Flash Memory Data Protection via Key Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Flash memory devices do not securely erase data, allowing unauthorized access to deleted information due to the persistence of data in memory blocks.
Innovation Solution
A data storage device with a controller that generates and stores encryption keys in separate blocks, encrypts files using these keys, and deletes the keys upon receipt of an eliminating command to invalidate the encrypted files, ensuring secure data protection by rendering the encrypted files inaccessible.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If data is stored in flash memory blocks, then data storage capability is improved, but data security deteriorates because deleted data can be recovered
Solution Approach 1:
The patent extracts the encryption key from the stored data and stores it separately in a key management structure. When data is deleted, only the key is removed while the encrypted data remains in place, rendering the data unrecoverable without the key. This separation of key and data resolves the contradiction by maintaining storage capacity while enhancing security.
Solution Approach 2:
The patent applies encryption to data before storing it in flash memory blocks. This preliminary encryption action ensures that even if data is deleted and recovered from the storage medium, it remains unintelligible without the corresponding decryption key, thus maintaining data security while preserving storage functionality.
2Reliability
If encryption keys are stored with encrypted data, then data security is improved, but data accessibility deteriorates when keys need to be deleted
Solution Approach 1:
The patent segments the data storage system into distinct components: encrypted data storage areas and separate key management structures. This segmentation allows independent management of data and keys, enabling secure deletion of keys while preserving encrypted data in place, thus maintaining both security and operational flexibility.
Solution Approach 2:
The patent introduces a key management structure as an intermediary between the encryption keys and the encrypted data. This intermediary layer enables controlled access and secure key deletion without directly manipulating the encrypted data, simplifying the operation of key management while maintaining security.
3Reliability
If separate key storage is implemented, then data security is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal key management structure that can handle multiple encryption keys and corresponding encrypted data blocks. This multi-functional structure consolidates key generation, storage, and deletion operations into a single manageable system, reducing overall device complexity while maintaining enhanced security through separate key storage.
Data Source
AI summary
A flash memory includes a plurality of blocks. A controller encrypts a first file to produce a first encrypted file and stores the first encrypted file to the flash memory, wherein the controller further comprises a key generation module, an encryption/decryption module and a key eliminating module. The key generation module produces a first key according to a first write command of a host device, wherein the first key is stored in a first block of the blocks. The encryption/decryption module encrypts the first file according to the first key to produce a first encrypted file, wherein the first encrypted file is stored in at least one second block of the blocks. The key eliminating module deletes the first key stored in the first block according to a first eliminating command in order to invalidate the first encrypted file stored in the second block.