Storage Controller Encrypting Data Keys via Diffie-Hellman
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices face security risks when sharing data encryption keys between users, as unencrypted key transfer can lead to security compromises and unauthorized access.
Innovation Solution
Implementing a storage device with a nonvolatile memory and a controller that uses the Diffie-Hellman algorithm to encrypt and decrypt data encryption keys, ensuring secure key sharing by generating a common key for encryption and decryption, thus preventing key leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the data encryption key is shared between users in plaintext, then users can access the storage space, but security is compromised and key leakage occurs
Solution Approach 1:
The patent introduces an encrypted form of the data encryption key as an intermediary between the key owner and other users. Instead of directly sharing the plaintext key, the system uses encryption to mediate the key distribution process, allowing secure sharing while maintaining security. The encrypted key acts as a safe intermediary that can be transmitted and stored without exposing the actual decryption key.
2Reliability
If the data encryption key is encrypted before sharing, then security is maintained, but users cannot directly access the storage space
Solution Approach 1:
The patent segments the key access process into multiple stages: the key is divided into an encrypted form for distribution and a decryption mechanism stored separately in the storage device. This segmentation allows the encrypted key to be safely shared while the decryption capability remains protected within the device, resolving the contradiction between security and accessibility.
Solution Approach 2:
The patent applies preliminary encryption to the data encryption key before sharing it with users. By pre-encrypting the key and storing the encrypted version externally while keeping the decryption mechanism internal, the system prepares the key for secure distribution in advance, enabling both security maintenance and future user access without requiring plaintext key transmission.
3Reliability
If different encryption methods are used for different users, then user-specific security is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal encryption approach where a single encryption algorithm is applied to the data encryption key regardless of which user will access it. This multi-functional encryption system handles all user key distribution needs through one consistent method, providing user-specific security through the encryption itself rather than through multiple different encryption schemes, thereby reducing device complexity.
Data Source
AI summary
A storage device includes a nonvolatile memory device, and a controller that manages a data encryption key (DEK). The DEK is used to encrypt data to be written in a storage space of the nonvolatile memory device by a first user and to decrypt data read from the storage space. The controller grants a second user authority to access the storage space by encrypting the DEK based on a Diffie-Hellman (DH) algorithm, grants a second user authority to access the encrypted DEK, and decrypts the encrypted DEK based on the DH algorithm.