Storage Device Write Protection via HMAC Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional storage systems lack robust mechanisms for secure write protection, particularly for boot loaders and kernel images, which can be vulnerable to unauthorized access and changes even when write protection is set.
Innovation Solution
A data structure and method for managing write protection in storage devices that includes a memory partition identifier, start address, length, and type information, using a hash-based message authentication code (HMAC) to authenticate requests and control write access, ensuring secure and dynamic write protection settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional write protection commands are used, then write protection can be set and released, but the protection can be easily bypassed or changed by unauthorized users
Solution Approach 1:
The patent implements nested protection by placing multiple layers of security within the write protection mechanism. The data structure contains partition identifiers that nest within memory areas, which nest within the storage device. The HMAC authentication code provides an additional nested layer of verification within the write protection command structure, creating纵深 defense against unauthorized access.
Solution Approach 2:
The patent changes the parameters of write protection by introducing type information that defines different protection modes (read-only, write-only, read-write). It also changes the parameter representation by using bit fields within the data structure to encode multiple protection attributes, transforming the simple binary protected/unprotected state into a multi-dimensional protection parameter space.
2Reliability
If write protection is applied to entire partitions, then security is improved, but flexibility to protect only specific areas is reduced
Solution Approach 1:
The patent segments the storage space into memory areas with specific start addresses and lengths, allowing selective write protection of individual regions rather than requiring protection of entire partitions. This segmentation enables granular control where different memory areas can have different protection statuses independently.
Solution Approach 2:
The patent applies local quality by assigning different write protection attributes to different memory areas based on their specific requirements. Each memory area can have its own protection type (read-only, write-only, read-write) determined by its content and function, allowing critical areas to be heavily protected while less critical areas remain flexible.
3Object-affected harmful factors
If authentication mechanisms are added to verify write protection requests, then unauthorized access is prevented, but processing time and complexity increase
Solution Approach 1:
The patent performs preliminary action by pre-calculating and storing the expected HMAC authentication code along with the write protection data structure. When a write request arrives, the authentication is verified by comparing the received HMAC with the pre-stored value, eliminating the need for complex real-time authentication computations and reducing processing time.
Data Source
AI summary
In one embodiment, the method includes receiving, at a storage device, a request. The request includes a request message authentication code and write protect information. The write protect information includes at least one of start address information and length information. The start address information indicates a logical block address at which a memory area in a non-volatile memory of the storage device starts, and the length information indicates a length of the memory area. The method also includes generating, at the storage device, a message authentication code based on (1) at least one of the start address information and the length information, and (2) a key stored at the storage device; authenticating, at the storage device, the request based on the generated message authentication code and the request message authentication code; and processing, at the storage device, the request based on a result of the authenticating.