Memory Controller Key Caching With Root-of-Trust Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices face challenges in securely managing encryption keys, particularly in scenarios where encryption keys are leaked, leading to potential decryption of encrypted user data.
Innovation Solution
A memory controller and storage device implementation that includes a cache memory for caching media encryption keys, an encryptor for encrypting and decrypting data using a generated second media encryption key based on a first media encryption key and a Root of Trust, and a write operation controller for secure data storage, enhancing key management and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored in the storage device, then data security is improved, but the risk of key leakage increases
Solution Approach 1:
The encryption key management is segmented into multiple components: host-provided first media encryption key, device-generated second media encryption key, and Root of Trust. The key is divided into segments stored in different locations (host and device), so that compromise of one segment does not lead to complete key exposure.
Solution Approach 2:
A mediator mechanism is introduced where the storage device generates a second media encryption key based on the first key from the host and a Root of Trust. This mediator process ensures that the actual encryption key never exists in plaintext form in the device, reducing key leakage risk while maintaining data security.
2Object-affected harmful factors
If encryption keys are managed centrally in the host, then key security is improved, but system complexity increases
Solution Approach 1:
The host performs preliminary action by providing the first media encryption key to the device. The device then preliminarily processes this key by generating the second media encryption key using the Root of Trust, so that when data encryption is needed, the key management process is already prepared and simplified.
Solution Approach 2:
The storage device performs self-service by autonomously generating the second media encryption key using its own Root of Trust and the first key received from the host. This self-service capability reduces the burden on the host while maintaining secure key management, balancing security and complexity.
3Reliability
If multiple encryption keys are generated and cached, then data security is improved, but memory usage increases
Solution Approach 1:
Different encryption keys are used for different purposes and locations: the first media encryption key is maintained by the host, while the second media encryption key is generated and cached in the device's cache memory. This local quality differentiation optimizes memory usage by storing only necessary key segments in device memory.
Solution Approach 2:
The device caches the second media encryption key temporarily in its cache memory for active use, but can discard it when not needed. The key can be recovered on-demand by regenerating it from the first key and Root of Trust, reducing permanent memory requirements while maintaining security.
Data Source
AI summary
The present disclosure relates to a storage device including a memory device to which a namespace including a plurality of zones is applied, a cache memory caching a media encryption key corresponding to each of a plurality of key tags, an encryptor encrypting data subject to a write request in response to a command input from a host by using a media encryption key corresponding to a key tag included in the command, and outputting encrypted data, and a write operation controller controlling the memory device to store the encrypted data in the memory device, wherein the media encryption key is a second media encryption key generated based on a first media encryption key provided from the host and a Root of Trust (RoT) generated from the encryptor.