Write and compare only data storage
The presently disclosed technology is directed to combatting data theft, particularly of verified authentication data (or hashes thereof) such as login information, thumbprint data, digital signatures, identification numbers, and any other data that should be known to an accessor of stored data. The verified authentication data is initially saved for later comparison in a new type of memory, write-and-compare-only memory, where the data may be queried as to whether a to-be-verified value matches the stored verified value, but the stored and verified data is not read from the write-and-compare-only memory. This prevents a data breach by preventing the verified authentication data from being read by anyone, including those with access (whether legitimate or illegitimate) to any system connected to the write-and-compare-only memory.
1. A method of operating an authentication service within a data storage network, comprising:
writing a verified authentication data set specific to an approved user to a write-and-compare-only partition of a data storage device, the verified authentication data set being writable to the write-and-compare-only partition but unreadable to any user from the write-and-compare-only partition;
querying the write-and-compare-only partition for a match between the verified authentication data set and a to-be-verified authentication data set received from the approved user by writing the to-be-verified authentication data set to a virtual volume mirroring the write-and-compare-only partition of the data storage device; and
receiving a match confirmation from the write-and-compare-only partition that the to-be-verified authentication data set matches the verified authentication data set in the form of a successful write notification of the to-be-verified authentication data.
2. The method of claim 1 , further comprising:
authorizing the approved user access responsive to receiving the match confirmation from the write-and-compare-only partition of the data storage device.
3. The method of claim 1 , further comprising:
querying the write-and-compare-only partition for a match between the verified authentication data set and another to-be-verified authentication data set;
receiving a match error from the write-and-compare-only partition that the to-be-verified authentication data set does not match the verified authentication data set.
4. The method of claim 3 , further comprising:
denying access responsive to receiving the match error.
5. The method of claim 3 , wherein repetition of the querying operation resulting in denying access is limited to a minimum time between queries.
6. The method of claim 1 , wherein the query operation and receiving the match confirmation is performed using an atomic test-and-set command.
7. The method of claim 1 , further comprising:
hashing the verified authentication data set prior to writing to the write-and-compare-only partition of the data storage device; and
hashing the to-be-verified authentication data set prior to querying the write-and-compare-only partition for a match between the verified authentication data set and the to-be-verified authentication data set.
8. A data storage network comprising:
a data storage device storing a verified authentication data set specific to an approved user in a write-and-compare-only partition of the data storage device, the verified authentication data set being writable to the write-and-compare-only partition but unreadable to any user from the write-and-compare-only partition; and
a network server to query the write-and-compare-only partition for a match between the verified authentication data set and a to-be-verified authentication data set received from the approved user by writing the to-be-verified authentication data set to a virtual volume mirroring the write-and-compare-only partition of the data storage device, the network server further to receive a match confirmation from the write-and-compare-only partition that the to-be-verified authentication data set matches the verified authentication data set in the form of a successful write notification of the to-be-verified authentication data.
9. The data storage network of claim 8 , the network server further to authorize the approved user access responsive to receiving the match confirmation from the write-and-compare-only partition of the data storage device.
10. The data storage network of claim 9 , the network server further to hash the verified authentication data set prior to writing to the write-and-compare-only partition of the data storage device, the network server further to hash the to-be-verified authentication data set prior to querying the write-and-compare-only partition for a match between the verified authentication data set and the to-be-verified authentication data set.
11. The data storage network of claim 8 , the network server further to query the write-and-compare-only partition for a match between the verified authentication data set and another to-be-verified authentication data set, the network server further to receive a match error from the write-and-compare-only partition that the to-be-verified authentication data set does not match the verified authentication data set.
12. The data storage network of claim 11 , the network server further to deny access responsive to receiving the match error.
13. The data storage network of claim 12 , wherein repetition of the query operation resulting in denying access is limited to a minimum time between queries.
14. The data storage network of claim 8 , wherein the query operation and receiving the match confirmation is performed using an atomic test-and-set command.
15. One or more computer-readable storage media encoding computer-executable instructions for executing on a computer system an authentication service within a data storage network, the authentication service comprising:
writing a verified authentication data set specific to an approved user to a write-and-compare-only partition of a data storage device, the verified authentication data set being writable to the write-and-compare-only partition but unreadable to any user from the write-and-compare-only partition;
querying the write-and-compare-only partition for a match between the verified authentication data set and a to-be-verified authentication data set received from the approved user by writing the to-be-verified authentication data set to a virtual volume mirroring the write-and-compare-only partition of the data storage device;
receiving a match confirmation from the write-and-compare-only partition that the to-be-verified authentication data set matches the verified authentication data set in the form of a successful write notification of the to-be-verified authentication data; and
authorizing the approved user access responsive to receiving the match confirmation from the write-and-compare-only partition of the data storage device.
16. The computer-readable storage media of claim 15 , the authentication service further comprising:
querying the write-and-compare-only partition for a match between the verified authentication data set and another to-be-verified authentication data set;
receiving a match error from the write-and-compare-only partition that the to-be-verified authentication data set does not match the verified authentication data set; and
denying access responsive to receiving the match error.