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storage devices using semiconductor memory face security challenges due to the exposure of internal information through vendor-specific commands, which can lead to unauthorized access and security breaches.
Innovation Solution
A storage device with a controller that implements token-based authentication to ensure only authorized users can execute specific commands, by generating and verifying tokens using public and private keys, and managing token lifetimes and access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If vendor-specific commands are supported to enable flexible storage operations, then device functionality and adaptability are improved, but security vulnerabilities increase due to exposure of internal information
Solution Approach 1:
The patent introduces a token-based authentication intermediary between the host and storage device controller. The token, generated by a trusted administrator, mediates command execution by verifying user credentials and permissions before allowing access to vendor-specific commands, thus preventing direct exposure of internal information while maintaining operational flexibility
Solution Approach 2:
The system performs preliminary authentication actions by requiring users to obtain tokens in advance from a trusted administrator. This preliminary verification of user identity and permissions prevents unauthorized access before commands are executed, addressing security concerns before they can manifest during operation
2Reliability
If authentication mechanisms are implemented to improve security, then security is improved, but device complexity increases due to additional authentication protocols
Solution Approach 1:
The patent extracts the complex authentication logic from the storage device controller and places it in the host system. The controller only needs to verify tokens presented by users, while the complex token generation, validation, and management operations are performed externally by the host and trusted administrator, reducing the complexity burden on the storage device itself
Data Source
AI summary
A storage device includes a memory device storing data, and a controller controlling the memory device. The controller obtains and stores a certificate including a public key of an administrator from a host device, provides a nonce to the host device in response to a request from the host device, receives a token request signature including the nonce, a user identifier (ID), an allowed command list and a lifetime from the host device, and when it is verified that the token request signature is generated by a legitimate administrator by decrypting the token request signature with the public key, generates a token for allowing a user corresponding to the user ID to execute a command included in the allowed command list during the lifetime, and a token secret key corresponding to the token, and provides the token and the token secret key to the host device.