Mechanism to support writing files into a file system mounted in a secure memory device
View Patent ↗A system, method and apparatus to record a file in a file system that is mounted in a secure section of a memory device. The memory device authenticates a requester to write data into secure section based on whether the requester is in possession of a cryptographic key. Nonprivileged modules of the operation system can write into a nonsecure section of the memory device. Requests to write or change a file can be recorded by nonprivileged modules into the nonsecure section for subsequent committing into the file system. In response to a request to commit the file, a security manager having the cryptographic key is called to identify, based on the records in the nonsecure section, data eligible to be written into the secure section. The security manager can generate commands, signed using the cryptographic key, to write the content of the file into the secure memory section.
1 . A device, comprising:
memory cells configured as a first region and a second region;
a controller configured to control access to the first region based on cryptographic keys, wherein access to the second region is not limited via the cryptographic keys;
wherein the controller is configured to store, into the second region and in response to first commands failing access control for the first region, records of the first commands; and
wherein the controller is further configured to write data into a file in a file system mounted in the first region and is further configured to write, into the first region that access is controlled based on the cryptographic keys, the data according to the records stored in the second region that access is not limited via the cryptographic keys and in response to a request to write the file in the file system, and wherein writing the data into the file in the file system comprises identifying the data of the file from the records in the second region and generating signed commands to write the file into the first region of the device, wherein one or more cryptographic keys are used to generate a digital signature for a signed command and after the digital signature is validated, the signed command can be executed by the device to write the file into the first region of the device.
2 . The device of claim 1 ,
wherein the request is configured to cause second commands to the device to write, into the first region, the data according to the records stored in the second region; and
wherein the controller is configured to validate digital signatures of the second commands prior to allowing execution of the second commands in the device.
3 . The device of claim 2 , wherein the controller is further configured to:
execute the second commands to store content of the file at storage locations in the first region; and
execute one or more third commands to write meta data configured to identify the storage locations of the content of the file.
4 . The device of claim 3 , wherein the records of the first commands include an identification of the file in the file system; and
wherein the identification of the file is independent of a storage location of the content of the file.
5 . The device of claim 4 , wherein the controller is further configured to load, at a boot time of an operating system of a computing system having the device, instructions of a security manager from the first region for execution, the instructions executable to generate the second commands.
6 . The device of claim 5 , wherein the controller is further configured to provide, during the boot time, the security manager with a cryptographic key to generate digital signatures of commands from the security manager to write the data into the first region.
7 . A method, comprising:
mounting, by a computing system, a memory device having memory cells configured as a first region and a second region, wherein a controller of the memory device is configured to control access to the first region based on cryptographic keys but not access to the second region;
sending, by the computing system, first commands to the memory device, wherein the first commands are configured to write data into the first region;
determining, by the controller, the first commands failing access control for the first region;
storing, by the controller in response to the first commands failing the access control for the first region, records of the first commands into the second region;
storing, in the first region, instructions executable in the computing system as a security manager, wherein the security manager is configured to identify the data of a file from the records in the second region and generate signed commands to write the file into the first region of the memory device, wherein one or more cryptographic keys are used to generate a digital signature for a signed command and after the digital signature is validated, the signed command can be executed by the memory device to write the file into the first region of the memory device; and
loading, at a boot time of an operating system of the computing system, the instructions for execution in the computing system.
8 . The method of claim 7 , further comprising:
generating, by the computing system executing the instructions to implement the security manager and in response to a request to write the data into the file in a file system mounted in the first region, second commands to write the data, into the first region, according to the records stored in the second region.
9 . The method of claim 8 , further comprising:
providing, by the controller during the boot time, the security manager with a cryptographic key; and
generating, by the security manager using the cryptographic key, digital signatures of the second commands to write the data into the first region according to the records stored in the second region.
10 . The method of claim 9 , further comprising:
validating, by the controller, the digital signatures of the second commands prior to allowing execution of the second commands in the memory device.
11 . The method of claim 10 , further comprising:
executing, in the memory device, the second commands to store content of the file at storage locations in the first region, after the validating of the digital signatures of the second commands.
12 . The method of claim 11 , further comprising:
executing, in the memory device, one or more third commands to write meta data configured to identify the storage locations of the content of the file.
13 . The method of claim 12 , wherein the records of the first commands include an identification of the file in the file system; and
wherein the identification of the file is independent of a storage location of the content of the file.
14 . A computing system, comprising:
a processing device configured to execute instructions of an operating system; and
a memory device, including:
memory cells configured as a first region and a second region; and
a controller configured to control access to the first region but not access to the second region;
wherein the controller is configured to store, in the second region, records of first commands, in response to the first commands failing access control for the first region;
wherein the memory device is configured to store, in the first region, instructions of a security manager executable by the processing device, wherein the security manager is configured to identify data of a file from the records in the second region and generate signed commands to write the file into the first region of the memory device, wherein one or more cryptographic keys are used to generate a digital signature for a signed command and after the digital signature is validated, the signed command can be executed by the memory device to write the file into the first region of the memory device; and
wherein the computing system is configured to load, at a boot time of the operating system of the computing system, the instructions of the security manager.
15 . The computing system of claim 14 ,
wherein the security manager is configured to generate, in response to a request to write the file in a file system mounted in the first region, second commands to write the data, into the first region, according to the records stored in the second region.
16 . The computing system of claim 15 , wherein the controller is configured to provide, during the boot time, the security manager with a cryptographic key; and
wherein the security manager is configured to generate, using the cryptographic key, digital signatures of the second commands to write the data into the first region according to the records stored in the second region.
17 . The computing system of claim 16 , wherein the controller is configured to validate the digital signatures of the second commands prior to allowing execution of the second commands in the memory device.
18 . The computing system of claim 17 , wherein the memory device is configured to execute the second commands to store content of the file at storage locations in the first region, after validation of the digital signatures of the second commands.
19 . The computing system of claim 18 , wherein the memory device is further configured to execute one or more third commands to write meta data configured to identify the storage locations of the content of the file.
20 . The computing system of claim 19 , wherein the records of the first commands are configured to include an identification of the file in the file system; and
wherein the identification of the file is independent of a storage location of the content of the file.