Encrypting system level data structures

Patent metadata

Field	Value
Publication number	US-11210406-B2
Application number	US-201615212022-A
Country	US
Kind code	B2
Filing date	Jul 15, 2016
Priority date	Jul 15, 2016
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

Systems and methods for encrypting system level data structures are described. A storage system may include a storage drive and at least one controller for the storage drive. In some embodiments, the at least one controller may be configured to identify user data assigned to be stored on the storage drive, encrypt the user data, identify a system data structure generated in relation to the user data, and encrypt the system data structure. In some cases, the data structure may include at least one of metadata, system data, and data encapsulation relative to the user data. In some embodiments, the user data and the data structure may be encrypted with one or more encryption keys programmed on the storage drive.

First claim

What is claimed is:

1. A storage system comprising:
a storage drive; and
a controller of the storage drive to:
receive, from a host computing device connected to the storage drive, user data assigned to be stored on the storage drive;
generate, by the storage drive, a data structure based on the user data, the data structure describing the user data and enabling the user data to be written to the storage drive, the data structure relating to a mapping between a host logical block address for the user data and a physical location where the user data is stored on the storage drive;
encrypt the user data with a first encryption key;
encrypt the data structure with a second encryption key, the first encryption key differing from the first encryption key;
encapsulate the encrypted user data and the encrypted data structure in a packet: and
store the packet in the storage drive without the packet being encrypted as a whole.

2. The storage system of claim 1 , the data structure comprising at least one of metadata, system data, and data encapsulation relative to the user data.

3. The storage system of claim 1 , comprising the controller to:
put the encrypted user data in a payload area of the packet.

4. The storage system of claim 1 , comprising the controller to:
identify header data associated with at least one of the user data and the packet.

5. The storage system of claim 4 , comprising the controller to:
encrypt the header data with the second encryption key.

6. The storage system of claim 5 , comprising the controller to:
put the encrypted header data in a header area of the packet.

7. The storage system of claim 1 , comprising the controller to:
generate metadata in relation to the user data, the metadata comprising data that describes the user data, the metadata being generated by at least one of the storage drive and a user of the storage drive; and
encrypt the metadata with the first encryption key used to encrypt the user data.

8. The storage system of claim 1 , comprising the controller to:
encrypt the data structure with the first encryption key used to encrypt the user data prior to encrypting the data structure with the second encryption key.

9. The storage system of claim 1 , the first encryption key programmed on the storage drive.

10. An apparatus comprising:
a data management module of a data storage device comprising a drive controller and data storage media to:
receive, from a host computing device connected to the data management module, user data assigned to be stored on a memory of the data storage device;
generate a data structure based on the user data, the data structure describing the user data and enabling the user data to be written to the data storage media, the data structure relating to a mapping between a host logical block address for the user data and a physical location where the user data is stored on the storage drive;
encrypt the user data with a first encryption key;
encrypt the data structure with a second encryption key, the first encryption key differing from the first encryption key;
encapsulate the encrypted user data and the encrypted data structure in a packet;
process the packet without the packet being encrypted as a whole; and
storing the packet in the data storage media with the user data and data structure each respectively encrypted.

11. The apparatus of claim 10 , the data structure comprising at least one of metadata, system data, and data encapsulation relative to the user data.

12. The apparatus of claim 10 , comprising the data management module to:
put the encrypted user data in a payload area of the packet.

13. The apparatus of claim 10 , comprising the data management module to:
identify header data associated with at least one of the user data and the packet.

14. The apparatus of claim 13 , comprising the data management module to:
encrypt the header data with the second encryption key.

15. The apparatus of claim 14 , comprising the data management module to:
put the encrypted header data in a header area of the packet.

16. The apparatus of claim 10 , comprising the data management module to:
generate metadata in relation to the user data, the metadata comprising data that describes the user data, the metadata being generated by at least one of the apparatus and a user of the apparatus; and
encrypt the metadata with the first encryption key used to encrypt the user data.

17. A method comprising:
receiving, at a storage drive from a host computing device connected to the storage drive, user data assigned to be stored on the storage drive;
generating, by the storage drive, a data structure based on the user data, the data structure describing the user data and enabling the user data to be written to the storage drive the data structure relating to a mapping between a host logical block address for the user data and a physical location where the user data is stored on the storage drive;
encrypting the user data with a first encryption key;
encrypting the data structure with a second encryption key, the first encryption key differing from the second encryption key;
encapsulating the encrypted user data and the encrypted data structure in a packet; and
storing the packet in the storage drive without the packet being encrypted as a whole.

18. The method of claim 17 , comprising:
putting the encrypted user data in a payload area of the packet;
identifying header data associated with at least one of the user data and the packet; and
putting the encrypted header data in a header area of the packet.

Assignees

• Seagate Technology Llc

Inventors

• Moss Robert W
• Secatch Stacey
• Conklin Kristofer C
• Simonson Dana L

Classifications

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F21/60

  Protecting data · CPC title

• G06F21/72

  in cryptographic circuits · CPC title

• G06F3/0623

  in relation to content · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title