Buffer memory protection unit

Patent metadata

Field	Value
Publication number	US-9305142-B1
Application number	US-201113330450-A
Country	US
Kind code	B1
Filing date	Dec 19, 2011
Priority date	Dec 19, 2011
Publication date	Apr 5, 2016
Grant date	Apr 5, 2016

Abstract

Embodiments described herein include systems and methods for managing security of a storage subsystem. Certain of these embodiments involve the use of a buffer protection module configured to intelligently police requests for access to the subsystem buffer memory.

First claim

What is claimed is:

1. A storage apparatus in communication with a host computing system and configured to enforce a security policy for data stored in a buffer of the storage apparatus, the storage apparatus comprising a housing that encloses a plurality of hardware elements, the plurality of hardware elements comprising:
a buffer located within the storage apparatus, the buffer comprising addressable memory and configured to store data associated with commands received from a host computing system;
at least one non-volatile memory device located within the storage apparatus;
an encryption module comprising a plurality of gates, the encryption module in communication with the buffer and located between the buffer and the at least one non-volatile memory device in a hardware datapath within the storage apparatus, the encryption module configured to apply an encryption scheme to data received from the buffer so that encrypted data is stored in the at least one non-volatile memory device;
a plurality of buffer clients in communication with the buffer and configured to request access to unencrypted data stored in the buffer, the plurality of buffer clients comprising a plurality of hardware processors located within the storage apparatus; and
a buffer protection module within the storage apparatus and in communication with the plurality of buffer clients and the buffer and configured to manage access to the unencrypted data stored in the buffer by the plurality of buffer clients, the buffer protection module distinct from the plurality of buffer clients, the buffer protection module further configured to:
assign security criteria to portions of the buffer, each portion corresponding to at least one storage location in the buffer and at least some of the portions being assigned different security criteria;
in response to a request from a buffer client from the plurality of buffer clients to access the unencrypted data stored in a particular portion of the buffer, associate a security level with the request;
determine whether the security level satisfies the security criteria assigned to the particular portion of the buffer;
when the security level associated with the request satisfies the security criteria assigned to the particular portion of the buffer, permit the requested access to stored unencrypted data; and
when the security level associated with the request does not satisfy the security criteria assigned to the particular portion of the buffer, deny the requested access to stored unencrypted data,
wherein a portion of the buffer having a first assigned security criteria is directly accessible by a first buffer client of the plurality of buffer clients and indirectly accessible by a second buffer client of the plurality of buffer clients, wherein indirectly accessing comprises the second buffer client requesting the first buffer client to perform a buffer operation on the portion of the buffer having the first assigned security criteria.

2. The storage apparatus of claim 1 , wherein each portion of the buffer is associated with a particular data type.

3. The storage apparatus of claim 1 , wherein the portions of the buffer include one or more portions storing user data associated with commands received from the host computing system and assigned at least a first security criteria and one or more other portions storing non-user data and associated with at least a second security criteria.

4. The storage apparatus of claim 1 , wherein user data is stored in the portion of the buffer having the first assigned security criteria.

5. The storage apparatus of claim 1 , wherein the buffer comprises volatile memory.

6. The storage apparatus of claim 1 , wherein the buffer clients include a host interface block and one or more processors of the storage apparatus.

7. The storage apparatus of claim 1 , wherein the buffer protection module associates the security level to the request based at least in part on an identity of the requesting buffer client, a data type associated with the request, one or more buffer addresses associated with the request, the length of the request, or any combination thereof.

8. The storage apparatus of claim 1 , wherein at least a portion of the buffer protection module is implemented in hardware.

9. The storage apparatus of claim 1 , wherein the number of gates in the plurality of gates of the encryption module, when the encryption module is located between the buffer and the non-volatile memory, is at least 75% less than a second encryption module in a second storage apparatus when the second encryption module is located between a host interface and a buffer of the second storage apparatus.

10. The storage apparatus of claim 1 , further comprising a set of programmable configuration registers, wherein at least some of the security criteria is defined by values stored in the configuration registers.

11. The storage apparatus of claim 10 , further comprising a secure processor having the ability to modify the configuration registers, wherein the buffer clients do not have the ability to modify the configuration registers.

12. A method of enforcing a security policy for data stored in a buffer of a storage apparatus that is in communication with a host computing system, the method comprising:
storing unencrypted data associated with commands received from the host computing system in a buffer located within a storage apparatus that encloses a plurality of hardware elements, the buffer comprising addressable memory;
assigning security criteria to portions of the buffer, wherein at least some of the portions are assigned different security criteria;
in response to a request from one or more buffer clients comprising one or more storage apparatus processors located within the storage apparatus to access a particular portion of the buffer that stores unencrypted data, associating a security level with the request;
determining, using a buffer protection module included in the storage apparatus, whether the security level associated with the request satisfies the security criteria assigned to the particular portion of the buffer, wherein:
when the security level associated with the request satisfies the security criteria assigned to the particular portion of the buffer, permitting the requested access to the unencrypted data; and
when the security level associated with the request does not satisfy the security criteria assigned to the particular portion of the buffer, denying the requested access to the unencrypted data;

receiving data from the buffer for storing in at least one non-volatile memory device of the storage apparatus;
using an encryption module comprising a plurality of gates to apply an encryption scheme to the data received from the buffer, the encryption module included in the storage apparatus and located in a hardware datapath within the storage apparatus between the buffer and the at least one non-volatile memory device; and
storing encrypted data in the at least one non-volatile memory device.

13. The method of claim 12 , wherein the steps of the method are performed by the storage apparatus.

14. The method of claim 12 , wherein said assigning security criteria to portions of the buffer comprises assigning at least one first security level to one or more portions storing user data associated with commands received from the host computing system and assigning at least one second security level to one or more other portions storing non-user data.

15. The method of claim 12 , wherein said assigning security criteria comprises assigning a first security criteria to one of the

Assignees

• Ybarra Danny O
• Deforest Marvin R
• Meyer Alan T
• Western Digital Tech Inc

Inventors

• Ybarra Danny O
• Deforest Marvin R
• Meyer Alan T

Classifications

• G06F12/1458 Primary

  by checking the subject access rights · CPC title

• G06F21/00 Primary

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F12/1441

  for a range · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title