System and method for providing data integrity

Patent metadata

Field	Value
Publication number	US-9652408-B2
Application number	US-201414444819-A
Country	US
Kind code	B2
Filing date	Jul 28, 2014
Priority date	Nov 25, 2008
Publication date	May 16, 2017
Grant date	May 16, 2017

Abstract

Systems and methods for providing data integrity for stored data are disclosed. A method may include, in connection with the receipt of a read command at a storage resource, reading a data block from the storage resource, the data block including a data field, a data integrity field indicating the integrity the data field, and an encryption indicator field indicating whether the data block is encrypted with a current cryptographic key for the storage resource. The method may further include determining whether the data field is encrypted with the current cryptographic key based at least on the encryption indicator field. The method may additionally include returning at least a portion of the data block in reply to the read command in response to determining that the data field is encrypted with a cryptographic key other than the current cryptographic key.

First claim

What is claimed is:

1. A method comprising:
receiving a read command at a storage resource, wherein the read command is received in connection with an initialization of a storage array;
reading a data block from the storage resource, the data block comprising:
a data field,
a data integrity field, indicating the integrity of the data field, and
a key counter value field indicating a cryptographic key used to encrypt the data field;

comparing the key counter value field to a key counter register associated with the storage resource, wherein the key counter register is modified each time a cryptographic key of the storage resource is modified, the modified cryptographic key is to be used to encrypt the data field when the data block is to be written to the storage resource;
returning at least a portion of the data field if the key counter value field does not equal the key counter register;
determining whether the data field is corrupted based on the data integrity field, if the key counter value field equals the key counter register; and
returning an error indication if the data field is corrupted.

2. The method of claim 1 , further comprising returning at least a portion of the data field in reply to the read command if the data field is not corrupted.

3. The method of claim 1 , further comprising returning an indication that the data field was encrypted with a previous cryptographic key if the key counter value does not equal the key counter register.

4. The method of claim 1 , wherein the storage resource comprises a full-disk encryption storage resource.

5. The method of claim 1 , further comprising returning an indication that the read command has completed.

6. A storage resource comprising:
a cryptographic key;
a key counter register; and
a non-transitory computer-readable storage medium;
the storage resource configured to:
receive a read command at a storage resource, wherein the read command is received in connection with an initialization of a storage array;
read a data block from the storage medium, the data block comprising:
a data field,
a data integrity field, indicating the integrity of the data field, and
a key counter value field indicating a cryptographic key used to encrypt the data field;

compare the key counter value field to the key counter register, wherein the key counter register is modified each time the cryptographic key is modified, the modified cryptographic key is to be used to encrypt the data field when the data block is to be written to the storage resource;
return at least a portion of the data field if the key counter value field does not equal the key counter register;
determine whether the data field is corrupted based on the data integrity field, if the key counter value field equals the key counter register; and
return an error indication if the data field is corrupted.

7. The storage resource of claim 6 , further configured to return at least a portion of the data field in reply to the read command if the data field is not corrupted.

8. The storage resource of claim 6 , further configured to return an indication that the data field was encrypted with a previous cryptographic key if the key counter value does not equal the key counter register.

9. The storage resource of claim 6 , wherein the storage resource comprises a full-disk encryption storage resource.

10. The storage resource of claim 6 , further configured to return an indication that the read command has completed.

Assignees

• Cherian Jacob
• Marks Kevin
• Dell Products Lp

Inventors

• Cherian Jacob
• Marks Kevin

Classifications

• G06F2212/1052

  Security improvement · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title