Storage device authenticated modification
Devices and techniques for authenticated modification of a storage device are described herein. A data transmission, received at an interface of the storage device, can be decoded to obtain a command, a set of input identifications, and a first signature corresponding to data identified by the input identifications. Members of the set of input identifications can be marshalled to produce an input set. A cryptographic engine of the storage device can be invoked on the input set to produce a second signature from the input set. The first signature is and the second signature are compared to determine a match. In response to the match, the input set can be written to a secure portion of the storage device.
1. A storage device comprising:
a cryptographic engine;
an interface to:
receive a write, the write including data and specifying storage the data into an unsecured portion of the storage device; and
receive a transmission that includes a command, a set of input identifications, and a first signature, the set of input identifications corresponding to the data written into the unsecured portion of the storage device;
a decoder to parse the command, the set of input identifications, and the first signature from the data transmission received at the interface; and
a controller to:
collect members of the set of input identifications from the unsecured portion of the storage device to produce an input set;
instruct the cryptographic engine to produce a second signature from the input set;
compare the first signature and the second signature to determine a match; and
write the input set from the unsecured portion of the storage device to a secure portion of the storage device in response to the match.
2. The storage device of claim 1 , wherein the set of input identifications define an address range of the unsecure portion of the storage device.
3. The storage device of claim 1 , wherein the data transmission includes an identification of the secure portion.
4. The storage device of claim 1 , wherein the secure portion of the storage device is readable to an external entity via the interface to the storage device.
5. The storage device of claim 4 , wherein the controller is to instruct the cryptographic engine to create a third signature of the secure portion in response to a read operation.
6. The storage device of claim 5 , wherein the controller is to provide the third signature to the external entity in response to a verification instruction including a reference to the read operation.
7. The storage device of claim 1 , wherein the data transmission identifies a secret of the storage device.
8. The storage device of claim 1 , wherein the first signature and the second signature include is a keyed-hash message authentication code (HMAC).
9. The storage device of claim 1 , wherein the interface of the storage device is a Joint Electron Device Engineering Council (JEDEC) memory standards interface.
10. The storage device of claim 1 , wherein the interface of the storage device conforms to at least one of an Integrated Device Electronics (IDE) AT Attachment (ATA) interface, a serial ATA (SATA) interface, a Small Computer System Interface (SCSI) interface, a Universal Flash Storage (UFS) interface, an embedded MultiMedia Card (eMMC) interface, or Non-Volatile Memory Host Controller Interface Specification (NVMHCI) interface.
11. The storage device of claim 10 , wherein the storage device is a flash memory device.
12. A machine implemented method for authenticated modify in a storage device, the method comprising:
receiving, at an interface of the storage device, a write of data into an unsecured portion of the storage device;
decoding a data transmission received at the interface, the data transmission including a command, a set of input identifications for the data written into the unsecured portion of the storage device, and a first signature corresponding to data identified by the input identifications, the command corresponding to a secure portion of the storage device;
marshalling members of the set of input identifications from the unsecured portion of the storage device to produce an input set;
invoking a cryptographic engine of the storage device on the input set to produce a second signature from the input set;
comparing the first signature and the second signature to determine a match; and
writing, in response to the match, the input set from the unsecured portion of the storage device to a secure portion of the storage device.
13. The method of claim 12 , wherein the set of input identifications define an address range of the unsecure portion of the storage device.
14. The method of claim 12 , wherein the data transmission includes an identification of the secure portion.
15. The method of claim 12 , wherein the secure portion of the storage device is readable to an external entity via the interface to the storage device.
16. The method of claim 15 , comprising creating a third signature of the secure portion, using the cryptographic engine, in response to a read operation.
17. The method of claim 15 , comprising providing the third signature to the external entity in response to a verification instruction including a reference to the read operation.
18. The method of claim 12 , wherein the data transmission identifies a secret of the storage device.
19. The method of claim 12 , wherein the first signature and the second signature include is a keyed-hash message authentication code (HMAC).
20. The method of claim 12 , wherein the interface of the storage device is a Joint Electron Device Engineering Council (JEDEC) memory standards interface.
21. The method of claim 12 , wherein the interface of the storage device conforms to at least one of an Integrated Device Electronics (IDE) AT Attachment (ATA) interface, a serial ATA (SATA) interface, a Small Computer System Interface (SCSI) interface, a Universal Flash Storage (UFS) interface, an embedded MultiMedia Card (eMMC) interface, or Non-Volatile Memory Host Controller Interface Specification (NVMHCI) interface.
22. The method of claim 21 , wherein the storage device is a flash memory device.