Storage Device Command Obfuscation via Inverse Data Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional storage devices with security functions based on XOR operations are vulnerable to analysis due to general operations, requiring additional hardware and complex software, and struggle to maintain data security without significant configuration changes.
Innovation Solution
A storage device with an input/output unit that processes converted commands, including command and address information subjected to data conversion, using an extractor to read key information and perform inverse conversions, thereby enhancing security by preventing direct acquisition of address information and utilizing an output controller to output data only when command information matches predetermined criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If XOR operations are used for encryption and decryption, then processing time is minimized, but security functions become vulnerable to analysis
Solution Approach 1:
The patent introduces an intermediary data conversion layer between the command and the storage device. Commands are converted into encrypted or obfuscated forms before being sent to the storage device, and converted back after retrieval. This intermediary conversion process masks the original command structure, preventing direct analysis of security functions while maintaining processing efficiency through predefined conversion tables.
Solution Approach 2:
The patent changes the parameters of command representation by transforming commands into converted commands with different data formats. The command structure is modified through data conversion processes that alter address information and command parameters, making them unrecognizable to external analysts while preserving functionality for the storage device.
2Reliability
If unique ID information is added for encryption processing, then data security is improved, but hardware complexity and software complexity increase
Solution Approach 1:
The patent makes the data conversion mechanism universal by using a single conversion table that handles multiple security functions. The same conversion table structure serves both encryption and decryption operations, as well as command obfuscation and data protection, eliminating the need for separate hardware circuits for each function.
Solution Approach 2:
Instead of using complex cryptographic hardware, the patent creates a simplified copy mechanism using lookup tables. The conversion tables store pre-computed transformed command data, allowing the storage device to simply copy and retrieve converted commands rather than performing complex real-time encryption operations with unique ID information.
3Ease of operation
If address information is exposed in converted commands, then data retrieval is simplified, but security against direct information acquisition is reduced
Solution Approach 1:
The patent segments the command into separate functional components: command identification information and converted address information. The address information is separately converted and attached to the command, allowing the storage device to process retrieval operations while keeping the original address structure hidden from external observation.
Solution Approach 2:
The patent adds a new dimension to command representation by introducing converted command fields that exist alongside original command fields. This dimensional expansion allows the system to maintain both the simplicity of direct address access internally and the security of obscured address information externally.
Data Source
AI summary
A storage device includes a storage unit that stores key information. The storage device also includes an input/output unit that inputs a converted command. Further, the storage device includes an extractor that extracts attached information from the converted command inputted, reads out, from an address according to the attached information, the key information from the storage unit, and performs an inverse data conversion corresponding to a data conversion on the converted command, using the key information, to extract command information and address information. In addition, the storage device includes an output controller that, only when the command information is equivalent to predetermined information, reads out and outputs storage data from an address of the storage unit through the input/output unit, the address of the storage data indicated by the address information extracted by the extractor.