Intermediary Device for Key-Based I/O Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems lack effective key management for secure input/output operations, particularly in scenarios where data encryption and decryption are required without modifying the storage device controller, posing risks such as data loss or theft.
Innovation Solution
A system and method that include a device with a processing unit and communications circuitry to communicate with a storage device controller and host device, enabling key-based encryption and decryption of data in memory addresses, allowing secure write and read operations without modifying the storage device controller, using look-up tables and key tags to manage encryption and decryption processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key-based encryption and decryption is implemented without modifying the storage device controller, then data security is improved, but device complexity increases due to the need for additional key management components
Solution Approach 1:
The patent introduces an intermediary device positioned between the host device and storage device controller that performs encryption and decryption operations. This intermediary contains key management components including a processing device, communications circuitry, and memory for storing key tags and encryption keys, thereby adding security functionality without modifying the storage device controller itself.
Solution Approach 2:
The system segments the security functionality into a separate intermediary component rather than integrating it into the storage device controller. The intermediary handles key management, encryption, and decryption independently, while the storage device controller remains unchanged, thus adding security without modifying the existing storage controller architecture.
2Reliability
If key per I/O operations are implemented, then data protection is improved, but operation complexity increases due to key identification and management overhead
Solution Approach 1:
The system performs preliminary actions by pre-establishing associations between memory addresses and key tags in a lookup table stored in the intermediary's memory. When data I/O operations occur, the intermediary automatically retrieves the appropriate key tag based on the memory address, eliminating the need for complex real-time key selection logic during data operations.
Solution Approach 2:
The intermediary device automatically manages key identification and retrieval based on memory address information contained in I/O requests. The system self-services by using the memory address from the request to lookup the corresponding key tag in its internal table, and automatically applies the appropriate encryption or decryption key without requiring additional manual key management operations.
3Reliability
If encryption and decryption operations are performed in the intermediary device, then data security is improved, but processing time increases due to additional cryptographic operations
Solution Approach 1:
The intermediary device pre-loads and caches encryption keys and key tags in its memory before data I/O operations begin. This preliminary preparation allows the device to quickly retrieve the appropriate key during encryption or decryption operations, reducing the time penalty associated with cryptographic operations by eliminating key search and management overhead during actual data processing.
Data Source
AI summary
A device includes a communications circuit configured to communicate with a storage device controller and a host device. The device further includes a processing device configured to receive a request from the storage device controller through the communications circuit. The request requests encrypted data be written to a memory address of the host device. The processing device is further configured to identify a key associated with the write request based on the memory address. The processing device is further configured to generate a decrypted version of the data based on the key. The processing device is further configured to initiate transfer, through the communications circuit, of the decrypted version of the data to the host device.