Self-Encrypting Flash Drive Sector Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Designing Self-Encrypting Drives (SEDs) poses challenges in efficiently performing encryption and decryption processes while ensuring data security and integrity, particularly in flash storage devices used in mobile and smartphone devices.
Innovation Solution
A flash storage device is configured with an encryption module that generates a unique initialization vector based on auxiliary data for each sector write, encrypting plaintext messages with a user key to produce cipher text and authentication data, which is stored separately, and uses this authentication data to decrypt the cipher text during read operations, ensuring data integrity and protection against tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption and decryption processes are implemented in flash storage devices, then data security and integrity are improved, but device complexity increases
Solution Approach 1:
The flash storage device performs self-encryption and self-decryption of data stored within it. The encryption module uses stored keys and initialization vectors to automatically encrypt plaintext data when written to the device and decrypt ciphertext data when read from the device, without requiring external encryption/decryption hardware or software
Solution Approach 2:
The flash storage device is divided into functional modules including an encryption module, a key management module, and data storage areas (ciphertext portion and metadata portion). This segmentation allows each module to perform its specific function independently, managing complexity through modular design while maintaining data security
2Reliability
If authentication data is stored separately from ciphertext, then data integrity is improved, but device complexity increases
Solution Approach 1:
The storage space is segmented into distinct portions: a ciphertext portion for storing encrypted data and a metadata portion for storing authentication data (authentication tags). This separation allows the system to verify data integrity by checking authentication data against decrypted ciphertext without requiring complex external verification mechanisms
Solution Approach 2:
While separating ciphertext and authentication data in different storage portions, the system merges them logically by using the authentication data to verify the integrity of the corresponding ciphertext during decryption. The encryption module manages both portions together, combining their functions to provide comprehensive data integrity protection
Data Source
AI summary
Exemplary methods are provided for storing data in a flash storage device to facilitate subsequent detection of tampering, comprising receiving a plaintext; reading first metadata associated with a device sector; encrypting the plaintext based on the first metadata to generate a cipher text and first authentication data; storing the cipher text in the sector; and storing the first authentication data as second metadata associated with the sector. Exemplary methods are also provided for detecting tampering with data stored in a flash storage device, comprising determining a physical location in a device sector; reading cipher text from the physical location; reading first authentication data and maintenance metadata associated with the sector; decrypting the cipher text based on a user key and the maintenance metadata to generate second authentication data; and determining the occurrence of tampering based on the first and second authentication data. Memory devices embodying said methods are also provided.