Data Storage Device Encryption with Segmented Block Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage devices lack an effective end-to-end encryption solution, as data transmitted between the device and the host computer system remains unencrypted, making it vulnerable to unauthorized access during transfer, even when the storage itself is encrypted.
Innovation Solution
Implementing a data storage device with hardware circuitry that encrypts and decrypts data using different cryptographic keys for defined block ranges, allowing for secure transmission and storage of files across insecure links by encrypting data before transmission and decrypting it upon receipt.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full disk hardware encryption is implemented, then data at rest is encrypted, but data transmitted over the data link remains in plain text and vulnerable to eavesdropping
Solution Approach 1:
The storage device is divided into multiple block ranges, with each range encrypted using a separate cryptographic key. This segmentation allows selective encryption of data portions and enables the device to provide encryption services without requiring the entire disk to be encrypted, thereby maintaining security while improving flexibility in data transmission scenarios
Solution Approach 2:
The device controller dynamically adjusts encryption behavior based on operational context. It can decrypt data when needed for host access and re-encrypt it before transmission over the data link, or maintain encryption throughout the transfer process. This dynamic switching between encrypted and decrypted states resolves the contradiction between providing accessible data and maintaining secure transmission
2Ease of operation
If data is decrypted for host access, then data can be read by the host computer system, but the decrypted data becomes vulnerable during transmission over insecure channels
Solution Approach 1:
The device controller performs preliminary encryption of data before it is transmitted over the data link, even after decryption for host access. This preliminary re-encryption action ensures that data maintains security during transmission without requiring the host to manage multiple keys or perform additional encryption operations
Solution Approach 2:
The device controller acts as an intermediary between the host computer system and the storage medium. It handles the complex tasks of decrypting data for host access and re-encrypting it for secure transmission, shielding the host from encryption/decryption operations while maintaining both accessibility and security
3Device complexity
If a single cryptographic key is used for all data, then encryption implementation is simplified, but security is reduced as all data becomes vulnerable to a single key compromise
Solution Approach 1:
The storage device divides its block space into multiple ranges, each protected by a separate cryptographic key. This segmentation ensures that compromise of one key does not affect other data, improving security while maintaining manageable complexity through structured key organization
Solution Approach 2:
Different portions of the storage device have different security properties through their unique keys. Each block range can be independently encrypted and decrypted, allowing fine-grained security control where sensitive data uses stronger protection while less sensitive data uses simpler schemes
Data Source
AI summary
This disclosure relates to data storage device (DSD) hardware and, more specifically, to systems and methods for encrypting data stored on a DSD. A DSD comprises a non-volatile storage medium to store multiple file system data objects using block addressing. The multiple file system data objects are addressable by respective ranges of blocks. A device controller is integrated with the DSD and comprises hardware circuitry configured to encrypt data to be stored on the storage medium and decrypt data stored on the storage medium based on different cryptographic keys, and to use each of the different cryptographic keys for one of the ranges of blocks addressing a respective file system data object. The decryption part of the hardware circuitry can be deactivated so that the data can be read in encrypted form.