Method to provide chip based security for I/O packets in an array using dynamic topology

• US 8,677,461 B2
• Filed: 04/21/2011
• Issued: 03/18/2014
• Est. Priority Date: 04/21/2011
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: LSI Corporation (Broadcom, Inc.)
• Inventors: Jibbe, Mahmoud K., Marathe, Chandan A., Gangadharan, Manjunath Balgatte, Somanna, Natesh
• Primary Examiner(s): Brown, Christopher
• Assistant Examiner(s): MOHAMMADI, FAHIMEH M
• Application Number:
  US13/091,381
• Publication Number:
  US 20120272298A1
• Time in Patent Office: 1,062 Days
• Field of Search: 726/3, 726/5, 382/115, 713/186
• US Class Current: 726/5
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation

Abstract

An apparatus comprising a controller circuit and an array. The controller circuit may be configured to read/write data in response to one or more input/output requests. The array may be configured to present/receive data to/from the controller circuit in response to the input/output requests. The data may be only transmitted to/from the array after a successful authentication between (i) a first code embedded within each of the input/output requests and (ii) a second code stored on a non-volatile memory within the controller circuit.

Claims

1. An apparatus comprising:

a controller circuit configured to read or write a plurality of data packets in response to one or more input/output requests; and

an array configured to present or receive said plurality of data packets to or from said controller circuit in response to said input/output requests, wherein (A) each of said plurality of data packets are only transmitted to or from said array after a successful authentication between (i) a first code that dynamically changes between transmission of each of said data packets embedded within each of said plurality of packets and (ii) a second code stored on a non-volatile memory within said controller circuit, (B) said first code is verified after each of said plurality of packets is received, (C) said first code is generated during an initial access to said array by a particular user, and (D) said first code of said particular user allows said particular user to access only portions of said array with data previously written by said particular user.

2. The apparatus according to claim 1, wherein said first code comprises a private key and said second code comprises a comparison key.

3. The apparatus according to claim 2, wherein said comparison key is stored in a table in said non-volatile memory.

4. The apparatus according to claim 3, wherein said comparison key stored in said table is compared to said private key to provide said successful authentication.

5. The apparatus according to claim 1, wherein said authentication is denied after a predetermined time.

6. The apparatus according to claim 1, wherein said authentication is performed for each of said plurality of packets.

7. The apparatus according to claim 1, wherein said first code is preserved by an administrator for future use.

8. The apparatus according to claim 1, wherein said second code is compared to the first code using an exclusive-OR mathematical function.

9. The apparatus according to claim 1, wherein said first code is used to obtain said second code.

10. The apparatus according to claim 1, wherein said authentication of each of said data packets implements an encryption to provide secure communication between said controller circuit and said array.

11. A method for providing security on data stored on a network, comprising the steps of:

reading or writing a plurality of data packets in response to one or more input/output requests; and

presenting or receiving said plurality of data packets to or from a controller circuit in response to said input/output requests, wherein (A) each of said plurality of data packets are only transmitted to or from an array after a successful authentication between (i) a first code that dynamically changes between transmission of each of said data packets embedded within each of said plurality of packets and (ii) a second code stored on a non-volatile memory within said controller circuit, (B) said first code is verified after each of said plurality of packets is received, (C) said first code is generated during an initial access to said array by a particular user, and (D) said first code of said particular user allows said particular user to access only portions of said array with data previously written by said particular user.

12. The method according to claim 11, further comprising the steps of:

determining whether a predetermined time period has occurred; and

denying access to said data after said predetermined time period.

13. The method according to claim 11, further comprising the step of:

determining said successful authentication by comparing said first code with said second code.

14. The method according to claim 11, wherein said first code comprises a private key and said second code comprises a compare key stored in a table on the controller.

15. The method according to claim 11, further comprising:

generating a new second code in response to a third code.

16. The method according to claim 15, wherein said third code comprises a secret key.

17. An apparatus comprising:

means for reading or writing a plurality of data packets in response to one or more input/output requests; and

means for presenting or receiving said plurality of data packets to or from a controller circuit in response to said input/output requests, wherein (A) each of said plurality of data packets are only transmitted to or from an array after a successful authentication between (i) a first code that dynamically changes between transmission of each of said data packets embedded within each of said plurality of packets and (ii) a second code stored on a non-volatile memory within said controller circuit, (B) said first code is verified after each of said plurality of packets is received, (C) said first code is generated during an initial access to said array by a particular user, and (D) said first code of said particular user allows said particular user to access only portions of said array with data previously written by said particular user.