Disk Drive BLOB Key Storage for Controller Failure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems face challenges in securely managing cryptographic keys, including key authentication for multiple users, key storage burdens on central servers, and key entrapment in failed disk array controllers, which affect data accessibility and security.
Innovation Solution
The solution involves a disk drive system where cryptographic keys are sealed into Binary Large Objects (BLOBs) by a key server using a Trusted Platform Module, stored on disk drives, and unsealed upon request, allowing key migration and access without relying on a specific controller or server, thus decentralizing key storage and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored on a central key server, then key management is centralized and controlled, but the server becomes a single point of failure and key access becomes complex requiring authentication for multiple users
Solution Approach 1:
The patent extracts the cryptographic key from the central key server and stores it directly on the disk drive in encrypted form (BLOB). This removes the key management burden from the server while maintaining security, allowing the server to no longer be a single point of failure for key storage.
Solution Approach 2:
The system segments key storage across multiple locations: the cryptographic key is stored encrypted on each disk drive individually, while the key server retains only the ability to seal and unseal keys. This distribution eliminates the central server as a critical dependency.
2Ease of operation
If cryptographic keys are stored in the disk array controller, then key access is simplified, but the key becomes trapped in the controller and data is inaccessible if the controller fails
Solution Approach 1:
The patent extracts the cryptographic key from the disk array controller and stores it on the disk drive itself. This ensures the key travels with the data and remains accessible even if the controller fails, eliminating the key entrapment problem.
Solution Approach 2:
The system performs preliminary encryption of the key into a BLOB format before storage on the disk drive. This pre-prepared encrypted form allows the key to be stored safely on the drive while maintaining security, and can be unsealed later by the key server when needed.
3Adaptability or versatility
If cryptographic keys are sent from host to drive, then the host controls key management, but this creates security risks and management burdens for large numbers of keys
Solution Approach 1:
The disk drive autonomously manages its own cryptographic key by storing it in encrypted BLOB form on itself. The drive can independently retrieve and use the key for encryption/decryption operations without requiring the host to manually manage each key, enabling self-service key management.
Solution Approach 2:
The system segments key management responsibilities: each disk drive independently manages its own encrypted key (BLOB), while the key server provides centralized sealing/unsealing services. This eliminates the burden of managing large numbers of keys at the host level.
Data Source
AI summary
Embodiments include methods, apparatus, and systems for storage device data encryption. One method includes encrypting data on a storage device with a key and then transmitting the key to a cryptographic module that encrypts the key to form a Binary Large Object (BLOB). The BLOB is transmitted to an array controller that is coupled to the storage device which stores the BLOB.