Secure metadata protection
A data storage device includes a memory device and a controller coupled to the memory device. The controller is configured to receive a read command from a host device to read data from the memory device, fetch the read data from the memory device, check metadata associated with the read data, determine if the metadata corresponds to the read command, and provide modified read data to the host device when the metadata does not correspond to the read command. The modified read data may be encrypted read data, corrupted read data, or read data that is replaced with debug information. When the host device receives data that is different than the read data that is requested, the modified read data may be unreadable to the host device so that unprivileged access to the read data may be avoided.
1. A data storage device, comprising:
a memory device; and
a controller coupled to the memory device, wherein the controller is configured to:
receive a read command from a host device to read data from the memory device;
fetch the read data from the memory device;
check metadata associated with the read data;
determine if the metadata corresponds to the read command; and
provide modified read data to the host device when the metadata does not correspond to the read command, wherein the controller is further configured to fetch the metadata prior to fetching the read data, wherein the controller is further configured to store the metadata that is fetched in a comparison unit, wherein the controller is further configured to:
calculate cyclic redundancy code (CRC) for the read data; and
provide the calculated CRC to the comparison unit, wherein the metadata that is fetched includes an expected CRC, an expected namespace (NS), and an expected logical block address (LBA), and wherein the read command includes an actual CRC, an actual NS, and an actual LBA, wherein the controller is configured to:
compare the expected CRC, the actual CRC, and the calculated CRC; and
modify the read data when the expected CRC, the actual CRC, and the calculated CRC do not match.
2. The data storage device of claim 1 , wherein the controller is configured to:
compare the expected NS and the actual NS; and
modify the read data when the expected NS and the actual NS do not match, where modifying the read data comprises replacing the read data with random generated data.
3. The data storage device of claim 1 , wherein the controller is configured to:
compare the expected LBA and the actual LBA; and
modify the read data when the expected LBA and the actual LBA do not match, where modifying the read data comprises replacing the read data with random generated data.
4. A data storage device, comprising:
a memory device;
a controller coupled to the memory device, wherein the controller comprises:
a host interface module (HIM); and
a direct memory access (DMA) coupled to the HIM, wherein the DMA is configured to:
fetch metadata associated with a read command, wherein the read command has a first data identifier, and wherein the fetched metadata has a second data identifier;
fetch data associated with the read command, wherein the fetched data has a third data identifier;
determine if the first data identifier, the second data identifier, and the third identifier match; and
provide a requester of the read command either:
unmodified fetched data when the first data identifier, the second data identifier, and the third identifier match; or
modified fetched data when the first data identifier, the second data identifier, and the third identifier do not match, wherein the DMA comprises a multiplexer (MUX) switch, wherein the first data identifier, the second data identifier, and the third data identifier are provided to the MUX switch, wherein the first data identifier includes an actual cyclic redundancy code (CRC), an actual namespace (NS), and an actual logical block address (LBA), wherein the second data identifier includes an expected CRC, an expected NS, and an expected LBA, and the third data identifier includes a calculated CRC.
5. The data storage device of claim 4 , wherein the controller is further configured to fetch the metadata prior to fetching the read data.
6. The data storage device of claim 5 , wherein the controller is further configured to store the metadata that is fetched in a comparison unit.
7. The data storage device of claim 6 , wherein the controller is further configured to:
calculate cyclic redundancy code (CRC) for the read data; and
provide the calculated CRC to the comparison unit.
8. The data storage device of claim 7 , wherein the metadata that is fetched includes the expected CRC, the expected NS, and the expected LBA, and wherein the read command includes an actual CRC, an actual NS, and an actual LBA.
9. The data storage device of claim 4 , wherein the modified fetched data is a re-encrypted fetched data, and wherein the re-encrypting uses a system defined key.
10. The data storage device of claim 4 , wherein the modified fetched data includes debug information.
11. The data storage device of claim 4 , wherein the modified fetched data is re-encrypted fetched data, and wherein the modified fetched data further includes debug information.
12. The data storage device of claim 4 , wherein the first data identifier, the second data identifier, and the third data identifier are provided to the MUX switch.
13. The data storage device of claim 4 , wherein the determining if the first data identifier, the second data identifier, and the third identifier match comprises:
determining if the actual CRC, the expected CRC, and the calculated CRC match;
determining if the actual NS and the expected NS match; and
determining if the actual LBA and the expected LBA match.
14. The data storage device of claim 4 , wherein the modified fetched data is a re-encrypted fetched data, and wherein the re-encrypting uses a system defined key.
15. The data storage device of claim 4 , wherein the modified fetched data includes debug information.
16. The data storage device of claim 4 , wherein the modified fetched data is re-encrypted fetched data, and wherein the modified fetched data further includes debug information.
17. The data storage device of claim 4 , wherein the first data identifier, the second data identifier, and the third data identifier are provided to the MUX switch.
18. The data storage device of claim 4 , wherein the DMA includes a metadata unit, a response unit, a request unit, a data unit, a comparison unit, and a CRC unit.
19. The data storage device of claim 18 , wherein the request unit is configured receive a new command for read data.
20. The data storage device of claim 19 , wherein the read data of the new command includes pointers for data and metadata in volatile memory, such as static random access memory (SRAM) or dynamic random access memory (DRAM), along with namespace and LBA of the data.