Session access to files in a file system mounted in a secure memory device
Session access to files in a file system mounted in a secure memory region in a secure memory device. In response to a request from an application to open a session for the file system to access the memory region, a secure command is sent to the memory device to install an access control key for the memory region. After storing a session key in a key repository, the application can call the operating system to access files in the file system. In response, the file system can generate access commands to be transmitted to the memory device. The session key stored in the key repository can be used to sign the access commands on behalf of the application. The memory device uses the access control key to validate the access commands signed using the session key prior to the execution of the access commands.
1 . A method, comprising:
receiving a request from an application for a file system to access a memory region of a memory device;
storing, into a key repository, a session key;
receiving, from the file system, access commands to be transmitted to the memory device;
communicating with the key repository to generate verification codes for the access commands using the session key; and
transmitting the access commands with the verification codes to the memory device.
2 . The method of claim 1 , wherein the session key and a key installed via a secure command are a pair of cryptographic keys for asymmetric cryptography.
3 . The method of claim 1 , wherein the session key is same as a key installed via a secure command.
4 . The method of claim 1 , further comprising:
generating a verification code for a secure command using a cryptographic key representative of a privilege to have the secure command executed in the memory device, wherein the secure command is transmitted to the memory device with the verification code for the secure command, and the memory device is configured with an access control key to validate the verification code prior to execution of the secure command.
5 . The method of claim 4 , further comprising:
receiving, from the application, a key to be installed via the secure command; and
receiving, from the application, the session key to be stored into the key repository.
6 . The method of claim 4 , further comprising:
verifying, in response to the request, a privilege of the application to access the memory region, wherein the secure command is transmitted to the memory device in response to a determination that the application is eligible to access the memory region.
7 . The method of claim 6 , further comprising:
generating, in response to the request, a key to be installed via the secure command and the session key to be stored into the key repository.
8 . The method of claim 4 , further comprising:
receiving an identification of one or more locations in the memory region at which data of files in the file system is stored;
communicating with the memory device to generate a cryptographic measure of the data of the files.
9 . The method of claim 8 , further comprising:
detecting a security attack based on monitoring the cryptographic measure of the data of the files.
10 . The method of claim 9 , further comprising:
upon detecting the security attack based on monitoring the cryptographic measure of the data of the files, engaging in countermeasures including revocation of active session keys in the memory device.
11 . The method of claim 4 , wherein the session key is stored in association with a location indicator representative of the memory region; and
the method further comprises:
retrieving the session key from the key repository in response to a determination that the access commands address the memory region.
12 . A computing apparatus, comprising:
a memory device having memory cells and an access controller; and
a host system coupled to the memory device, the host system configured to execute instructions of a direct access driver and a storage stack driver;
wherein the direct access driver is configured to receive a request from a first application to access a memory region allocated on a portion of the memory cells;
wherein the computing apparatus includes a key repository configured to receive and store a session key;
wherein the storage stack driver is configured to:
receive, from a file system, access commands to be transmitted to the memory device;
communicate with the key repository to generate, using the session key, verification codes for the access commands; and
transmit the access commands with the verification codes to the memory device.
13 . The computing apparatus of claim 12 , wherein the access commands include a command to write data into the memory region, a command to read data from the memory region, or any combination thereof; and the first application is configured with a pair of cryptographic keys representative of a privilege to access the memory region; the pair of cryptographic keys include a private key and a public key generated via asymmetric cryptographic; and the first application is configured to provide the public key to the direct access driver for installation in the memory device via a first command transmitted by the direct access driver and store the private key into the key repository during a session.
14 . The computing apparatus of claim 13 , wherein the direct access driver is configured with a cryptographic key representative of a privilege to cause the memory device to execute the first command transmitted by the direct access driver to the memory device; and the memory device is configured with an access control key usable to validate a verification code generated using the cryptographic key.
15 . The computing apparatus of claim 14 , wherein the storage stack driver is configured to provide the access commands to the key repository to receive the verification codes generated by the key repository.
16 . The computing apparatus of claim 14 , wherein the storage stack driver is configured to request the key repository to provide the session key associated with the memory region and generate the verification codes from the session key and the access commands.
17 . A non-transitory computer storage medium storing instructions which when, executed in a computing system having a memory device with a memory region mounted therein a file system, cause the computing system to perform a method, the method comprising:
sending a request from an application to a security manager for the file system to access the memory region;
storing, into a key repository, a session key; and
calling an operating system running in the computing system to access files in the file system, wherein the file system generates, in response to the calling, access commands, and wherein the security manager is configured to communicate with the key repository to generate verification codes for the access commands using the session key and transmitting the access commands with the verification codes to the memory device.
18 . The non-transitory computer storage medium of claim 17 ,
wherein an access control key is same as the session key.
19 . The non-transitory computer storage medium of claim 17 ,
wherein an access control key and the session key are a pair of cryptographic keys of asymmetric cryptography.
20 . The non-transitory computer storage medium of claim 19 , wherein the method further comprises:
obtaining, by the application, the session key as a privilege to access the memory region.