Storage Controller Selective Decryption for Encrypted Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices face challenges in efficiently decrypting only the necessary portions of encrypted data for computations, as they often require decrypting entire logical regions or namespaces, which poses security risks and inefficiencies.
Innovation Solution
The storage device employs a controller that uses specific keys for encrypting and decrypting only particular portions of data, rather than entire logical regions or namespaces, allowing for selective decryption and computation on specific data sets without exposing other data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire logical region or namespace is decrypted for computation, then computation can be performed on the data, but security is compromised and inefficiency occurs due to decrypting unnecessary data
Solution Approach 1:
The patent segments the encrypted data into multiple portions, each encrypted with a different key. This allows the controller to decrypt only the specific portion needed for computation rather than the entire logical region, thereby maintaining security while improving computation efficiency.
Solution Approach 2:
The patent applies different encryption keys to different portions of data based on their access requirements. This local differentiation allows selective decryption of only the necessary data portions, resolving the contradiction between security and computation efficiency.
2Reliability
If only a portion of encrypted data is decrypted using a specific key, then security is improved by limiting decryption scope, but the complexity of key management increases
Solution Approach 1:
The patent implements a universal key management structure where the controller can selectively apply different keys to different data portions. This multi-functional key management system handles both full-region and partial-region decryption scenarios, improving security without proportionally increasing complexity.
Data Source
AI summary
Aspects of a storage device are provided that perform partial decryption of host encrypted data and encryption of host provided data using received or generated keys for data targeted for compute services. The storage device may include a non-volatile memory and a controller. The controller may receive encrypted data, receive a key associated with a portion of the encrypted data, and decrypt the portion of the encrypted data based on the key without decrypting a remainder of the encrypted data. The controller may also receive data, receive or generate a key associated with a portion of the data, encrypt the portion of the data based on the key without encrypting a remainder of the data based on the key, and store the encrypted portion of the data in the non-volatile memory for subsequent decryption. As a result, a balance between encrypted data storage and decrypted data security may be achieved.