Storage Device Encrypted-Data-Only Write Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a corporate environment, ensuring that data stored on storage devices is encrypted at rest is challenging, especially when devices are installed in platforms that do not perform OS-level encryption, making it difficult to trust that the data is encrypted and requiring complex solutions to maintain security and prevent data leakage.
Innovation Solution
Implementing an encrypted-data-only storage solution where storage devices only write encrypted data and return media errors for unencrypted content, using an entropy check to verify encryption and a password-based mechanism to control encrypted-data-only usage, allowing only trusted platforms to access the unlock key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If operating system encryption is used, then data security is improved, but it becomes difficult to verify that data is encrypted on devices installed in platforms that do not perform OS-level encryption
Solution Approach 1:
The storage device performs self-verification by checking the entropy of incoming data to determine if it is encrypted. The device autonomously detects whether the data meets encryption requirements without needing external verification mechanisms, thereby solving the verification difficulty while maintaining security.
Solution Approach 2:
The system implements feedback by returning media errors when unencrypted data is detected through entropy checking. This feedback mechanism informs the host system about the encryption status of data being written, enabling verification of encryption without compromising security.
2Reliability
If hardware encryption is implemented, then data security is improved, but device complexity and firmware trust boundaries increase
Solution Approach 1:
The encryption verification function is extracted from the storage device firmware and placed in the host system software. The storage device only performs simple entropy checking and returns errors, while the host system handles the complex logic of encryption verification and key management, thereby reducing firmware complexity and trust boundaries.
Solution Approach 2:
The entropy check acts as an intermediary mechanism between the host system and storage device. Instead of requiring direct trust in firmware or complex hardware encryption, the system uses entropy checking as a mediator to verify encryption status, simplifying the overall system architecture and reducing trust requirements.
3Difficulty of detecting and measuring
If entropy checking is performed on every write operation, then encryption verification is improved, but processing speed decreases
Solution Approach 1:
Instead of performing exhaustive verification of every byte, the system performs partial entropy checking on sampled data portions. This partial action approach provides sufficient verification of encryption status while minimizing the impact on write performance, balancing security verification with productivity.
Data Source
AI summary
Techniques for encrypted-data-only media operations are described. In some instances, data from a source to be written to memory of a storage device is received by a storage device and the storage devices determines whether the data is encrypted at a storage location based on an amount of entropy of the received data. When the received data is not encrypted a media error is returned to the source and when the received data is encrypted the data is written.