Key Per IO Crypto-Erasure via Internal Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data centers face challenges in definitively crypto-erasing Encryption-Capable Drives (ECDs) that have failed or are decommissioned, leading to risks of forensic recovery of encrypted data.
Innovation Solution
Implementing a device-implemented method that receives external keys for Key per IO operations, generates unique Media Encryption Keys (MEKs) using an internal key and external keys, and enables internal crypto-erasure by destroying the internal key and associated MEKs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the MEK is stored non-volatilely on the ECD, then the key remains available for data decryption, but the drive cannot be definitively crypto-erased if it fails or is decommissioned
Solution Approach 1:
The encryption key is divided into two separate components: a volatile MEK stored in the drive for operational use, and a non-volatile internal key stored in the drive's memory. The MEK is generated by combining the internal key with an external key provided by the host. This segmentation allows the drive to maintain key availability during operation while enabling definitive crypto-erasure by destroying the internal key, which cannot be regenerated.
Solution Approach 2:
The internal key acts as an intermediary that enables the generation of the MEK from an external key. The MEK is not stored directly but is instead generated on-demand by combining the internal key with the external key. This intermediary mechanism allows the system to achieve both key availability during operation and definitive crypto-erasure capability, as the internal key can be destroyed without affecting the external key management.
2Reliability
If multiple copies of the MEK are stored externally to ensure key availability, then data can be decrypted, but key management becomes significantly more difficult to secure
Solution Approach 1:
The complex key management function is extracted from the host system and transferred to the drive itself through the internal key. The drive generates and manages the MEK by combining the internal key with external keys provided by the host. This extraction simplifies key management at the host level while maintaining data accessibility, as the drive autonomously manages the encryption keys without requiring multiple external key copies.
3Loss of information
If the MEK is served to the drive after each power up cycle, then the key can be destroyed and all ciphertext can be crypto-erased externally, but the user must trust the drive to handle non-volatile storage of the MEK
Solution Approach 1:
The drive performs self-service by storing the internal key non-volatilely within itself and using it to generate the MEK from external keys. The drive manages its own key generation and storage without requiring external intervention. This self-service capability ensures that the internal key remains secure and available for generating MEKs while enabling definitive crypto-erasure when needed, as the drive can destroy its internal key without external assistance.
Data Source
AI summary
Device-implemented methodology for enabling and/or performing crypto-erase via internal action and/or external action in a Key per IO-enabled system. In various approaches, crypto-erasure of the data stored in a Key per IO scheme is enabled by implementing an internal key, which is combined with an external key to generate a media encryption key, which is in turn used to encrypt/decrypt data. By restricting access to the internal key, destruction of the internal key and all media encryption key(s) created using the internal key, renders the data crypto-erased, and thus unrecoverable.