Secure applications in computational storage devices

Patent metadata

Field	Value
Publication number	US-12254191-B2
Application number	US-202117492544-A
Country	US
Kind code	B2
Filing date	Oct 1, 2021
Priority date	Mar 23, 2021
Publication date	Mar 18, 2025
Grant date	Mar 18, 2025

Abstract

A method includes receiving, at a controller of a storage device, a command reserving a program slot of a processing device of the storage device to an application. The method further includes storing, by the controller of the storage device, an association between the program slot and the application. The method further includes receiving, at the controller of the storage device, a request to load the application into the execution slot. The method further includes loading, by the controller of the storage device, the application into the program slot based on the association and the request. The method further includes executing, at the processing device of the storage device, the application in the program slot.

First claim

What is claimed is:

1. A method comprising:
receiving, at a controller of a storage device, a first command reserving a first program slot of a processing device of the storage device to an application, wherein the processing device further comprises a second program slot, wherein the first program slot and the second program slot correspond to logical representations of the processing device, and wherein the first command is received from a first source;
determining that the first source is authorized to reserve the first program slot based on access information associated with the first source;
storing, by the controller of the storage device, an association between the first program slot and the application based on the access information;
receiving, at the controller of the storage device, a first request to load the application into the first program slot;
determining, by the controller of the storage device, that the application is permitted to execute in the first program slot based on the association and the first request;
loading, by the controller of the storage device, the application into the first program slot based on the first request; and
executing, at the processing device of the storage device, the application in the first program slot.

2. The method of claim 1 , further comprising:
receiving, at the controller of the storage device, a second request to load a second application into the first program slot; and
rejecting, by the controller of the storage device, the second request based on the access information associated with the first source.

3. The method of claim 1 , wherein the first request to load the application is received from a second application executing at the processing device.

4. The method of claim 1 , further comprising receiving, at the controller of the storage device, a second request to associate one or more permissions with the application and storing an indication of the one or more permissions to the access information.

5. The method of claim 4 , wherein the one or more permissions include a permission to load a second application into the processing device.

6. The method of claim 5 , wherein the one or more permissions further indicates one or more second permissions of the second application.

7. The method of claim 4 , wherein the one or more permissions identify a storage space accessible to the application.

8. The method of claim 7 , wherein the storage space comprises a namespace, a file, a logical block address range, or a combination thereof.

9. The method of claim 4 , wherein the one or more permissions identify a virtual address space of a memory accessible to the application.

10. The method of claim 1 , further comprising:
receiving a second command to disable the first program slot;
clearing the application from the first program slot; and
rejecting a second request to load the application into the first program slot.

11. A computational storage device comprising:
a processing device;
a memory; and
a controller configured to:
receive a first command reserving a first program slot of the processing device to an application, wherein the processing device further comprises a second program slot, wherein the first program slot and the second program slot correspond to logical representations of the processing device, and wherein the first command is received from a first source;
determine that the first source is authorized to reserve the first program slot based on access information;
store an association between the first program slot and the application in the memory based on the access information associated with the first source;
receive a first request to load the application into the first program slot;
determine that the application is permitted to execute in the first program slot based on the association and the first request;
load the application into the first program slot based on the first request; and
initiate execution of the application in the first program slot at the processing device.

12. The computational storage device of claim 11 , wherein the controller is further configured to:
receive a second request to load a second application into the first program slot; and
reject the second request based on the access information associated with the first source.

13. The computational storage device of claim 11 , wherein the first request to load the application is received from a second application executing at the processing device.

14. The computational storage device of claim 11 , wherein the controller is further configured to receive a second request to associate one or more permissions with the application and to store an indication of the one or more permissions to the access information.

15. The computational storage device of claim 14 , wherein the one or more permissions include a permission to load a second application into the processing device.

16. The computational storage device of claim 15 , wherein the one or more permissions further indicate one or more second permissions of the second application.

17. The computational storage device of claim 14 , further comprising a storage medium, wherein the one or more permissions identify a storage space associated with the storage medium and accessible to the application.

18. A non-transitory computer readable storage device storing instructions executable by a controller to:
receive a first command reserving a first program slot of a processing device to an application, wherein the processing device further comprises a second program slot, wherein the first program slot and the second program slot correspond to logical representations of the processing device, and wherein the first command is received from a first source;
determine that the first source is authorized to reserve the first program slot based on access information associated with the first source;
store an association between the first program slot and the application in a memory based on the access information;
receive a first request to load the application into the first program slot;
determine that the application is permitted to execute in the first program slot based on the association and the first request;
load the application into the first program slot based on the first request; and
initiate execution of the application in the first program slot at the processing device.

19. The non-transitory computer readable storage device of claim 18 , wherein the instructions are further executable by the controller to:
receive a second request to load a second application into the first program slot; and
reject the second request based on the access information associated with the first source.

20. The non-transitory computer readable storage device of claim 18 , wherein the first request to load the application is received from a second application executing at the processing device.

Assignees

• Samsung Electronics Co Ltd

Inventors

• Venkataraman Gayathiri
• MARAM Vishwanath
• Bryson Matthew Shaun
• Ryu Sungwook

Classifications

• G06F9/48

  Program initiating; Program switching, e.g. by interrupt · CPC title

• G06F9/44557

  Code layout in executable memory · CPC title

• G06F3/0673

  Single storage device · CPC title

• G06F3/0644

  Management of space entities, e.g. partitions, extents, pools · CPC title

• G06F21/629

  to features or functions of an application · CPC title