US-12625996-B2 - Method to prevent data theft from a storage device

US12625996B2US 12625996 B2US12625996 B2US 12625996B2US-12625996-B2

Abstract

A method for assessing a data access request to a data storage device (DSD) by a computer program, the method comprising: assigning a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of a non-volatile storage medium of the DSD using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition; receiving, from the computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and assessing the data access request by: determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue; and in response to determining the one queue of the plurality of queues corresponding to the first partition is the first queue, determining the first queue is authentic to assess the first partition.

Inventors

Shiva K
Saurabh Singh

Assignees

SanDisk Technologies, Inc.

Dates

Publication Date: 20260512
Application Date: 20240614

Claims (20)

1 . A method for assessing a data access request to a data storage device (DSD) by a computer program, the method comprising: assigning a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of a non-volatile storage medium of the DSD using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition; receiving, from the computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and assessing the data access request by: determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue; determining whether the one partition of the plurality of partitions that the computer program is configured to access is the first partition; determining the data access request is authentic in response to determining that: the one queue of the plurality of queues corresponding to the first partition is the first queue; and the one partition of the plurality of partitions that the computer program is configured to access is the first partition; and determining the data access request is not authentic responsive to determining that: the one queue of the plurality of queues corresponding to the first partition is not the first queue; or the one partition of the plurality of partitions the computer program is configured to access is not the first partition; and attempting to authenticate, responsive to determining that the data access request is not authentic, the data access request in a different way.
2 . The method of claim 1 , wherein: the data access request comprises a command to read, write, modify, or delete data in a logical address in the first partition; and the data access request is received in the first queue.
3 . The method of claim 2 , wherein: determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue comprises: detecting, responsive to receiving the data access request, a first queue identifier for the first queue; detecting, based on the logical address, the first partition for the data access request; and comparing the first queue identifier to a second queue identifier associated with the first partition.
4 . The method of claim 1 , wherein: assigning the plurality of queues to the plurality of computer programs comprises generating a data indexing structure having information for each computer program; and the data indexing structure includes: the one partition of the plurality of partitions that each computer program is configured to access; and the one queue of the plurality of queues assigned to that computer program.
5 . The method of claim 4 , wherein the data indexing structure further includes, for each partition of the plurality of partitions, the one queue of the plurality of queues corresponding to that partition of the plurality of partitions.
6 . The method of claim 4 , wherein determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue and determining whether the one partition of the plurality of partitions the computer program is configured to access is the first partition comprises retrieving information from the data indexing structure.
7 . The method of claim 1 , wherein each queue of the plurality of queues comprises a queue identifier used by a driver of a host computer system to assign one queue of the plurality of queues to one computer program of the plurality of computer programs.
8 . The method of claim 7 , wherein determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue includes: determining whether a first queue identifier of the first queue matches a second queue identifier of the one queue of the plurality of queues corresponding to the first partition; and in response to determining the first queue identifier matches the second queue identifier, determining the one queue of the plurality of queues corresponding to the first partition is the first queue.
9 . The method of claim 1 , wherein assigning the plurality of queues to the plurality of computer programs further comprises: retrieving data characteristics of data used by each computer program; assigning, based on the data characteristics, each computer program to a partition of the plurality of partitions; and assigning each queue of the plurality of queues to the partition assigned based on the data characteristics for that computer program.
10 . The method of claim 9 , wherein the data characteristics are selected from: data structures used by that computer program; data types used by that computer program; and data variables used by that computer program.
11 . The method of claim 1 , wherein the attempting to authenticate the data access request a different way includes providing a one-time authentication for the data access request.
12 . The method of claim 1 , wherein the attempting to authenticate the data access request a different way includes providing a long-term authentication to authenticate the computer program to access the first partition using the first queue.
13 . The method of claim 1 , wherein attempting to authenticate the data access request in a different way includes receiving, from a user of a host computer system: a first credential for a one-time authentication for the data access request; and/or a second credential for a long-term authentication for the computer program to access the first partition using the first queue.
14 . The method of claim 13 , further comprising: in response to receiving the first credential, allowing the data access request by allowing access to the first partition by the computer program on a one-off basis.
15 . The method of claim 13 , further comprising, in response to receiving the second credential: updating a data indexing structure having information for each computer program to include: the first partition as an additional partition configured for access by the computer program; the first queue as an additional queue of the plurality of queues assigned to the computer program; and/or the first queue as an additional queue of the plurality of queues corresponding to the first partition; and allowing the data access request by allowing access to the first partition.
16 . The method of claim 1 , wherein assigning the plurality of queues to the plurality of computer programs is based on data characteristics of each computer program of the plurality of computer programs.
17 . The method of claim 16 , wherein: the data characteristics include a confidentiality of the data used by that computer program;; the confidentiality of the data is grouped into a plurality of levels; and one or more computer programs of the plurality of computer programs having a same level of the plurality of levels are configured to access a same partition of the plurality of partitions.
18 . The method of claim 1 , wherein: the DSD is a non-volatile memory express (NVMe) device including a plurality of I/O queues; and the plurality of queues are a subset of the plurality of I/O queues.
19 . A data storage device (DSD) comprising: a non-volatile storage medium configured to store data; a data path configured to transmit at least data between the non-volatile storage medium and a host computer system; and one or more processors, individually or in combination, configured to: assign a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of the non-volatile storage medium using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition; receive, from a computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and assess the data access request by: determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue; determining whether the one partition of the plurality of partitions that the computer program is configured to access is the first partition; determining the data access request is authentic in response to determining that: the one queue of the plurality of queues corresponding to the first partition is the first queue; and the one partition of the plurality of partitions that the computer program is configured to access is the first partition; and determining the data access request is not authentic responsive to determining that: the one queue of the plurality of queues corresponding to the first partition is not the first queue; or the one partition of the plurality of partitions the computer program is configured to access is not the first partition; and attempting to authenticate, responsive to determining that the data access request is not authentic, the data access request in a different way.
20 . A data storage device (DSD) comprising: a non-volatile storage medium configured to store data; means for transmitting at least data between a host computer system and the data storage device; means for assigning a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of the non-volatile storage medium using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition; means for receiving, from a computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and means for assessing the data access request by: means for determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue; determining whether the one partition of the plurality of partitions that the computer program is configured to access is the first partition; determining the data access request is authentic in response to determining that: the one queue of the plurality of queues corresponding to the first partition is the first queue; and the one partition of the plurality of partitions that the computer program is configured to access is the first partition; and determining the data access request is not authentic responsive to determining that: the one queue of the plurality of queues corresponding to the first partition is not the first queue; or the one partition of the plurality of partitions the computer program is configured to access is not the first partition; and means for attempting to authenticate, responsive to determining that the data access request is not authentic, the data access request in a different way.

Description

TECHNICAL FIELD This disclosure relates to assessing a data access request to a data storage device (DSD) by a computer program to prevent unauthorized or malicious access to the storage device. BACKGROUND Data storage devices (DSDs) are electronic devices with the capability to store information in the form of digital data. DSDs are typically deployed as an integrated part of, or as a removable component configured to interface with, a computing system for the purpose of improving the data transmission and storage capabilities of the computing system. From the perspective of the computing system, a data storage device (DSD) is typically implemented as a block storage device where the data stored is in the form of one or more blocks, being sequences of bytes or bits having a maximum length, referred to as block size. DSDs are commonly used to supplement the data storage capabilities of a computer system. For example, DSDs are often standalone physical devices that house an internal storage component, such as a hard disk drive (HDD) or a solid state drive (SSD), that provides a host computer system with an additional portion of non-volatile memory (i.e., the volume of the drive) in which to store digital data. These drive-type devices are connectable to the host computer system via a data path operating over a particular connectivity protocol (e.g., via a Universal Serial Bus (USB) cable or Peripheral Component Interconnect Express (PCIe) bus). In response to being connected to the host computer system, the host computer system recognizes the drive as a block data storage device such that a user of the device may access the storage of the drive via the data path (e.g., through operations of the host computer system). Access to the drive typically enables one or more users of the host computer system and computer programs on the host computer system to access (e.g., read, write and/or modify) user data stored on the drive. It is desirable to secure the user data content of a DSD against unauthorized or malicious access by the computer programs on the host computer system to prevent data theft from a storage device. However, traditional security measures implemented on host computer systems, such as antivirus software, are typically resource-intensive (e.g., consuming a large amount of central processing unit (CPU) power of the host computer systems). Furthermore, it is challenging to assess data access requests from diverse computer programs, particularly for these computer programs that have been legitimately installed on the host computer system and/or granted access by the user but are susceptible to malicious attacks (e.g., hacking) subsequently. SUMMARY Disclosed herein is a method for assessing a data access request to a data storage device (DSD) by a computer program, the method comprising: assigning a plurality of queues to a plurality of computer programs, wherein each computer program is configured to authentically access one partition of a plurality of partitions of a non-volatile storage medium of the DSD using one queue of the plurality of queues assigned to that computer program and corresponding to that one partition; receiving, from the computer program, a data access request to access a first partition of the plurality of partitions using a first queue of the plurality of queues; and assessing the data access request by: determining whether the one queue of the plurality of queues corresponding to the first partition is the first queue; and in response to determining the one queue of the plurality of queues corresponding to the first partition is the first queue, determining the first queue is authentic to assess the first partition. In some embodiments, assessing the data access request further comprises: determining whether the one of the plurality of partitions the computer program is configured to access is the first partition; and in response to determining the one of the plurality of partitions the computer program is configured to access is the first partition, determining the computer program is authentic to access the first partition. In some embodiments, the method further comprises allowing the data access request for accessing the first partition in response to determining both the first queue and the computer program are authentic to assess the first partition. In some embodiments, assigning the plurality of queues to the plurality of computer programs comprises generating a data indexing structure having information for each computer program, including (i) the one of the plurality of partitions that each computer program is configured to access, and (ii) the one queue of the plurality of queues assigned to that computer program. In some embodiments, the data indexing structure having information for each computer program further includes (iii) the one queue of the plurality of queues corresponding to the one of the plurality of partitions. In some embodiments, determining whethe