Object-Level Storage Device File Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing self-encrypting drives (SEDs) lack the granularity to perform file-level encryption, as they typically associate encryption keys with logical block addresses (LBAs), which limits their ability to provide finer encryption control and independence from LBA addresses, and host systems cannot perform encryption with the same performance as built-in hardware accelerators.
Innovation Solution
An object-level data storage device with a controller and non-volatile solid-state memory array that supports self-encrypting drive functions, enabling file-level encryption by generating statistically unique initialization vectors and allowing individual key selection per input/output operation, utilizing an encryption/decryption module and key management system to encrypt and decrypt data on a per-command basis, leveraging hardware acceleration for performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If self-encrypting drives associate encryption keys with logical block addresses (LBAs) at partition level, then encryption can be performed with hardware acceleration, but the granularity of encryption control is insufficient for file-level encryption
Solution Approach 1:
The patent segments the encryption control from the LBA address space by introducing a separate mapping structure (file system metadata or translation layer) that maps file identifiers to encryption keys independently of LBA addresses. This allows file-level encryption granularity while keeping the underlying LBA-to-key mapping simple and hardware-accelerated.
Solution Approach 2:
The patent introduces an intermediary mapping layer between the file system and the encryption hardware. This intermediary structure (such as a file-to-key mapping table or translation service) decouples the file-level encryption requirements from the LBA-based hardware encryption mechanism, enabling fine-grained control without compromising hardware acceleration performance.
2Adaptability or versatility
If file-level encryption is implemented with independence from LBA addresses, then finer encryption control is achieved, but the storage device lacks knowledge of LBAs allocated by file
Solution Approach 1:
The patent adds another dimension to the encryption control by introducing a file identifier-to-key mapping that operates independently of the LBA address dimension. This creates a parallel encryption control pathway where files can be encrypted based on their own identifiers rather than their LBA allocations, achieving independence from LBA addresses while maintaining necessary information through the alternative mapping dimension.
3Adaptability or versatility
If host systems perform file-level encryption, then independence from storage device is achieved, but performance is inferior to built-in hardware accelerators
Solution Approach 1:
The patent introduces an intermediary mapping layer between the file system and the encryption hardware. This intermediary structure (such as a file-to-key mapping table or translation service) decouples the file-level encryption requirements from the LBA-based hardware encryption mechanism, enabling fine-grained control without compromising hardware acceleration performance.
Solution Approach 2:
The storage device performs self-service by maintaining its own file-to-key mapping information and using its built-in hardware accelerators to perform the actual encryption/decryption operations. This eliminates the need for the host to perform software-based encryption, ensuring both host independence and high performance through hardware acceleration.
Data Source
AI summary
A data storage device includes: a controller; an engine for performing at least one of encryption and decryption; and a logic circuit. In response to receiving a memory access command, the controller controls the logic circuit to generate an initialization vector based on initialization information in a first portion of the received command, selects a key from a plurality of keys based on key information in a second portion of the command, and controls the engine to perform at least one of encrypting and decrypting plain text data specified by the received command using the initialization vector and the selected key.