Encrypted transport solid-state disk controller

Patent metadata

Field	Value
Publication number	US-9760502-B2
Application number	US-201514752463-A
Country	US
Kind code	B2
Filing date	Jun 26, 2015
Priority date	Apr 29, 2011
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

Method and apparatus for transferring protected data. In some embodiments, an encrypted transport solid state drive (SSD) has a non-volatile memory and a controller circuit. The controller circuit is configured to, responsive to receipt of a write command from a host device to store an encrypted data set to the non-volatile memory, decrypt the encrypted data set using a first encryption key to generate a decrypted data set, apply lossless compression to the decrypted data set to generate a decrypted compressed data set, encrypt the decrypted compressed data set using a second encryption key to generate an encrypted compressed data set, and to direct storage of the encrypted compressed data set in the non-volatile memory.

First claim

What is claimed is:

1. A solid state drive (SSD), comprising:
a non-volatile memory; and
a controller circuit configured to, responsive to a transfer by the SSD of a first encryption key to a host device and receipt by the SSD of a write command from the host device to store an encrypted data set encrypted by the host device using the first encryption key to the non-volatile memory, decrypt the encrypted data set using the first encryption key to generate a decrypted data set, apply lossless compression to the decrypted data set to generate a decrypted compressed data set, encrypt the decrypted compressed data set using a second encryption key different from the first encryption key to generate an encrypted compressed data set, and to direct storage of the encrypted compressed data set in the non-volatile memory at a storage address identified by the write command, the controller circuit configured as a single integrated circuit to form a secure physical boundary for the decryption of the encrypted data set, the application of the lossless compression to the decrypted data set, and the encryption of the compressed data set.

2. The SSD of claim 1 , wherein the controller circuit comprises a programmable processor with associated programming stored in a controller memory device.

3. The SSD of claim 1 , wherein the controller circuit comprises a decryption hardware layer, a lossless compression hardware layer, an internal encryption hardware layer and a flash memory interface.

4. The SSD of claim 1 , wherein the controller circuit is further configured to direct retrieval of the encrypted compressed data set from the non-volatile memory to a local buffer memory, to decrypt the encrypted compressed data set using the second encryption key to regenerate the decrypted compressed data set, to apply lossless decompression to the decrypted compressed data set to regenerate the decrypted data set, to encrypt the decrypted data set using the first encryption key to regenerate the encrypted data set, and to direct a transfer of the encrypted data set to a receiving device.

5. The SSD of claim 4 , wherein the receiving device is a display device configured to display contents of the encrypted data set to a user.

6. The SSD of claim 4 , wherein the receiving device is the host device.

7. The SSD of claim 1 , wherein the non-volatile memory is characterized as a flash memory device.

8. The SSD of claim 1 , wherein the lossless compression uses a Lempel Ziv (LZ) compression algorithm.

9. The SSD of claim 1 , wherein the controller circuit employs a public key encryption algorithm.

10. The SSD of claim 1 , wherein the controller circuit is further configured to, responsive to establishment of a secure communication link with the host device over a network, transfer the first encryption key to the host device via the secure communication link to facilitate generation of the encrypted data set by the host device.

11. The SSD of claim 1 , wherein the controller circuit is further configured to format the encrypted compressed data set for storage in the non-volatile memory.

12. An apparatus comprising:
a remote server comprising a processor and memory, the memory storing a data set; and
a solid state drive (SSD) connected to the remote server over a network and comprising a non-volatile memory and a controller circuit;
the remote server configured to establish a secure link over the network between the remote server and the SSD;
the controller circuit configured to transfer a first encryption key to the remote server via the secure link;
the remote server further configured to encrypt the data set using the first encryption key to generate an encrypted data set;
the remote server further configured to transfer the encrypted data set to the SSD via the secure link;
the controller circuit further configured to decrypt the encrypted data set using the first encryption key to generate a decrypted data set;
the controller circuit further configured to apply lossless compression to the decrypted data set to generate a decrypted compressed data set;
the controller circuit further configured to encrypt the decrypted compressed data set using a second encryption key different from the first encryption key to generate an encrypted compressed data set;
the controller circuit further configured to direct storage of the encrypted compressed data set at a storage address identified by a write command in the non-volatile memory, the controller circuit configured as a single integrated circuit to form a secure physical boundary for the decrypting, applying and encrypting steps.

13. The apparatus of claim 12 , further comprising a local display device connected to the SSD and configured to display the data set to a user, wherein the controller circuit is further configured to transfer the data set to the local display device by directing a retrieval of the encrypted compressed data set from the non-volatile memory to a local buffer memory of the SSD, decrypting the encrypted compressed data set using the second encryption key to regenerate the decrypted compressed data set, applying lossless decompression to the decrypted compressed data set to regenerate the decrypted data set, encrypting the decrypted data set using the first encryption key to regenerate the encrypted data set, and to direct a transfer of the encrypted data set to the local display device.

14. The apparatus of claim 13 , wherein the local display device comprises a decryption engine which decrypts the encrypted data set transferred from the SSD using the first encryption key and outputs the decrypted data set to a display.

15. A computer-implemented method comprising:
using a solid state disk (SSD) device having a controller circuit and a non-volatile memory to transmit a first encryption key to a host device;
receiving, by the SSD device, an encrypted data set from the host device, the encrypted data set encrypted by the host using the first encryption key;
decrypting, by the controller circuit, the encrypted data set using the first encryption key to generate a decrypted data set;
applying, by the controller circuit, lossless compression to the decrypted data set to generate a decrypted compressed data set;
encrypting, by the controller circuit, the decrypted compressed data set using a second encryption key different from the first encryption key to generate an encrypted compressed data set; and
storing the encrypted compressed data set in at the storage address identified by a write command in the non-volatile memory of the SSD data storage device, the controller circuit configured as a single integrated circuit to form a secure physical boundary for the decrypting, applying and encrypting steps.

16. The method of claim 15 , further comprising formatting the encrypted compressed data set for storage in the non-volatile memory.

17. The method of claim 15 , further comprising subsequent steps of:
retrieving the encrypted compressed data set from the non-volatile memory;
decrypting, by the controller circuit, the encrypted compressed data set using the second encryption key to regenerate the decrypted compressed data set;
applying, by the controller circuit, lossless decompression to the decrypted compressed data set to regenerate the decrypted data set;
encrypting, by the controller circuit, the decrypted data set using the first encryption key to regenerate the encrypted data set; and
transferring the encrypted data set to a receiving device.

18. The method of claim 15 , wherein the non-volatile memory

Assignees

• Seagate Technology Llc

Inventors

• Raam Farbod Michael

Classifications

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G11C16/22

  Safety or protection circuits preventing unauthorised or accidental access to memory cells · CPC title

• G06F13/38 Primary

  Information transfer, e.g. on bus (G06F13/14 takes precedence) · CPC title