Data Storage Device Encryption Hardware Circuitry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage devices do not provide adequate end-to-end encryption, as data transmitted between the device and the host computer system remains unencrypted, making it vulnerable to unauthorized access during transfer, even when the storage itself is encrypted.
Innovation Solution
Implementing a data storage device with hardware circuitry that encrypts data using a cryptographic key and sends it in encrypted form across insecure links, while allowing decryption only when necessary, ensuring that data is stored and transmitted securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full disk hardware encryption is implemented, then data stored on the device is encrypted, but data transmitted over the data link remains unencrypted and vulnerable to eavesdropping
Solution Approach 1:
The patent applies preliminary action by encrypting data at the source (storage device) before transmission occurs. The storage device encrypts data using a first cryptographic key before sending it over the data link, so the encryption is already in place before the data becomes vulnerable during transmission.
Solution Approach 2:
The patent uses cryptographic keys as intermediaries to protect data. A first key is used for encryption at the storage device, and a second key is used for decryption at the host system. These keys act as mediators that enable secure data protection without exposing the actual data during transmission.
2Reliability
If data is encrypted at the storage device, then data at rest is protected, but the data link between storage device and host remains insecure
Solution Approach 1:
The patent segments the encryption process into distinct stages: encryption at the storage device using a first key, transmission over the data link, and decryption at the host system using a second key. This segmentation allows each component to perform its specific encryption function independently, achieving end-to-end encryption without requiring the entire system to use a single encryption method.
Solution Approach 2:
The patent changes the cryptographic parameters (keys) used at different stages of data handling. The storage device uses a first cryptographic key for encryption, while the host system uses a second cryptographic key for decryption. This parameter change enables flexible end-to-end encryption where different keys are applied at different points in the data flow.
3Ease of operation
If decryption is always performed, then data is accessible to the host system, but data transmitted over insecure channels remains vulnerable
Solution Approach 1:
The patent applies preliminary action by performing encryption at the storage device before data leaves the secure environment. This ensures data is protected in advance, and decryption is only performed at the destination host system where the data is needed, rather than during transmission over insecure channels.
Solution Approach 2:
The patent uses cryptographic keys as intermediaries to control data accessibility. The first key enables encryption at the storage device, and the second key enables decryption at the host system. These intermediary keys allow data to remain encrypted during transmission while still being accessible to authorized systems that possess the appropriate decryption key.
Data Source
AI summary
This disclosure relates to data storage device (DSD) hardware and, more specifically, to systems and methods for encrypting data stored on a DSD. A DSD comprises a non-volatile storage medium to store multiple file system data objects using block addressing. A device controller is integrated with the DSD and comprises hardware circuitry configured to encrypt data to be stored on the storage medium. The controller receives a request for an encrypted file system data object from a host computer system, identifies one of the ranges of blocks where the requested encrypted file system data object is stored on the storage medium, and sends the file system data object stored in the identified range of blocks to the host computer system in encrypted form as stored on the storage medium.