Disk Controller Key Verification via Generation Information
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storage devices face challenges in verifying whether an encryption key used for decrypting data matches the key generated on a host, especially when the key is not stored within the device.
Innovation Solution
A disk device with a controller that receives a key setting request from a host, generates and stores generation information, and manages key information using tables to ensure matching encryption and decryption keys, preventing unnecessary storage and ensuring key integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the storage device stores the encryption key within the device, then key verification is simplified, but security is compromised as the key becomes vulnerable to extraction
Solution Approach 1:
The encryption key is extracted from the storage device and generated externally by the host. The storage device only stores key identification information (key ID and generation information) rather than the actual key, eliminating the security vulnerability of storing keys within the device while maintaining the ability to verify key matching through the stored identification data
2Reliability
If the host generates the encryption key externally, then security is improved, but the storage device cannot verify key matching
Solution Approach 1:
Key identification information (key ID and generation information) serves as an intermediary between the host-generated key and the storage device. This intermediary allows the storage device to verify key matching without storing the actual key, enabling secure external key generation while maintaining verification capability through the intermediary identification data
3Difficulty of detecting and measuring
If the storage device stores key information, then key verification is enabled, but storage space is consumed
Solution Approach 1:
Only the essential key identification information (key ID and generation information) is extracted and stored, rather than storing the complete encryption key. This extraction approach enables key verification functionality while minimizing storage space consumption by storing only the necessary identification data
Data Source
AI summary
A disk device includes a volatile memory, a nonvolatile memory, and a controller. The controller is configured to receive, from a host, a key setting request that includes a cryptographic key, a key ID thereof, and tag information of the cryptographic key and generate generation information of the cryptographic key. The controller is also configured to store a first entry including the tag information, the cryptographic key, and the generation information associated with each other in the volatile memory, and store a second entry including the key ID and the generation information associated with each other in the nonvolatile memory.