Storage system and method for performing secure write protect thereof

Patent metadata

Field	Value
Publication number	US-10257192-B2
Application number	US-201514710934-A
Country	US
Kind code	B2
Filing date	May 13, 2015
Priority date	May 29, 2014
Publication date	Apr 9, 2019
Grant date	Apr 9, 2019

Abstract

A storage system includes a host configured to provide a request for setting or clearing secure write protection; and a storage device including a register, the register including fields that store information for controlling write protection attributes and a secure mode of the storage device, the storage device being configured to authenticate a request of the host when the secure mode is enabled, wherein the storage device is configured set or clear the secure write protection based on the request of the host when the storage device authenticates the request of the host, wherein after the secure mode is set, the storage device restricts an access of an unauthenticated host for setting and clearing write protection, and wherein the register comprises a secure write protection (WP) configuration masking field for controlling register fields of the register that are associated with write protection.

First claim

What is claimed is:

1. A storage system comprising:
a host; and
a storage device,
the host configured to provide a request for setting or clearing write protection (WP) of the storage device; and
the storage device including a register, the register including fields that store information for controlling attributes of the WP and information for controlling a secure mode of the storage device, the register including a secure WP support field configured to indicate whether or not the storage device supports the secure mode and a secure WP enable field configured to control a state of the secure mode of the storage device,
wherein, before the secure mode is set, the host can set the WP without being authenticated,
wherein, after the host reads the secure WP support field and determines that the storage device supports the secure mode, the host is configured to set the secure mode by setting the secure WP enable field through authentication using at least one keyed-hash message authentication code (HMAC,
wherein after the secure mode is set, the storage device restricts an access of and unauthenticated host for setting and clearing the WP, and
wherein the register further comprises a secure WP configuration masking field for controlling register fields of the register that are associated with the WP, and the register fields are aligned to secure WP configuration masking field and are accessed depending on register values of the secure WP configuration masking field.

2. The storage system of claim 1 , wherein the storage device is configured such that a number of the register fields controlled by the secure WP configuration masking field is greater than a number of bits included in the WP configuration masking field.

3. The storage system of claim 1 , wherein the storage system is configured such that storage device requires requests of the host to be authenticated using at least one of HMAC, SHA256, or MD5 before the storage device allows the host to access the secure WP configuration masking field.

4. The storage system of claim 1 , wherein the storage system is configured such that storage device requires requests of the host to set or clear the secure mode to be authenticated using at least one of HMAC, SHA256, or MD5 before the storage device allows the host to set or clear the secure mode.

5. The storage system of claim 4 , wherein the host is configured such that the request of the host to set or clear the secure mode is provided using a data frame that includes a request/response type field, a write counter field, a nonce field, a block counter field, a data field, an address field, a result field, and an HMAC field.

6. The storage system of claim 1 , wherein the storage device is an embedded MultiMediaCard (eMMC) and is configured to implement the secure mode using a replay protected memory block (RPMP).

7. The storage system of claim 1 , wherein the storage device includes at least one of a plurality of flash memory devices, the plurality of flash memory devices each including a three-dimensional memory array.

8. A storage system comprising:
a host; and
a storage device,
the storage device being configured to implement a write protection (WP) mode such that, when the WP mode is in an enabled state, the storage device prevents data stored in the storage device from being changed until the WP mode is in a disabled state,
the storage device being configured to receive a WP change request, the WP change request being a request to change a state of the WP mode,
the host being configured to read a secure WP support field of the storage device, the secure WP support field configured to indicate whether or not the storage device supports a secure mode,
the storage device being configured to implement a secure mode such that,
the secure mode is in an disabled state when a secure WP enable field of the storage device is not set,
the secure mode is in an enabled state when, after the host reads the secure WP support field and determines that the storage device supports the secure mode, the secure WP enable field of the storage device is set by the host through authentication using a keyed-hash message authentication code (HMAC),
when the secure mode is in the disabled state, the storage device changes the state of the WP mode in response to the WP change request, and
when the secure mode is in an enabled state, the storage device performs an authentication process on the WP change request based on the HMAC included in the WP change request, and the storage device does not change the state of the WP mode in response to the WP change request only unless the authentication process indicates that the WP change request is valid.

9. The storage system of claim 8 ,
the host being configured to generate the WP change request such that the WP change request include the HMAC, and to send the WP change request to the storage device,
the storage device being configured such that, when the secure mode is enabled, the storage device performs the authentication process on the WP change request based on the HMAC.

10. The storage system of claim 9 ,
wherein the host is configured to generate an authentication code using a shared private key of which is stored at the storage device.

11. The storage system of claim 10 ,
wherein the storage device is configured such that performing the authentication process includes,
generating a validation code using the shared private key,
performing a comparison operation based on the validation code and the authentication code, and
determining whether the WP change request is valid based on a result of the comparison operation.

12. The storage system of claim 11 , wherein the host is configured such that the authentication code is the HMAC), and the storage device is configured such that the validation code is the HMAC.

13. A storage system comprising:
a host configured to provide a request for setting or clearing write protection (WP); and
a storage device configured to receive the request of the host,
wherein the storage device comprises a register and the register comprises register fields that store information for controlling attributes of the WP,
the register further comprising:
a secure WP support field configured to indicate whether or not the storage device supports a secure mode,
a secure WP enable field configured to control a state of the secure mode of the storage device, and
a secure WP configuration masking field configured to control the register fields that are associated with the WP, the register fields being aligned to the secure WP configuration masking field and being accessed depending on register values of the secure WP configuration masking field,

and
wherein, after the host reads the secure WP support field and determines that the storage device supports the secure mode, the host is further configured to set the secure mode by setting the secure WP enable field through authentication using a keyed-hash message authentication code (HMAC), and
wherein the storage device is further configured to:
set or clear the secure mode based on the request of the host when the storage device authenticates the request of the host, and
restrict an access of an unauthenticated host after the secure mode is set.

14. The storage system of claim 13 , wherein the storage device is further configured such that a number of the register fields controlled by the secure WP configuration masking field is greater that a number of bits included in the secure WP configuration masking field.

15. The storage system of claim 13 , wherein the host is further con

Assignees

• Samsung Electronics Co Ltd

Inventors

• Shin Bo-Ram
• Lee Jaegyu
• Cho Heechang
• Ju Wonchul

Classifications

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F2212/1052

  Security improvement · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title