METHOD AND APPARATUS FOR WRITE RESTRICTED STORAGE

• US 20160314288A1
• Filed: 04/22/2015
• Published: 10/27/2016
• Est. Priority Date: 04/22/2015
• Status: Abandoned Application

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Elnekaveh, Or
• Application Number:
  US14/693,558
• Publication Number:
  US 20160314288A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Disclosed is a method for write restricted storage. In the method, a controller maintains an authorization list received over a control path. The authorization list includes at least one authorized data block digest, and each authorized data block digest is based on a corresponding authorized data block. The controller generates a calculated digest for a data block received over a data path. The controller determines if the calculated digest for the data block matches an authorized data block digest in the authorization list. The controller writes the data block to a storage if the calculated digest matches the authorized data block digest in the authorization list.

Claims

1. A method, comprising:

maintaining, by a controller, an authorization list received over a control path, wherein the authorization list includes at least one authorized data block digest, and each authorized data block digest is based on a corresponding authorized data block;

generating, by the controller, a calculated digest for a data block received over a data path;

determining, by the controller, if the calculated digest for the data block matches an authorized data block digest in the authorization list; and

writing, by the controller, the data block to a storage if the calculated digest matches the authorized data block digest in the authorization list.

2. The method of claim 1, wherein the controller authenticates the authorization list.

3. The method of claim 1, wherein the control path is a secure control path.

4. The method of claim 3, wherein the data path is not as secure as the secure control path.

5. The method of claim 1, wherein each authorized data block digest is generated from the corresponding authorized data block using a hash function.

6. An apparatus, comprising:

means for maintaining an authorization list received over a control path, wherein the authorization list includes at least one authorized data block digest, and each authorized data block digest is based on a corresponding authorized data block;

means for generating a calculated digest for a data block received over a data path;

means for determining if the calculated digest for the data block matches an authorized data block digest in the authorization list; and

means for writing the data block to a storage if the calculated digest matches the authorized data block digest in the authorization list.

7. The apparatus of claim 6, further comprising means for authenticating the authorization list.

8. The apparatus of claim 6 wherein the control path is a secure control path.

9. The apparatus of claim 8, wherein the data path is not as secure as the secure control path.

10. The apparatus of claim 6, wherein each authorized data block digest is generated from the corresponding authorized data block using a hash function.

11. An apparatus, comprising:

a storage for storing authorized data blocks received over a data path; and

a controller configured to control writes of data blocks to the storage based on an authorization list, received over a control path, of authorized data block digests, wherein

each authorized data block digest is based on a corresponding authorized data block;

the controller further configured to;

generate a calculated digest for a data block received over the data path;

allow writing the data block to the storage if the calculated digest matches an authorized data block digest in the authorization list; and

prohibit writing of the data block to the storage if the calculated digest does not match an authorized data block digest in the authorization list.

12. The apparatus of claim 11, wherein the controller authenticates the authorization list.

13. The apparatus of claim 11, wherein the control path is a secure control path.

14. The apparatus of claim 13, wherein the data path is not as secure as the secure control path.

15. The apparatus of claim 11, wherein each authorized data block digest comprises 256 bits, and each authorized data block comprises at least 4 kilobytes.

16. A computer-readable medium, comprising:

code for causing a computer to maintain an authorization list received over a control path, wherein the authorization list includes at least one authorized data block digest, and each authorized data block digest is based on a corresponding authorized data block;

code for causing the computer to generate a calculated digest for a data block received over a data path;

code for causing the computer to determine if the calculated digest for the data block matches an authorized data block digest in the authorization list; and

code for causing a computer to write the data block to a storage if the calculated digest matches the authorized data block digest in the authorization list.

17. The computer-readable medium of claim 16, further comprising code for causing the computer to authenticate the authorization list.

18. The computer-readable medium of claim 16, wherein the control path is a secure control path.

19. The computer-readable medium of claim 18, wherein the data path is not as secure as the secure control path.

20. The computer-readable medium of claim 16, wherein each authorized data block digest is generated from the corresponding authorized data block using a hash function.