Storage Queue Authentication for Partition-Level Data Theft Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing data storage devices lack effective mechanisms to securely assess and control data access requests from computer programs, particularly in scenarios where malicious programs can deceive host computer systems, leading to unauthorized access and data theft.

Innovation Solution

Implementing a method where each computer program is assigned a specific queue to access a partition of a non-volatile storage medium, with the data storage device assessing the authenticity of the queue and partition correspondence to authorize access requests, thereby providing an additional layer of security against unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional security measures such as antivirus software are implemented on host computer systems, then data security against unauthorized access is improved, but system resource consumption increases significantly

Engineering Contradiction:

Improvedata securityVSAvoidCPU power consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent introduces a queue authentication mechanism as an intermediary layer between the computer program and the storage device. The storage device itself becomes the mediator that verifies queue authenticity and controls data access, eliminating the need for resource-intensive antivirus software on the host system while maintaining strong security.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The storage device performs self-authentication by verifying whether the queue used for data access is authentic according to its own internal records. This self-service mechanism shifts the security burden from the host computer system to the storage device itself, reducing host resource consumption while maintaining security.

Inventive Principle:

Principle #25Self-service

2Reliability

If access control mechanisms are implemented to prevent malicious access, then data protection is improved, but system complexity increases

Engineering Contradiction:

Improvedata protectionVSAvoidaccess control mechanism complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the data storage medium into multiple partitions, each accessible through a dedicated queue. This segmentation isolates data access paths so that a compromised program can only access its designated partition, simplifying the overall security architecture by using straightforward partition-queue mapping rather than complex access control algorithms.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The storage device autonomously performs queue authentication using its internal records to determine whether a queue is authentic. This self-service approach eliminates the need for complex host-based access control mechanisms, reducing system complexity while maintaining effective data protection.

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If multiple computer programs are allowed to access the storage device, then system functionality is improved, but security vulnerability increases

Engineering Contradiction:

Improveprogram access capabilityVSAvoidmalicious access risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent assigns a unique queue to each computer program and divides the storage medium into corresponding partitions. This segmentation ensures that each program can access only its designated partition through its assigned queue, enabling multiple programs to coexist while preventing malicious programs from accessing other programs' data.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The queue acts as an intermediary authentication mechanism between programs and the storage device. By verifying queue authenticity before allowing access, the storage device enables multiple programs to access the storage device securely, as only authentic queues corresponding to authorized programs can access their designated partitions.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12625996B2Method to prevent data theft from a storage device

Publication Date: 2026.05.12 SANDISK TECHNOLOGIES LLC

AI summary

A method for assessing a data access request to a data storage device (DSD) by a computer program, the method comprising: assigning a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of a non-volatile storage medium of the DSD using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition; receiving, from the computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and assessing the data access request by: determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue; and in response to determining the one queue of the plurality of queues corresponding to the first partition is the first queue, determining the first queue is authentic to assess the first partition.