Self-Encrypting Drive Key Rotation via Nested Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing key rotation methods in self-encrypting drives (SEDs) expose user data in the clear, which poses privacy and security risks, and involve time-consuming cryptographic operations due to the need to decrypt and re-encrypt large data sets.

Innovation Solution

The method involves generating new media encryption keys (MEK) and media encryption key encryption keys (MEKEK) without decrypting user data, using a nested construction to update/rotate keys, and re-encrypting ciphertext data with the new MEK, all while maintaining the data in an encrypted state.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing key rotation methods are used in SEDs, then keys can be updated, but user data is exposed in the clear during the process

Engineering Contradiction:

Improvedata securityVSAvoiddata exposure risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary encryption of the new MEK with the current MEKEK before the key rotation is complete. This preliminary action ensures that even if the rotation is interrupted, the data remains protected. The new MEK is prepared and encrypted in advance, then integrated into the nested structure without exposing plaintext data during the transition.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements a nested encryption structure where the new MEK is encrypted by the current MEKEK, and this encrypted MEK is stored within the existing encryption hierarchy. This nesting allows key rotation while maintaining continuous encryption protection, as each layer encrypts the next without requiring plaintext exposure.

Inventive Principle:

Principle #7Nested doll (Nesting)

2Reliability

If existing key rotation methods are used in SEDs, then keys can be rotated, but time-consuming cryptographic operations are required due to decrypting and re-encrypting large data sets

Engineering Contradiction:

Improvekey rotation capabilityVSAvoidkey rotation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts the key rotation operation from the data processing operation. Instead of decrypting and re-encrypting data, the system rotates keys by operating only on the encryption keys themselves through nested encryption. This extraction separates key management from data processing, eliminating the time-consuming decrypt-reencrypt cycle while maintaining key rotation capability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The current MEKEK serves as an intermediary that enables the transition from the old MEK to the new MEK without direct data involvement. The MEKEK mediates the key rotation by encrypting the new MEK and integrating it into the nested structure, allowing key rotation to occur independently of the data encryption/decryption process, thus reducing time consumption.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250125955A1Updateable encryption in self encrypting drives

Publication Date: 2025.04.17 SEAGATE TECH LLC

AI summary

A method of rotating a set of keys, having a media encryption key (MEK) and a current media encryption key encryption key (MEKEK) encrypted and stored in a self-encrypting drive (SED) having data encrypted with the MEK (MEK (data)), includes decrypting the stored MEK and the current MEKEK. A new MEK (MEK′) and a new MEKEK (MEKEK′) are generated. The MEKEK′ is encrypted to replace the current encrypted MEKEK. A concatenation of the MEK and the MEK′ is encrypted with MEKEK′. The encrypted data MEK (data) is re-encrypted with MEK′.