Storage Controller Key Extraction for Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices face risks of data leakage due to exposure of shared encryption keys when encrypting and decrypting data, compromising data security even when encrypted data is stored.
Innovation Solution
A storage device with a non-volatile memory and a storage controller that reads non-encrypted commands from memory, transmits encrypted data based on these commands, and returns non-encrypted completion results, ensuring encryption keys are not shared or exposed, thus maintaining data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the storage device receives a shared key used for encryption from the processor to decrypt the command, then the storage device can decrypt and execute commands accurately, but there is a risk of exposure of the key shared with the storage device
Solution Approach 1:
The patent extracts the encryption key management function from the storage device and places it exclusively in the processor. The storage device no longer holds or receives encryption keys, eliminating the risk of key exposure while maintaining the ability to execute encrypted commands through a trusted communication channel.
Solution Approach 2:
The patent introduces a trusted communication channel as an intermediary between the processor and storage device. This channel allows the storage device to receive encrypted commands and return encrypted responses without needing to possess the encryption key, thus enabling secure communication while preventing key exposure.
2Reliability
If the storage device stores encrypted data, then data security is improved, but the storage device needs to decrypt commands which requires sharing encryption keys
Solution Approach 1:
The patent removes the encryption key storage and management functionality from the storage device, extracting it to the processor instead. This simplifies the storage device's design by eliminating key management complexity while maintaining data security through encrypted storage and communication.
Solution Approach 2:
The processor retains exclusive control over encryption keys and performs all encryption/decryption operations itself. The storage device serves itself by simply storing and retrieving encrypted data without needing to manage or process encryption keys, thereby reducing overall system complexity.
Data Source
AI summary
A storage device includes a non-volatile memory, and a storage controller configured to read a non-encrypted command from a memory outside the storage device. The storage controller is also configured to transmit encrypted data to the non-volatile memory or the memory based on the non-encrypted command, and transmit a non-encrypted completion to the memory. The non-encrypted completion indicates a result of executing the non-encrypted command.