Storage Device Cryptographic Key Lifetime Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing semiconductor memory devices lack effective mechanisms to prevent data loss and leakage, especially when a host is hacked, as they do not adequately manage cryptographic keys to ensure secure data protection.
Innovation Solution
A storage device and operation method that utilize a nonvolatile memory system, where cryptographic keys have set lifetimes; when a key's lifetime expires, the system enters a lock mode, returning errors or dummy responses to unauthorized access attempts, thereby protecting data from unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are used to encrypt data in storage devices, then data security is improved, but the risk of data leakage increases if the host is hacked and the key is compromised
Solution Approach 1:
The system segments the cryptographic key management by introducing key identifiers and associating multiple keys with different lifetimes. When a key expires, only data encrypted with that specific key becomes inaccessible, while other data remains protected by their respective keys. This segmentation prevents total data compromise even if one key is stolen.
Solution Approach 2:
The system performs preliminary actions by setting expiration dates for cryptographic keys in advance. Before a key can be exploited by hackers, it automatically expires and becomes invalid. The storage device proactively manages key lifecycles, preventing potential security breaches rather than reacting to them.
2Reliability
If cryptographic keys have fixed lifetimes with automatic locking, then data protection against unauthorized access is improved, but system complexity increases due to key management overhead
Solution Approach 1:
The storage device performs self-service by automatically managing cryptographic key lifecycles without requiring continuous host intervention. The device autonomously tracks key expiration dates, locks expired keys, and manages key identifiers. This automation reduces the management burden on the host while maintaining security.
Solution Approach 2:
The system implements a universal key management mechanism that handles multiple cryptographic keys with different lifetimes through a unified interface. The host interacts with a single key management system that can manage multiple keys, their associations, and their lifecycles, rather than requiring separate management for each key.
3Object-affected harmful factors
If the storage device locks down access to expired cryptographic keys, then data leakage prevention is improved, but operational flexibility decreases as legitimate access may be blocked
Solution Approach 1:
The system introduces dynamic key management where cryptographic keys have configurable lifetimes and can be renewed. Keys transition from active to expired state automatically, but this process is dynamic and can be managed through key identifiers. The host can renew keys or manage their lifecycle to maintain operational flexibility while preventing unauthorized access to expired keys.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An operation method of a storage device which includes a nonvolatile memory device and communicates with a host based on a cryptographic key includes setting up a first key identifier and a first lifetime of a first cryptographic key based on a first command received from the host. The method further includes, after the first lifetime is expired, when a second command including the first key identifier is received from the host, performing a data protect operation on the first cryptographic key.