Techniques for secure storage hijacking protection
View Patent ↗Various embodiments of the present disclosure are directed to a storage device having a non-volatile memory, a Proof of Physical Access (PPA) mechanism and a controller circuit. The PPA mechanism generates a PPA value responsive to a direct physical user interaction with the storage device by a user. In response to receipt of a storage command from a host, the controller circuit executes the received storage command responsive to the storage command being determined to be a protected command and responsive to detection of the PPA value during a predetermined window of time. The controller circuit does not execute the received storage command responsive to the storage command being determined to be a protected command and responsive to an absence of the PPA value during the predetermined window of time. The protected command is a command that changes access to data stored in the non-volatile memory.
1. A storage device comprising:
a non-volatile memory;
a Proof of Physical Access (PPA) mechanism which generates a PPA value responsive to a direct physical user interaction with the storage device; and
a controller circuit configured to, responsive to receipt of a storage command from a host, execute the received storage command responsive to the storage command being determined to be a protected command and responsive to detection of the PPA value during a predetermined window of time, the controller circuit further configured to not execute the received storage command responsive to the storage command being determined to be a protected command and responsive to an absence of the PPA value during the predetermined window of time, the protected command comprising a command that changes access to data stored in the non-volatile memory.
2. The storage device of claim 1 , wherein the protected command comprises at least a selected one of a command to change security credentials for the storage device, a command to format the storage device, or a command to perform a solid-state drive TRIM operation.
3. The storage device of claim 1 , wherein the controller circuit is further configured to execute the received storage command responsive to a determination that the received storage command is not a protected command.
4. The storage device of claim 1 , wherein the PPA mechanism magnetically interacts with a magnetic field established during the direct physical user interaction to generate the PPA value.
5. The storage device of claim 1 , wherein the PPA mechanism comprises a switch located within a housing of the storage device that is configured to be activated during the direct physical user interaction to generate the PPA value.
6. The storage device of claim 1 , wherein the PPA mechanism comprises a radio frequency receiver/detector which receives a wireless signal transmitted by a user device proximate the storage device during the direct physical user interaction to generate the PPA value.
7. The storage device of claim 1 , wherein the PPA mechanism comprises a light source that generates a light beam which is interrupted during the direct physical user interaction to generate the PPA value.
8. The storage device of claim 1 , wherein the controller circuit comprises a programmable processor having associated programming in a local processor memory which, when executed, detects the received storage command and detects the PPA value.
9. The storage device of claim 1 , wherein the controller circuit is further configured to detect activation of a security protocol associated with the storage device and determine whether the received storage command is a protected command responsive to detected activation of the security protocol.
10. The storage device of claim 1 , characterized as a solid state drive (SSD) and the non-volatile memory is characterized as flash memory.
11. The storage device of claim 1 , characterized as a hard disk drive (HDD) and the non-volatile memory is characterized as a rotatable magnetic recording medium.
12. A solid state drive (SSD) comprising:
a non-volatile main memory;
a Proof of Physical Access (PPA) mechanism which generates a PPA value responsive to a direct physical user interaction with the storage device; and
controller circuitry coupled to the non-volatile main memory and the PPA mechanism and configured to receive a storage command from a host, to detect activation of a security protocol for the SSD, to determine whether the received storage command is a protected command responsive to the detected activation of the security protocol, to execute the received storage command responsive to the received storage command being a protected command and responsive to detection of the PPA value within a predetermined elapsed time interval, and to not execute the received storage command responsive to the received storage command being a protected command responsive to an absence of the PPA value within the predetermined elapsed time interval, the protected command comprising a command that changes access to data stored in the non-volatile memory.
13. The SSD of claim 12 , wherein the protected command comprises a command to change a security credential, to format the non-volatile main memory, to sanitize the non-volatile main memory, or to deactivate the activation of the security protocol.
14. The SSD of claim 12 , wherein the controller circuit is further configured to execute the received storage command responsive to a determination that the received storage command is not a protected command.
15. The SSD of claim 12 , wherein the PPA mechanism magnetically interacts with a magnetic field established during the direct physical user interaction to generate the PPA value.
16. The SSD of claim 12 , wherein the PRA mechanism comprises a switch located within a housing of the storage device that is configured to be activated during the direct physical user interaction to generate the PPA value.
17. The SSD of claim 12 , wherein the PPA mechanism comprises a radio frequency receiver/detector which receives a wireless signal transmitted by a user device proximate the storage device during the direct physical user interaction to generate the PPA value.
18. The SSD of claim 12 , wherein the PPA mechanism comprises a light source that generates a light beam which is interrupted during the direct physical user interaction to generate the PPA value.
19. The SSD of claim 12 , wherein the controller circuit comprises a programmable processor having associated programming in a local processor memory which, when executed, detects the received storage command and detects the PPA value.
20. The SSD of claim 12 , wherein the non-volatile main memory comprises flash memory cells.