Flash translation layer with hierarchical security
A computing device includes a non-volatile memory (NVM) interface and a processor. The NVM interface is configured to communicate with an NVM. The processor is configured to store in the NVM at least (i) data entries including data and (ii) mapping entries including mapping information that indicate physical addresses in which the data entries are stored in the NVM, and to verify authenticity of the data entries and of the mapping entries using a hierarchical authentication scheme in which (i) the data entries include first authentication information that authenticates the data, and (ii) the mapping entries include second authentication information that authenticates both the mapping information and the data entries.
1. A computing device, comprising:
a non-volatile memory (NVM) interface, configured to communicate with an NVM; and
a processor, configured to:
store in the NVM at least (i) data entries comprising data and (ii) mapping entries comprising mapping information that indicate physical addresses in which the data entries are stored in the NVM; and
verify authenticity of the data entries and of the mapping entries using a hierarchical authentication scheme in which (i) the data entries comprise first authentication information that authenticates the data, and (ii) the mapping entries comprise second authentication information that authenticates both the mapping information and the data entries.
2. The computing device according to claim 1 , wherein the processor is configured to verify the authenticity of the data entries and of the mapping entries in response to an initialization indication.
3. The computing device according to claim 1 , wherein, in response to writing data to the NVM, the processor is configured to update the hierarchical authentication scheme with (i) updated first authentication information reflecting the written data, and (ii) updated second authentication information reflecting the written data and the mapping information of the written data.
4. The computing device according to claim 1 , wherein, in response to reading data from the NVM, the processor is configured to verify the authenticity of the read data using at least the first authentication information and the second authentication information.
5. The computing device according to claim 1 , wherein the processor is configured to update the hierarchical authentication scheme in an order that guarantees consistency of the data and the hierarchical authentication scheme in the event of a power interruption.
6. The computing device according to claim 1 , wherein, as part of the hierarchical authentication scheme, the processor is further configured to store in the NVM third authentication information that authenticates the mapping entries.
7. A computing method, comprising:
storing in a non-volatile memory (NVM) at least (i) data entries comprising data and (ii) mapping entries comprising mapping information that indicate physical addresses in which the data entries are stored in the NVM; and
verifying authenticity of the data entries and of the mapping entries using a hierarchical authentication scheme in which (i) the data entries comprise first authentication information that authenticates the data, and (ii) the mapping entries comprise second authentication information that authenticates the both the mapping information and the data entries.
8. The computing method according to claim 7 , wherein verifying the authenticity of the data entries and of the mapping entries is performed in response to an initialization indication.
9. The computing method according to claim 7 , and comprising, in response to writing data to the NVM, updating the hierarchical authentication scheme with (i) updated first authentication information reflecting the written data, and (ii) updated second authentication information reflecting the written data and the mapping information of the written data.
10. The computing method according to claim 7 , wherein verifying the authenticity of the data entries comprises, in response to reading data from the NVM, the verifying the authenticity of the read data using at least the first authentication information and the second authentication information.
11. The computing method according to claim 7 , and comprising updating the hierarchical authentication scheme in an order that guarantees consistency of the data and the hierarchical authentication scheme in the event of a power interruption.
12. The computing method according to claim 7 , and comprising, as part of the hierarchical authentication scheme, storing in the NVM third authentication information that authenticates the mapping entries.