Storage Controller Key Management via Nested Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage devices face challenges in enhancing data security through encryption, as they lack robust mechanisms for managing and protecting encryption keys and data keys, leading to potential vulnerabilities in access control and data protection.
Innovation Solution
The storage device incorporates a non-volatile memory and a storage controller that manage encryption keys and data keys by generating and storing encrypted keys based on passwords, allowing secure access and blocking unauthorized access through a multi-level password system, ensuring secure data storage and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a simple encryption key storage method is used, then the device complexity is reduced, but the security of the encryption key is compromised
Solution Approach 1:
The encryption key management is segmented into multiple components: a first key for encrypting the encryption key, and a second key for encrypting data. This segmentation allows each key to have a specific security function, improving overall security while maintaining manageable complexity through clear division of responsibilities.
Solution Approach 2:
The patent implements nested encryption where the encryption key is encrypted by the first key, and data is encrypted by the second key. This nested structure creates multiple layers of security protection, where each layer protects the next, thereby enhancing security without requiring a completely complex new system.
2Reliability
If multiple password levels are implemented, then access control security is improved, but the ease of operation is reduced
Solution Approach 1:
The system dynamically adjusts access control based on password verification. When a correct password is provided, the corresponding encrypted keys are decrypted and made available for data access. This dynamic response allows the system to maintain high security requirements while providing convenient access when proper authentication is given.
Solution Approach 2:
The first key acts as an intermediary between the password and the encryption key. The password verifies access to the first key, which in turn protects the encryption key. This intermediary structure provides layered security while maintaining operational flow, as the intermediary automatically processes authentication without requiring manual intervention at each layer.
3Reliability
If encryption keys are stored in non-volatile memory, then data protection is improved, but the vulnerability to unauthorized access increases
Solution Approach 1:
The patent applies preliminary anti-action by encrypting the encryption key with the first key before storing it in non-volatile memory. This pre-encryption creates a protective barrier that prevents unauthorized access to the encryption key, thereby countering potential theft or misuse before it can occur. The encryption is applied in advance to neutralize the vulnerability of storing sensitive keys in persistent storage.
Data Source
AI summary
A storage device includes a non-volatile memory configured to store an encryption key and a data key encrypted with the encryption key, writes data using the data key, and reads the data using the data key; and a storage controller, wherein the storage controller is configured to receive a first security setting command which allows access to the data key, using a first password, generates a first key on the basis of the first password in response to the first security setting command, encrypts the encryption key with the first key to generate a first encrypted encryption key, encrypts the first key with the encryption key to generate an encrypted first key, and stores the first encrypted encryption key and the encrypted first key in the non-volatile memory.