SAFE COMMAND EXECUTION AND ERROR RECOVERY FOR STORAGE DEVICES

• US 20090106628A1
• Filed: 10/19/2007
• Published: 04/23/2009
• Est. Priority Date: 10/19/2007
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Aciicmez, Onur, Zhang, Xinwen
• Granted Patent: US 8,578,179 B2
• Time in Patent Office: Days
• US Class Current: 714/763
• CPC Class Codes: G06F 11/08 Error detection or correction by redundancy in data representation, e.g. by using checking codes
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00

Abstract

Techniques for execution of commands securely within a storage device are disclosed. Integrity of a command interpreter is verified before allowing it to execute commands within the storage device. The integrity of the commands can also be checked to safeguard against various threats including, for example, malicious attacks, unintentional errors and defects that can adversely affect stored content and execution. Error recovery techniques can be used to reconstruct the command interpreter and/or commands that are found to be defective. In addition, secure techniques can be used to obtain trusted versions of the command interpreter and/or commands from an authenticated external source.

Claims

1. A storage device, comprising:

a storage medium for storing data;

a controller configured for and/or capable of;

providing a command interpreter for execution of one or more commands within said storage device;

determining whether said command interpreter has maintained its integrity before allowing said command interpreter to execute said one or more commands; and

allowing said command interpreter to execute said one or more commands when said controller determines that said command interpreter has maintained its integrity.

2. The storage device of claim 1, wherein said command interpreter is configured for and/or capable of:

determining whether said one or more commands have maintained their integrity when said controller determines that said command interpreter has maintained its integrity; and

executing said one or more commands only when said command interpreter determines that said one or more commands have maintained their integrity.

3. The storage device of claim 1, wherein said controller is further configured for and/or capable of:

determining whether said one or more commands have maintained their integrity when said controller determines that said command interpreter has maintained its integrity; and

allowing said command interpreter to execute said one or more commands only when said controller determines that said one or more commands have maintained their integrity.

4. The storage device of claim 3, wherein said controller is further configured for and/or capable of:

attempting to reconstruct said command interpreter using an error recovery mechanism that uses error recovery code integrated with executable content of said command interpreter when said controller determines that said command interpreter has not maintained its integrity; and

attempting to obtain a valid version of said command interpreter from an external source when said attempting to reconstruct said command interpreter fails to reconstruct said command interpreter.

5. The storage device of claim 4, wherein said controller and/or command interpreter are further configured for and/or capable of:

attempting to reconstruct said one or more commands using an error recovery mechanism when it is determined that said one or more commands have not maintained their integrity; and

attempting to obtain a valid version of said one or more commands from an external source when it is determined that said one or more commands have not maintained their integrity.

6. The storage device of claim 1, wherein said storage device includes one or more of the following:

a hard disk drive, a flash drive, and optical drive, a non-volatile memory device, a volatile memory device.

7. The storage device of claim 1, wherein said storage device is a hard disk drive that can be configured to communicate with a host system.

8. A method of controlling the execution of one or more commands by a storage device that effectively provides a command interpreter for execution of said one or more commands, said method comprising:

determining whether a command interpreter has maintained its integrity before allowing said command interpreter to execute said one or more commands; and

allowing said command interpreter to execute one or more commands when said determining determines that said command interpreter has maintained its integrity.

9. The method of claim 8, wherein said method further comprises:

executing said command interpreter when said determining determines that said command interpreter has maintained its integrity;

not executing said command interpreter when determining determines that said command interpreter has not maintained its integrity;

determining whether said one or more commands have maintained their integrity;

executing said one or more commands when said determining determines that said one or more commands have maintained their integrity; and

not executing said one or more commands when determining determines that said one or more commands have not maintained their integrity.

10. The method of claim 9, wherein said method further comprises:

attempting to reconstruct said command interpreter using an error recovery mechanism that uses error recovery code integrated with executable content of said command interpreter when determining determines that said command interpreter has not maintained its integrity; and

attempting to reconstruct said one or more commands using an error recovery mechanism when determining determines that said one or more commands have not maintained their integrity.

11. The method of claim 10, wherein said method further comprises:

attempting to obtain a valid version of said command interpreter from an external source when said attempting to reconstruct said command interpreter fails to reconstruct said command interpreter; and

attempting to obtain a valid version of said one or more commands from an external source when said attempting to reconstruct said one or more commands fails to reconstruct said one or more commands.

12. The method of claim 11, wherein said method further comprises:

obtaining a signed version of said command interpreter that includes error recovery code; and

determining based on a signature of said signed version of said command interpreter whether said signed version is a valid version of said command interpreter.

13. The method of claim 8, wherein said determining of whether said command interpreter has maintained its integrity comprises:

obtaining at least one known integrity value for said command interpreter;

determining at least one current integrity value for said command interpreter;

comparing said at least one known integrity value to said at least one current integrity value; and

determining based on said comparing whether said command interpreter has maintained its integrity.

14. The method of claim 13, wherein said known integrity value is a signed known message digest of said command interpreter;

15. The method of claim 13, wherein said known Integrity value is a signed known message digest of executable content of said command interpreter and error recovery code which has been incorporated with said executable content of said command interpreter.

16. The method of claim 8, wherein said method comprises:

obtaining a current version of said command interpreter from memory of said storage device;

computing the message digest of said current version of said command interpreter;

comparing said message digest of said current version of said command interpreter to said signed message digest of said command interpreter;

extracting executable content of said command interpreter for execution when said comparing determining that said message digest of said current version of said command interpreter is equal to said signed message digest of said command interpreter;

attempting to reconstruct said executable content of said command interpreter using an error recovery technique that utilizes error recovery code incorporated with said executable content of said command interpreter;

incorporating said error recovery code into a reconstructed content of said command interpreter to generate a reconstructed command interpreter when said attempting to reconstruct said executable content;

computing the message digest of said reconstructed command interpreter; and

comparing said message digest of said reconstructed command interpreter to said signed known message digest to determine whether said command interpreter has been correctly reconstructed.

17. The method of claim 13, wherein said known integrity value and/or current integrity value are secured and/or protected against unauthorized access by one or more of the following:

storing said known integrity value and/or current integrity value in internal memory and/or secured memory; and

encrypting said known integrity value and/or current integrity values using one or more of the following;

public key signature algorithm, a root key algorithm using a unique and protected symmetric key, a private key, a pair of public and private keys.

18. The method of claim 8, wherein said determining of whether said command interpreter has maintained its integrity comprises:

applying an integrity verification function to said command interpreter.

19. The method of claim 18,

wherein said command interpreter includes a security value (S) that depends on (i) said integrity verification function, (ii) content of said command interpreter, and (iii) a pre-selected residual value (r) not stored in said command interpreter, and

wherein said method further comprises:

applying said integrity verification function to said command interpreter which includes said security value (S) to obtain a result (R); and

determining that said command interpreter has maintained its integrity when said result (R) is equal to said pre-selected residual value (r).

20. The method of claim 8, wherein said one or more commands executed by said storage device include one or more device internal commands that corresponds to one or more host commands received from a host system.

21. A tangible medium storing executable instructions for effectively controlling execution of one or more commands by a storage device, said tangible medium comprising:

executable instructions for determining whether a command interpreter has maintained its integrity before allowing said command interpreter to execute said one or more commands; and

executable instructions for allowing said command interpreter to execute one or more commands by only when said determining determines that said command interpreter has maintained its integrity.

22. The tangible medium of claim 21, wherein said tangible medium further comprises:

executable instructions for determining whether said one or more commands have maintained their integrity; and

executable instructions for executing said one or more commands only when said determining determines that said one or more commands have maintained their integrity.

23. The tangible medium of claim 22, wherein said tangible medium further comprises:

executable instructions for attempting to reconstruct said command interpreter using an error recovery mechanism that uses error recovery code integrated with executable content of said command interpreter when determining determines that said command interpreter has not maintained its integrity; and

executable instructions for attempting to reconstruct said one or more commands using an error recovery mechanism when said determining determines that said one or more commands have not maintained their integrity.

24. The tangible medium of claim 23, wherein said tangible medium further comprises:

executable instructions for attempting to obtain a valid version of said command interpreter from an external source when said attempting to reconstruct said command interpreter fails to reconstruct said command interpreter; and

executable instructions for attempting to obtain a valid version of said one or more commands from an external source when said attempting to reconstruct said one or more commands fails to reconstruct said one or more commands.

25. A computing component for a storage device, wherein said storage device can use a command interpreter to execute one or more commands internally within said storage device, wherein said controller is configured for and/or capable of:

determining whether said command interpreter has maintained its integrity before allowing said command interpreter to execute said one or more commands internally within said storage device; and

allowing said command interpreter to execute said one or more commands within said storage device when said controller determines that said command interpreter has maintained its integrity.