Storage Device Controller User-Client Pair Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage devices with nonvolatile memory face security risks due to the potential leakage of account information, allowing unauthorized access and data theft, as they rely solely on account authentication without additional user-client pair verification.
Innovation Solution
A storage device with a controller that manages user identification and authentication information, including hash values, to authenticate user-client pairs and control access rights, enhancing security by verifying user-client information separately from account authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If account authentication is used for storage device access, then ease of operation is improved, but security is worsened due to potential account information leakage
Solution Approach 1:
The authentication system is segmented into two independent parts: account authentication (performed by the server) and user-client pair authentication (performed by the storage device). This segmentation allows the storage device to verify additional authentication information locally without requiring server involvement, thereby maintaining security while preserving ease of operation.
Solution Approach 2:
The storage device acts as an intermediary authentication layer between the client and the data. It holds and verifies user-client pair authentication information independently, serving as a mediator that prevents unauthorized access even when account information is compromised, thus enhancing security without complicating the user experience.
2Device complexity
If only account authentication is implemented, then device complexity is reduced, but security against unauthorized access is insufficient
Solution Approach 1:
The authentication functionality is segmented between the server (account authentication) and the storage device (user-client pair authentication). This division allows the storage device to implement enhanced security through local verification of additional authentication information without requiring a complete redesign of the authentication system, thus managing complexity while improving security.
Solution Approach 2:
The user-client pair authentication information is registered and stored in advance in the storage device before actual data access occurs. This preliminary action enables the storage device to perform security verification locally and independently during data operations, enhancing security without adding complexity to the real-time access process.
3Reliability
If user-client pair authentication is added, then security is improved, but device complexity increases
Solution Approach 1:
The authentication system is divided into two independent modules: account authentication managed by the server and user-client pair authentication managed by the storage device. This segmentation allows the storage device to implement enhanced security through local verification without centralizing all authentication logic, thus improving security while distributing system complexity appropriately.
Solution Approach 2:
The storage device performs self-service authentication by independently verifying user-client pair authentication information locally without requiring continuous server involvement. This self-service capability enhances security through local verification while reducing the complexity of centralized authentication management, as the storage device handles its own authentication verification autonomously.
Data Source
AI summary
According to one embodiment, a storage device includes a nonvolatile memory and a controller. The controller manages first user identification information and first authentication information including a hash value calculated from the first user identification information and a first device identification information of a first client device. The controller receives an access request to the nonvolatile memory, user identification information, and authentication information transmitted from an external device, and accepts the access request in a case where the user identification information received matches the first user identification information, and the authentication information received matches the first authentication information.