MECHANISM FOR FACILITATING ENCRYPTION-FREE INTEGRITY PROTECTION OF STORAGE DATA AT COMPUTING SYSTEMS

• US 20140068274A1
• Filed: 08/31/2012
• Published: 03/06/2014
• Est. Priority Date: 08/31/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: KASATKIN, DMITRY
• Granted Patent: US 8,793,506 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

A mechanism is described for facilitating encryption-free integrity protection of storage data at computing systems according to one embodiment. A method of embodiments of the invention includes receiving a read request, from a software application at a computing device, to perform a read task relating to a first data block of data stored at a storage device coupled to the computing device. The read task may include reading the first data block. The method may further include accessing a first reference cryptographic code at a first metadata cache associated with the first data block, calculating a first new cryptographic code relating to the first data block, comparing the first new cryptographic code with the first reference cryptographic code, and accepting the read request if the first new cryptographic code matches the first reference cryptographic code. The accepting may further include facilitating the read task

Claims

1. A method comprising:

receiving a read request, from a software application at a computing device, to perform a read task relating to a first data block of data stored at a storage device coupled to the computing device, wherein the read task includes reading the first data block;

accessing a first reference cryptographic code at a first metadata cache associated with the first data block;

calculating a first new cryptographic code relating to the first data block;

comparing the first new cryptographic code with the first reference cryptographic code; and

accepting the read request if the first new cryptographic code matches the first reference cryptographic code, wherein accepting includes facilitating the read task.

2. The method of claim 1, further comprising denying the read request if the first new cryptographic code mismatches the first reference cryptographic code, wherein denying includes issuing an error message in response to the read request, wherein if a data block containing the first reference cryptographic code is missing from the first metadata cache, the read request is submitted to facilitate the read task to the missing data block.

3. The method of claim 1, wherein the first reference and new cryptographic codes include a hash-based message authentication code (HMAC).

4. The method of claim 1, wherein the software application comprises an operating system running at the computing device.

5. The method of claim 1, further comprising:

receiving a write request, from the software application at a computing device, to perform a write task relating to a second data block, wherein the write task includes writing the second data block to the data stored at the storage device;

accessing a second reference cryptographic code at a second metadata cache associated with the second data block;

calculating a second new cryptographic code relating to the second data block;

replacing the second reference cryptographic code by the second new cryptographic code in the second metadata cache; and

accepting the write request, wherein accepting includes facilitating the write task.

6. The method of claim 5, wherein the second metadata cache to maintain the second new cryptographic code such that the second new cryptographic code is used as a reference cryptographic code for future read requests.

7. The method of claim 5, wherein the second reference and new cryptographic codes include a hash-based message authentication code (HMAC).

8. The method of claim 5, wherein the software application comprises an operating system running at the computing device.

9. An apparatus comprising:

first logic to receive a read request, from a software application at a computing device, to perform a read task relating to a first data block of data stored at a storage device coupled to the computing device, wherein the read task includes reading the first data block;

second logic to access a first reference cryptographic code at a first metadata cache associated with the first data block;

third logic to calculate a first new cryptographic code relating to the first data block;

forth logic to compare the first new cryptographic code with the first reference cryptographic code; and

fifth logic to accept the read request if the first new cryptographic code matches the first reference cryptographic code, wherein accepting includes facilitating the read task.

10. The apparatus of claim 9, wherein the fifth logic is further to deny the read request if the first new cryptographic code mismatches the first reference cryptographic code, wherein denying includes issuing an error message in response to the read request, wherein if a data block containing the first reference cryptographic code is missing from the first metadata cache, the read request is submitted to facilitate the read task to the missing data block.

11. The apparatus of claim 9, wherein the first reference and new cryptographic codes include a hash-based message authentication code (HMAC).

12. The apparatus of claim 9, wherein the software application comprises an operating system running at the computing device.

13. The apparatus of claim 9, wherein:

the first logic is further to receive a write request, from the software application at a computing device, to perform a write task relating to a second data block, wherein the write task includes writing the second data block to the data stored at the storage device;

the second logic is further to access second reference cryptographic code at a second metadata cache associated with the second data block;

the third logic is further to calculate a second new cryptographic code relating to the second data block;

the forth logic is further to replace the second reference cryptographic code by the second new cryptographic code in the second metadata cache; and

the fifth logic is further to accept the write request, wherein accepting includes facilitating the write task.

14. The apparatus of claim 13, wherein the second metadata cache to maintain the second new cryptographic code such that the second new cryptographic code is used as a reference cryptographic code for future read requests.

15. The apparatus of claim 13, wherein the second reference and new cryptographic codes include a hash-based message authentication code (HMAC).

16. The apparatus of claim 13, wherein the software application comprises an operating system running at the computing device.

17. A system comprising:

a computing device having a memory to store instructions, and a processing device to execute the instructions, the computing device further having a mechanism to;

receive a read request, from a software application at a computing device, to perform a read task relating to a first data block of data stored at a storage device coupled to the computing device, wherein the read task includes reading the first data block;

access a first reference cryptographic code at a first metadata cache associated with the first data block;

calculate a first new cryptographic code relating to the first data block;

compare the first new cryptographic code with the first reference cryptographic code; and

accept the read request if the first new cryptographic code matches the first reference cryptographic code, wherein accepting includes facilitating the read task.

18. The system of claim 17, wherein the mechanism is further to deny the read request if the first new cryptographic code mismatches the first reference cryptographic code, wherein denying includes issuing an error message in response to the read request, wherein if a data block containing the first reference cryptographic code is missing from the first metadata cache, the read request is submitted to facilitate the read task to the missing data block.

19. The system of claim 17, wherein the first reference and new cryptographic codes include a hash-based message authentication code (HMAC).

20. The system of claim 17, wherein the software application comprises an operating system running at the computing device.

21. The system of claim 17, wherein the mechanism is further to:

receive a write request, from the software application at a computing device, to perform a write task relating to a second data block, wherein the write task includes writing the second data block to the data stored at the storage device;

access second reference cryptographic code at a second metadata cache associated with the second data block;

calculate a second new cryptographic code relating to the second data block;

replace the second reference cryptographic code by the second new cryptographic code in the second metadata cache; and

accept the write request, wherein accepting includes facilitating the write task.

22. The system of claim 21, wherein the second metadata cache to maintain the second new cryptographic code such that the second new cryptographic code is used as a reference cryptographic code for future read requests.

23. At least one machine-readable storage medium comprising a plurality of instructions that in response to being executed on a computing device, causes the computing device to carry out a method according to one or more operations comprising:

receive a read request, from a software application at a computing device, to perform a read task relating to a first data block of data stored at a storage device coupled to the computing device, wherein the read task includes reading the first data block;

access a first reference cryptographic code at a first metadata cache associated with the first data block;

calculate a first new cryptographic code relating to the first data block;

compare the first new cryptographic code with the first reference cryptographic code; and

accept the read request if the first new cryptographic code matches the first reference cryptographic code, wherein accepting includes facilitating the read task.

24. The machine-readable storage medium of claim 23, wherein the one or more operations further comprise:

denying the read request if the first new cryptographic code mismatches the first reference cryptographic code, wherein denying includes issuing an error message in response to the read request, wherein if a data block containing the first reference cryptographic code is missing from the first metadata cache, the read request is submitted to facilitate the read task to the missing data block.

25. The machine-readable storage medium of claim 23, wherein the first reference and new cryptographic codes include a hash-based message authentication code (HMAC).

26. The machine-readable storage medium of claim 23, wherein the software application comprises an operating system running at the computing device.

27. The machine-readable storage medium of claim 23, wherein the one or more operations further comprise:

receive a write request, from the software application at a computing device, to perform a write task relating to a second data block, wherein the write task includes writing the second data block to the data stored at the storage device;

access a second reference cryptographic code at a second metadata cache associated with the second data block;

calculate a second new cryptographic code relating to the second data block;

replace the second reference cryptographic code by the second new cryptographic code in the second metadata cache; and

accept the write request, wherein accepting includes facilitating the write task.

28. The machine-readable storage medium of claim 27, wherein the second metadata cache to maintain the second new cryptographic code such that the second new cryptographic code is used as a reference cryptographic code for future read requests.

29. The machine-readable storage medium of claim 27, wherein the second reference and new cryptographic codes include a hash-based message authentication code (HMAC).

30. The machine-readable storage medium of claim 27, wherein the software application comprises an operating system running at the computing device.