Storage Device Write Protection via Message Authentication

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional storage systems lack robust write protection mechanisms, allowing unauthorized access to critical components like boot loaders and kernel images, which can lead to vulnerabilities such as rooting.

Innovation Solution

A data structure and method for controlling write protection in storage devices, using a non-volatile memory with a memory partition identifier, start address, length information, and type information to apply write protection, along with a message authentication code for secure operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If write protection is set by a predetermined command, then write protection can be applied to memory areas, but anyone can release the write protection or change its setting

Engineering Contradiction:
Improvewrite protection reliabilityVSAvoidwrite protection accessibility
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces an authentication code as an intermediary mechanism between the write protection command and the memory area. The authentication code acts as a mediator that verifies the legitimacy of write protection operations, preventing unauthorized access while allowing legitimate operations to proceed. This resolves the contradiction by adding a security layer that maintains reliability without completely blocking legitimate operations.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements preliminary authentication before applying write protection. The authentication code is verified in advance before the write protection is actually set, ensuring that only authorized operations can modify the protection state. This preliminary action prevents unauthorized changes while allowing legitimate users to establish and manage write protection as needed.

Inventive Principle:
Principle #10Preliminary action

2Ease of operation

If write protection is released to allow access, then memory areas become accessible, but critical components like boot loaders and kernel images are exposed to dangerous access

Engineering Contradiction:
Improvememory accessibilityVSAvoidunauthorized access vulnerability
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The authentication code serves as an intermediary that controls access to memory areas. It mediates between the need for accessibility and the need for security by verifying the legitimacy of access requests. Legitimate access is permitted while unauthorized access is blocked, resolving the contradiction between ease of operation and protection from harmful factors.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent applies different authentication requirements to different memory areas. Critical components like boot loaders and kernel images have stricter protection with authentication codes, while other areas may have more permissive access. This local differentiation allows easy access where needed while maintaining strong security where required, resolving the contradiction between accessibility and vulnerability.

Inventive Principle:
Principle #3Local quality

Data Source

PatentUS11880313B2Storage system and method for performing and authenticating write-protection thereof
Publication Date: 2024.01.23 SAMSUNG ELECTRONICS CO LTD
  • US11880313B2 patent drawing
  • US11880313B2 patent drawing
  • US11880313B2 patent drawing

AI summary

In one embodiment, the method includes receiving, at a storage device, a request. The request includes a request message authentication code and write protect information. The write protect information includes at least one of start address information and length information. The start address information indicates a logical block address at which a memory area in a non-volatile memory of the storage device starts, and the length information indicates a length of the memory area. The method also includes generating, at the storage device, a message authentication code based on (1) at least one of the start address information and the length information, and (2) a key stored at the storage device; authenticating, at the storage device, the request based on the generated message authentication code and the request message authentication code; and processing, at the storage device, the request based on a result of the authenticating.