The present invention relates to device controllers, and more specifically, to data security and coherency.
A device controller can interface between a computer processing device and one or more memory devices. A computer processing device, such as a computer, can issue memory read and write requests to such a device controller, which can effectuate the requests by facilitating the reading from and writing to the one or more memory devices.
It is an object of the present invention to provide a device controller to enforce time-based sector level security.
It is another object of the present invention to provide corresponding methods of enforcing time-based sector level security.
In an exemplary embodiment, the present invention can include a device controller interfaced between an electronic processing device and a sector based data storage device, with the device controller including at least one processor communicatively connected to a clock and to at least one computer memory having a control list stored therein.
In an exemplary aspect, a control list can include one or more security feature entries, with each security feature entry respectively including a high level data characteristic, time data associated with the characteristic, and at least one security response associated with the characteristic.
In another exemplary aspect, for a particular one of the one or more security feature entries, the at least one processor can determine, based at least in part on interrogation of the control list and a clock time generated by the clock, the time data of the particular entry conflicts with the clock time, and in response to such determination, can thereafter execute the at least one security response of the particular entry on one or more target sector ranges determined based, at least in part, on the respective high level data characteristic.
According to an exemplary embodiment of the invention, time data can represent an expiration date and the at least one processor can determine the time data conflicts with the clock time if the clock time is beyond the expiration date.
In an exemplary aspect of any embodiment of the present invention, the at least one processor can render a time conflict determination in response to a processing request received from an electronic processing device, in response to an alarm interrupt received from an optional event monitoring system communicatively connected to the at least one processor, or in response to any desired logical condition or state, including but not limited to the former two cases.
In another exemplary aspect of the present invention, the time data can represent a time window, and the at least one processor can determine the time data conflicts with the clock time when the time data is within the time window. Optionally, such a time data conflict determination can be further conditioned on a data keep alive flag being false.
In still another exemplary aspect of the present invention, a high level data characteristic can include at least a portion of a file name, a time factor, a location factor, file content, or a file size, for example and not in limitation.
In additional exemplary embodiments, the present invention includes corresponding methods of enforcing time-based sector level security.
It should be noted that this disclosure includes a plurality of embodiments, each having a plurality of elements, steps, and/or aspects, and such elements, steps, and/or aspects need not necessarily be interpreted as being conjunctively required by one or more embodiments of the present invention. Rather, all combinations of all elements, steps, and/or aspects described herein can enable a separate embodiment of the present invention, which may be claimed with particularity in the present or one or more future filed Non-Provisional Patent Applications. Moreover, any particular structure, arrangement, step, and/or functional logic disclosed herein, whether expressly or implicitly, are to be construed strictly as illustrative and enabling, and not necessarily limiting. Therefore, it is expressly set forth that such structure, step, arrangement, and functional logic, independently or in any combination thereof, are merely illustratively representative of one or more elements, steps, and/or aspects of one or more embodiments of the present invention and are not to be construed as necessary in a strict sense.
Further, to the extent the same element, step, or aspect is defined differently anywhere within this disclosure, whether expressly or implicitly, or individually or in combination with any another element, step, or aspect, the broader definition is to take absolute precedence, with the distinctions encompassed by the narrower definition to be strictly construed as optional.
Moreover, required hardware elements for each embodiment described herein are to be perceived in a minimalistic manner. Accordingly, one of ordinary skill in the art is directed to interpret the required hardware for each embodiment as the minimum hardware elements required to effectuate each respective security feature, with any additional hardware illustratively shown and/or described conjunctively herein as being strictly optional for that respective embodiment.
Illustratively, perceived benefits of the present invention can include functional utility, whether expressly or implicitly stated herein, or apparent herefrom. However, it is expressly set forth that these benefits are not intended as exclusive. Therefore, any explicit, implicit, or apparent benefit from the disclosure herein is expressly deemed as applicable to the present invention. Exemplary functional utility provided by a device controller disclosed herein includes enforcement of at least one feature of the security feature set described herein, and can include any additional or alternative utility apparent herefrom.
The present invention can be embodied in a device controller and a method that enforce sector level security between an electronic processing device (such as a computer or other functionally compatible device, for example and not in limitation) and a sector based storage device (such as a disk drive, a solid state drive, or any other type of sector based storage structure, for example and not in limitation).
The present invention allows user, factory, and/or default configurations to define and apply particular security features to particular sector ranges within a sector based storage device.
As illustrated in
In an exemplary aspect, the present invention contemplates utilization of any type and number of processors 110 desired, insofar as functionally compatible with the present invention, including but not limited to, an Application-Specific Integrated Circuit (“ASIC”), a Field-Programmable Gate Array (“FPGA”), a general processor, etc., for example and not in limitation. Further, processing duties can be shared across multiple devices to the extent desired.
In another exemplary aspect, the present invention contemplates utilization of any type and number of computer memories 120 desired, insofar as functionally compatible, including but not limited to, a random access memory, a read-only memory, a latch, a register, sequential access memory, etc., insofar as the resulting one or more computer memories are functionally compatible with the present invention as claimed. Further, memory duties can be shared across multiple devices to the extent desired.
In another exemplary aspect, device controller 100 can be provided as any direct or indirect interfacing device between electronic processing device 10 and storage device 20 desired, such as a host controller, a memory controller, or any other known or apparent implementation of a device controller functionally compatible herewith. Further, device controller 100 can be implemented with one or more of a proprietary data interface and a “standardized” data interface, such as a Serial Advanced Technology Attachment (“SATA”), Serial Attached Small Computer System Interface (“SAS”), Small Computer System Interface (“SCSI”), Peripheral Component Interconnect Express (“PCI Express”), or Universal Serial Bus (“USB”) interface, for example and not in limitation, insofar as functionally compatible.
In a further exemplary aspect, electronic processing device 10 can include a computer or any other functionally compatible device that can send data (such as a request or signal, for example and not in limitation) to device controller 100.
In another exemplary aspect, sector based storage device 20 can be provided as any type of desired data storage device that can organize stored data in a sector-based manner, such as a solid state drive, a hard drive, an optical drive, etc., for example and not in limitation.
As further illustrated in
In a further exemplary aspect, clock 130 can provide clock time 131 to device controller 100 according to any desired logical condition, such as, for example and not in limitation, according to a predetermined schedule (e.g., every n seconds or clock cycles, upon a scheduled event, etc.), continuously, sua sponte, or in response a logical state (e.g., in response to a time request, upon a power-up state, upon an initialization state, in conjunction with an alarm interrupt, etc.). As illustratively shown in
As illustrated in
In an exemplary aspect, target sector range 123.1 represents a range of sectors of storage device 20 that are to be acted upon if a time conflict is determined by processor 110. Such a range 123.1 can be user, default, or factory defined, and can be an actual or determinable sector range, which can be stored for subsequent use or determined dynamically, periodically, randomly, chaotically, or in response to any desired logical state or condition. Notably, such a range 123.1 can be a portion or all of available sectors ranges of a storage device 20.
In another exemplary aspect, a determinable sector range can be based upon one or more high level data characteristics, one or more of which can be used to encapsulate and define one or more sector ranges. For example and not in limitation, a high level data characteristic can be converted into one or more sector ranges at any logical state prior to use, such as during an initial configuration process, upon a conflict determination, etc. Also, for example and not in limitation, where a user specifies a file name as a high level data characteristic, the physical sector range or ranges for that file can be determined and used and/or stored as the range or ranges to be acted upon.
In a further exemplary aspect, a high-level data characteristic can represent one or more of the following: a portion of, or an entire, drive, partition, path, or directory; a file name, which can optionally include a wildcard; a time factor (such as a creation time, modified time, accessed time, etc.); a location factor (such as from where a file, directory, or partition was created, modified, accessed, etc.); file content (such as a particular data instance, which can include a wildcard, contained within one or more files); file size (such as =, <=, <. >, >=, ≠ a defined size); or any other file or data characteristic upon which one or more files or data instances can be logically referenced.
In a further exemplary aspect, an instance of time data 123.2 according to the present invention can represent an expiration date (i.e., a particular time and/or date) or a time window (i.e., a period of time), either of which can be an actual or virtual time and/or date.
In another exemplary aspect, as illustrated in
In still another exemplary aspect, processing load on computer processor 110 can be reduced, as illustrated in
In another exemplary aspect, EMS 140 can include a microcontroller (such as, an MSP430, for example and not in limitation), which too can be provided as any type of functionally compatible processor or processors, and can optionally include one or more of built-in Clock-Calendar capabilities, internal non-volatile storage, a rechargeable battery system, and desired sensor interfaces.
Notably, such Clock-Calendar functionality can be external from the microcontroller as could the non-volatile storage and the battery system, to the extent desired. Clock/Calendar capabilities can also be used to generate a timestamp when a sensor event occurs and/or to provide a timestamp to the device controller 100 upon request. The microcontroller can also have alarm capabilities that can be defined to generate and issue an interrupt to device controller 100 when a programmed alarm time or event is reached or occurs, respectively.
The non-volatile storage can be used to store configuration options (such as, alarm times, sensor thresholds, etc., for example and not in limitation) and/or events (such as log sensor, alarm events, etc., for example and not in limitation) as they occur or in due course. In another exemplary aspect, log entries can be time stamped to the extent desired.
In a further exemplary aspect, various environmental sensors can be connected to the microcontroller, which can respond to interrupts generated by the sensors, or it may poll the sensors to obtain environmental measurements, such as temperatures, etc., for example and not in limitation.
In still another exemplary aspect, a rechargeable battery system can be configured to manually or automatically recharge when the device is connected to a powered host. The microcontroller and optional sensor(s) can be powered by the battery when the host system is offline, which can allow the device to log and/or respond to an event(s) even if they occur when the device is not powered, such as by a powered host, for example and not in limitation.
In an exemplary aspect, data storage 142 can be provided as any one or more types of computer memory, as defined supra, and can store one or more alarm events respectively representing target sector range 123.1 and/or time data 123.2 of at least one security feature entry 123 stored in computer memory 120. Further, in this exemplary embodiment, processing device 141 can determine based on calendar logic or otherwise interrogate data storage 142 against clock time 131 to assess whether an alarm event has arisen, or will arise, which can equate to a time conflict as further described herein. Accordingly, where such an alarm event arises, or will arise, EMS 140 can notify device controller 100 by sending an alarm interrupt 133 thereto.
According to the present invention, processor 110 can determine a time conflict exists based on the values of clock time 131 and time data 123.2. As noted above, time data 123.2 can represent an expiration date (i.e., a time and/or date) or a time window (i.e., times and/or dates). Accordingly, where time data 123.2 represents an expiration date, processor 110 can determine a time conflict exists if clock time 131 is within the time window represented by the time data, and where the time data represents a time window, processor 110 can determine a time conflict exists if the clock time is within or during the time windows represented by the time data.
As illustrated in
In an exemplary aspect, as noted above and illustrated in
As described above, the present invention can optionally include an EMS 140, in which case, as illustrated in
In another exemplary aspect, a method of enforcing sector level security can apply when device controller 100 receives a processing request (e.g., read request, write request, or any other request that involves storage device 20) from electronic processing device 10. Accordingly, as illustrated in
In an additional exemplary aspect, the present invention as noted above and illustrated in
In still another exemplary aspect, in conjunction with time data 123.2 representing a time window, an optional DKA check flag can be set as TRUE or FALSE, with either value being set and/or toggled by default and/or via a DKA Command, which can add a control layer to sector level security enforcement. Accordingly, in conjunction with time data 123.2 representing a time window, as illustrated in
In still yet another exemplary aspect, optionally, as illustrated in
It will be apparent to one of ordinary skill in the art that the manner of making and using the claimed invention has been adequately disclosed in the above-written and attached description of the exemplary embodiments and aspects of the present invention.
It should be understood, however, that the invention is not necessarily limited to the specific embodiments, aspects, arrangement, steps, and components shown and described above, but may be susceptible to numerous variations within the scope of the invention. For example and not in limitation, the various logic aspects of the present invention can be implemented in any one or more of software, firmware, and hardwired logic circuitry, and additionally, processing can be distributed or centralized to any desired degree consistent with the present invention.
Therefore, the specification and drawings are to be regarded in an illustrative and enabling, rather than a restrictive, sense.
Accordingly, it will be understood that the above description of the embodiments of the present invention are susceptible to various modifications, changes, and adaptations, and the same are intended to be comprehended within the meaning and range of equivalents apparent to one of ordinary skill in the art.
This document is related to, claims the priority benefit of, and incorporates by reference in their entireties, the following co-pending United States Patent Applications: Ser. No. ______, entitled “Device Controller and Method of Enforcing Time Based Sector Level Security,” and filed on Aug. 31, 2018 by John Edward Benkert and Tony Edward Fessel; and Ser. No. 15/150,860, entitled “Device Controller and Method of Enforcing Time-Based Sector Level Security,” and filed on May 10, 2016 by John Edward Benkert and Tony Edward Fessel, which in turn claims the priority benefit of, and incorporates in its entirety Provisional Patent Application Ser. No. 62/181,591, entitled “Device Controller and System with Sector Level Security,” and filed on Jun. 18, 2015 by John Edward Benkert and Tony Edward Fessel.
Number | Date | Country | |
---|---|---|---|
Parent | 15150860 | May 2016 | US |
Child | 16118695 | US |