Storage Controller Homomorphic Encryption Accelerator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Homomorphic encryption and decryption technologies face challenges with large ciphertext sizes and high computational complexity, leading to security risks during data transmission and processing.
Innovation Solution
A storage controller with a homomorphic encryption and decryption accelerator that performs encryption and decryption operations within the storage controller, minimizing the transmission of large ciphertext data and maintaining security by keeping public and secret keys within the controller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If homomorphic encryption is applied to encrypt plaintext data, then security is improved, but ciphertext size increases significantly
Solution Approach 1:
The patent segments the storage system into multiple storage domains (first storage domain, second storage domain, third storage domain) with different encryption requirements. The first storage domain stores encrypted data for server transmission, the second stores encrypted data for local use only, and the third stores unencrypted data. This segmentation allows the system to apply homomorphic encryption selectively only where needed, rather than encrypting all data, thereby maintaining security where required while avoiding unnecessary ciphertext expansion.
2Reliability
If homomorphic encryption is applied to encrypt plaintext data, then security is improved, but computational complexity increases
Solution Approach 1:
The patent divides the storage controller into multiple processing units that handle different storage domains independently. Each processing unit manages specific encryption operations for its designated domain, avoiding the need for a single complex processing unit to handle all encryption operations. This segmentation of computational tasks reduces the complexity burden on any single component while maintaining overall security.
Solution Approach 2:
The patent introduces a storage domain determination unit as an intermediary that decides whether encryption is needed before data is stored. This intermediary component filters out data that does not require encryption, preventing unnecessary computational complexity from being applied to data that will remain in the system without transmission, thereby reducing overall computational burden.
3Ease of operation
If plaintext data is transmitted to server system, then data accessibility is improved, but security risk increases
Solution Approach 1:
The patent segments data into different storage domains based on transmission requirements. Data designated for server transmission is stored in the first storage domain with encryption applied, while data for local use only is stored in the second storage domain. This segmentation ensures that only necessary data is transmitted to the server, maintaining accessibility for required operations while minimizing security risks by not exposing all data to transmission channels.
4Reliability
If large ciphertext data is transmitted, then encrypted data transmission is achieved, but transmission burden increases
Solution Approach 1:
The patent segments the storage system into multiple storage domains with different encryption requirements. By identifying and storing data that does not require transmission to external servers in encrypted form within the same storage device (second storage domain), the system avoids the energy burden of transmitting large ciphertext data over networks. Only data requiring external access is transmitted, minimizing transmission burden while maintaining encrypted transmission where necessary.
Data Source
AI summary
A client system includes a client-side host device, and a client-side storage device including a storage controller and a storage memory. The storage controller includes a host interface, a processor configured to control a read operation and a write operation for the storage memory, and a homomorphic encryption and decryption accelerator configured to, based on receiving a read request from the client-side host device, perform homomorphic encryption on first plaintext data that is read from the storage memory, to generate first homomorphic ciphertext data, and provide the first homomorphic ciphertext data to the client-side host device through the host interface, and based on receiving a write request from the client-side host device, perform homomorphic decryption on second homomorphic ciphertext data that is received through the host interface, to generate second plaintext data, and write the second plaintext data in the storage memory.