Method to prevent data theft from a storage device

1 . A method for assessing a data access request to a data storage device (DSD) by a computer program, the method comprising:

assigning a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of a non-volatile storage medium of the DSD using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition;

receiving, from the computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and

assessing the data access request by:

determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue;

determining whether the one partition of the plurality of partitions that the computer program is configured to access is the first partition;

determining the data access request is authentic in response to determining that:

the one queue of the plurality of queues corresponding to the first partition is the first queue; and

the one partition of the plurality of partitions that the computer program is configured to access is the first partition; and

determining the data access request is not authentic responsive to determining that:

the one queue of the plurality of queues corresponding to the first partition is not the first queue; or

the one partition of the plurality of partitions the computer program is configured to access is not the first partition; and

attempting to authenticate, responsive to determining that the data access request is not authentic, the data access request in a different way.

2 . The method of claim 1 , wherein:

the data access request comprises a command to read, write, modify, or delete data in a logical address in the first partition; and

the data access request is received in the first queue.

3 . The method of claim 2 , wherein:

determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue comprises:

detecting, responsive to receiving the data access request, a first queue identifier for the first queue;

detecting, based on the logical address, the first partition for the data access request; and

comparing the first queue identifier to a second queue identifier associated with the first partition.

4 . The method of claim 1 , wherein:

assigning the plurality of queues to the plurality of computer programs comprises generating a data indexing structure having information for each computer program; and

the data indexing structure includes:

the one partition of the plurality of partitions that each computer program is configured to access; and

the one queue of the plurality of queues assigned to that computer program.

5 . The method of claim 4 , wherein the data indexing structure further includes, for each partition of the plurality of partitions, the one queue of the plurality of queues corresponding to that partition of the plurality of partitions.

6 . The method of claim 4 , wherein determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue and determining whether the one partition of the plurality of partitions the computer program is configured to access is the first partition comprises retrieving information from the data indexing structure.

7 . The method of claim 1 , wherein each queue of the plurality of queues comprises a queue identifier used by a driver of a host computer system to assign one queue of the plurality of queues to one computer program of the plurality of computer programs.

8 . The method of claim 7 , wherein determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue includes:

determining whether a first queue identifier of the first queue matches a second queue identifier of the one queue of the plurality of queues corresponding to the first partition; and

in response to determining the first queue identifier matches the second queue identifier, determining the one queue of the plurality of queues corresponding to the first partition is the first queue.

9 . The method of claim 1 , wherein assigning the plurality of queues to the plurality of computer programs further comprises:

retrieving data characteristics of data used by each computer program;

assigning, based on the data characteristics, each computer program to a partition of the plurality of partitions; and

assigning each queue of the plurality of queues to the partition assigned based on the data characteristics for that computer program.

10 . The method of claim 9 , wherein the data characteristics are selected from:

data structures used by that computer program;

data types used by that computer program; and

data variables used by that computer program.

11 . The method of claim 1 , wherein the attempting to authenticate the data access request a different way includes providing a one-time authentication for the data access request.

12 . The method of claim 1 , wherein the attempting to authenticate the data access request a different way includes providing a long-term authentication to authenticate the computer program to access the first partition using the first queue.

13 . The method of claim 1 , wherein attempting to authenticate the data access request in a different way includes receiving, from a user of a host computer system:

a first credential for a one-time authentication for the data access request; and/or a second credential for a long-term authentication for the computer program to access the first partition using the first queue.

14 . The method of claim 13 , further comprising:

in response to receiving the first credential, allowing the data access request by allowing access to the first partition by the computer program on a one-off basis.

15 . The method of claim 13 , further comprising, in response to receiving the second credential:

updating a data indexing structure having information for each computer program to include:

the first partition as an additional partition configured for access by the computer program;

the first queue as an additional queue of the plurality of queues assigned to the computer program; and/or

the first queue as an additional queue of the plurality of queues corresponding to the first partition; and

allowing the data access request by allowing access to the first partition.

16 . The method of claim 1 , wherein assigning the plurality of queues to the plurality of computer programs is based on data characteristics of each computer program of the plurality of computer programs.

17 . The method of claim 16 , wherein:

the data characteristics include a confidentiality of the data used by that computer program;;

the confidentiality of the data is grouped into a plurality of levels; and

one or more computer programs of the plurality of computer programs having a same level of the plurality of levels are configured to access a same partition of the plurality of partitions.

18 . The method of claim 1 , wherein:

the DSD is a non-volatile memory express (NVMe) device including a plurality of I/O queues; and

the plurality of queues are a subset of the plurality of I/O queues.

19 . A data storage device (DSD) comprising:

a non-volatile storage medium configured to store data;

a data path configured to transmit at least data between the non-volatile storage medium and a host computer system; and

one or more processors, individually or in combination, configured to:

assign a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of the non-volatile storage medium using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition;

receive, from a computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and

assess the data access request by:

determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue;

determining whether the one partition of the plurality of partitions that the computer program is configured to access is the first partition;

determining the data access request is authentic in response to determining that:

the one queue of the plurality of queues corresponding to the first partition is the first queue; and

the one partition of the plurality of partitions that the computer program is configured to access is the first partition; and

determining the data access request is not authentic responsive to determining that:

the one queue of the plurality of queues corresponding to the first partition is not the first queue; or

the one partition of the plurality of partitions the computer program is configured to access is not the first partition; and

attempting to authenticate, responsive to determining that the data access request is not authentic, the data access request in a different way.

20 . A data storage device (DSD) comprising:

a non-volatile storage medium configured to store data;

means for transmitting at least data between a host computer system and the data storage device;

means for assigning a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of the non-volatile storage medium using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition;

means for receiving, from a computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and

means for assessing the data access request by:

means for determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue;

determining whether the one partition of the plurality of partitions that the computer program is configured to access is the first partition;

determining the data access request is authentic in response to determining that:

the one queue of the plurality of queues corresponding to the first partition is the first queue; and

the one partition of the plurality of partitions that the computer program is configured to access is the first partition; and

determining the data access request is not authentic responsive to determining that:

the one queue of the plurality of queues corresponding to the first partition is not the first queue; or

the one partition of the plurality of partitions the computer program is configured to access is not the first partition; and

means for attempting to authenticate, responsive to determining that the data access request is not authentic, the data access request in a different way.