Tenant and Type Key Encryption for Key-Limited KPIO Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Key Per IO (KPIO)-compliant encryption devices can only handle a limited number of keys, typically up to 4,096, which restricts the number of tenants and data types that can be accommodated, necessitating trade-offs between tenant count and data type granularity.
Innovation Solution
A method that combines a tenant key with a type key to create a combined key for encryption and decryption, utilizing a subset of address bits for tenant identification and another subset for data type, enabling devices to handle a smaller number of keys while supporting multiple data types, with crypto-erase capabilities at three levels of granularity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple keys are assigned per tenant to enable independent crypto-erase of different data types, then data type granularity is improved, but the number of tenants that can be accommodated decreases
Solution Approach 1:
The patent segments the key identification space by dividing the 16-bit NVMe header field into two distinct subsets: one for identifying external tenant keys and another for identifying type keys representing different data types. This segmentation allows independent management of tenant keys and data type keys, enabling fine-grained crypto-erase operations without increasing the total number of keys the device must handle simultaneously.
Solution Approach 2:
The patent introduces type keys as intermediary elements that mediate between tenant keys and encryption operations. Instead of creating multiple keys per tenant, the type key acts as a mediator that can be combined with a single tenant key to achieve different encryption modes or data type-specific encryption, thereby reducing the total key count while maintaining data type granularity.
2Adaptability or versatility
If the number of simultaneously handled keys is increased to accommodate more tenants and data types, then tenant capacity and data type support are improved, but device complexity increases
Solution Approach 1:
The patent segments the key management function into two independent components: external key management for tenant identification and type key management for data type identification. This segmentation simplifies device complexity by allowing each component to be managed independently with smaller key sets, rather than managing one large set of combined keys.
Solution Approach 2:
The type keys serve multiple functions: they identify data types, enable fine-grained crypto-erase operations, and can be combined with any tenant key to create encrypted data streams. This multi-functionality reduces the need for dedicated keys for each tenant-data type combination, thereby reducing overall key management complexity.
3Ease of operation
If a fixed address field is used for key identification, then device operation simplicity is improved, but the number of supported keys is limited
Solution Approach 1:
The patent segments the fixed address field into two distinct subsets of bits: one subset for external key identification and another subset for type key identification. This segmentation allows the fixed address field to efficiently encode both tenant and data type information simultaneously, maintaining ease of operation while effectively doubling the information capacity without requiring additional address space.
Solution Approach 2:
The patent adds a new dimension to the key identification space by introducing type keys as a separate identifier dimension. Instead of using a single-dimensional key index, the system uses a two-dimensional addressing scheme where one dimension identifies the tenant key and the other identifies the type key, thereby expanding the total number of supported key combinations while maintaining the same address field size.
Data Source
AI summary
A device-implemented method, in accordance with one aspect of the present invention, includes receiving a command having an address field of predefined length. A first subset of bits in the address field identify an external key of a particular tenant, and a second subset of the bits in the address field corresponds to one of a plurality of type keys associated with different data types. The external key identified by the first subset of bits is retrieved. The type key corresponding to the second subset of bits is also retrieved. The tenant and type keys are combined to create a combined key for use in encrypting and/or decrypting data associated with the command.