Encryption Engine Endpoint for Data Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption methods, both software-based and hardware-based, face challenges in high-volume data applications like cloud data servers, where encryption speed is a bottleneck and security risks arise from exposed unencrypted keys and plaintext data, especially in multi-user systems.
Innovation Solution
A data storage system utilizing an encryption engine endpoint that controls encryption keys, storing them only in non-persistent memory, ensuring neither the host nor the encryption engine has access to decrypt the data, and employing direct peer-to-peer communication to bypass the host CPU, enhancing security by preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software-based encryption is used, then flexibility and ease of use are improved, but encryption speed deteriorates and processing resources are consumed
Solution Approach 1:
The patent replaces software-based encryption mechanisms with hardware-based encryption using a self-encrypting storage device. The encryption function is implemented in dedicated hardware circuitry within the storage device, substituting the software execution model with a hardware-level encryption engine that operates independently of the host CPU, thereby achieving both ease of use and high encryption speed.
2Productivity
If hardware-based encryption is used, then encryption speed and CPU resource availability are improved, but security risks from exposed unencrypted keys and plaintext data worsen
Solution Approach 1:
The patent extracts the encryption keys and plaintext data from the host system memory where they would be vulnerable to attacks. The self-encrypting storage device maintains its own independent encryption keys internally, and plaintext data is encrypted immediately upon entering the device's memory buffer, preventing exposure in the host system. This extraction of sensitive elements from the host environment resolves the security risks while maintaining hardware-based encryption speed.
3Reliability
If encryption is performed in high-volume data applications, then data security is improved, but encryption speed becomes a bottleneck
Solution Approach 1:
The patent merges the encryption function directly into the storage device hardware, combining data storage and encryption operations into a single integrated system. The self-encrypting storage device performs encryption at the hardware level within its own circuitry, eliminating the need for separate software encryption processes. This merging of storage and encryption functions enables high-volume data processing with maintained security, as the encryption operates in parallel with data I/O operations without becoming a bottleneck.
Data Source
AI summary
A system and method that utilize an encryption engine endpoint to encrypt data in a data storage system are disclosed. In the system and method, the client controls the encryption keys utilized to encrypt and decrypt data such that the encryption keys are not stored together with the encrypted data. Therefore, once data is encrypted, neither the host of the data storage system, nor the encryption engine endpoint have access to the encryption keys required to decrypt the data, which increases the security of the encrypted data in the event of, for example, the data storage system being accessed by an unauthorized party.