Security management unit, host controller interface including same, method operating host controller interface, and devices including host controller interface

Patent metadata

Field	Value
Publication number	US-9785784-B2
Application number	US-201514829705-A
Country	US
Kind code	B2
Filing date	Aug 19, 2015
Priority date	Oct 19, 2012
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

A method of operating a host controller interface includes receiving a buffer descriptor including sector information from a main memory, fetching data by using a source address included in the buffer descriptor, selecting one of a plurality of entries included in a security policy table by using the sector information, and determining whether to encrypt the fetched data by using a security policy included in the selected entry.

First claim

What is claimed is:

1. A method of managing data security in a computer system configured to execute a plurality of applications, the method comprising:
determining a security policy for a current application among the plurality of applications;
determining an operating mode for the current application based on the security policy;
if the operating mode is determined to be a secure mode, allowing the current application to access data stored in a specific region of a storage device and executing the application in the secure mode; and
sharing the accessed data between the current application and another application among the plurality of applications when the another application is managed based on a corresponding security policy for the another application.

2. The method of claim 1 , wherein the data has the security policy that is coherent to both the current application and the another application.

3. The method of claim 1 , further comprising temporarily storing the data in a high-speed cache upon accessing the data from the specific region of the storage device.

4. The method of claim 1 , wherein the computer system comprises a main memory and a plurality of interface ports respectively configured to enable communication of the data between the storage device and the main memory.

5. The method of claim 1 , wherein the storage device is accessible by the computer system via a plurality of interfaces that are different from one another.

6. The method of claim 1 , further comprising determining whether the data stored in the specific region is encrypted.

7. The method of claim 1 , wherein the storage device includes a plurality of regions, and each of the plurality of regions has a corresponding security policy.

8. The method of claim 1 , wherein the storage device is one of a non-volatile memory device, a multimedia card (MMC), a hard disk drive (HDD), a solid state drive (SSD), and a universal flash storage (UFS).

9. The method of claim 1 , wherein the computer system comprises a secure CPU and a non-secure CPU, and the determining of the security policy for the current application is initiated by the secure CPU.

10. The method of claim 9 , wherein the determining of the security policy for the current application comprises selecting a corresponding entry from among a plurality of entries in a security policy table stored in a host controller interface for the computer system.

11. The method of claim 10 , further comprising:
updating at least one entry in the security policy table in response to a command received from the secure CPU.

12. The method of claim 9 , wherein the sharing of the data between the current application and the another application is performed while the current application and the another application are simultaneously executed by the computer system.

13. The method of claim 9 , further comprising:
accessing the data stored in the specific region of the storage device by reading the data;
storing the read data in a main memory of the computer system; and thereafter,
sharing the data between the current application and the another application.

14. A computer system configured to execute a plurality of applications, the computer system comprising:
a first CPU;
a second CPU;
a main memory;
a storage device including a plurality of regions; and
a controller including:
a security management unit configured to select one entry from among a plurality of entries in a security policy table to determine a security policy for a current application among the plurality of applications, and generate a corresponding access indication signal; and
a storage controller configured to control access to data stored in a specific region among the plurality of regions of the storage device in response to the access indication signal,

wherein the storage controller is configured to communicate the data from the storage device to the main memory via at least one of a plurality of interfaces that are different from one another, and
at least one of the first CPU and the second CPU is configured to share the accessed data between the current application and another application among the plurality of applications when the another application is managed based on a corresponding security policy for the another application.

15. The system of claim 14 , wherein the data has the security policy that is coherent to both the current application and the another application.

16. The system of claim 14 , wherein the first CPU is a secure CPU, and the second CPU is a non-secure CPU.

17. A host controller interface comprising:
a storage controller that controls access to data stored in a storage device and generates a sector key corresponding to the data; and
a security management unit configured to select a security policy from a plurality of security policies in response to execution of a current application, and determine whether to allow the current application to access the data stored in a specific region of a storage device based on the security policy,
wherein the accessed data has a security policy that enables sharing of the accessed data between the current application and another application when the another application is managed based on a corresponding security policy for the another application.

18. The host controller interface of claim 17 , further comprising a data protector configured to determine whether to perform an encryption operation on the accessed data.

19. The host controller interface of claim 17 , wherein the current application and the another application have different security policies and correspondingly different security levels.

20. The host controller interface of claim 17 , wherein operation of the security management unit is initiated by a secure CPU of a computer system incorporating the host controller interface.

Assignees

• Kim Kwan Ho
• Kim Seok Min
• Lee Heon Soo
• Samsung Electronics Co Ltd

Inventors

• Kim Kwan Ho
• Kim Seok Min
• Lee Heon Soo

Classifications

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F3/0637

  Permissions · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F21/78 Primary

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F21/629

  to features or functions of an application · CPC title