Cascaded data encryption dependent on attributes of physical memory

• US 9,396,136 B2
• Filed: 10/13/2014
• Issued: 07/19/2016
• Est. Priority Date: 04/29/2011
• Status: Active Grant

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Hars, Laszlo, Matthews, Donald P. Jr.
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): GIDDINS, NELSON S
• Application Number:
  US14/512,793
• Publication Number:
  US 20150052370A1
• Time in Patent Office: 645 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/0246 in block erasable memory, e.g. flash memory
• CPC Class Codes: G06F 12/14 Protection against unauthorised use of memory or access to memory
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/7201 Logical to physical mapping or translation of blocks or pages
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Apparatus and method for providing data security through cascaded encryption. In accordance with various embodiments, input data are encrypted in relation to a first auxiliary data value to provide first level ciphertext. The first level ciphertext are encrypted using a second auxiliary data value associated with a selected physical location in a memory to produce second level ciphertext, which are thereafter stored to the selected physical location. In some embodiments, migration of the stored data to a new target location comprises partial decryption and re-encryption of the data using a third auxiliary data value associated with a new target physical location to produce third level ciphertext, and the storage of the third level ciphertext to the new target physical location.

Claims

1. A method comprising:

encrypting input data in relation to a first auxiliary data value to provide first level ciphertext, the first auxiliary data value comprising a logical block address (LBA) associated with the input data;

subsequently encrypting the first level ciphertext in relation to a second auxiliary data value associated with one or more attributes of a first physical location in a non-volatile memory to provide second level ciphertext, the second auxiliary data value comprising an accumulated count value indicative of a total accumulated count of erasure operations that have taken place to erase the first physical location in the non-volatile memory;

storing the second level ciphertext in the first physical location of the non-volatile memory; and

subsequently migrating the input data from the first physical location to a second physical location in the non-volatile memory by partially decrypting the second level ciphertext to recover the first level ciphertext from the first physical location without recovering the corresponding input data in an unencrypted form, re-encrypting the recovered first level ciphertext using a third auxiliary data value associated with the second physical location to provide third level ciphertext, and storing the third level ciphertext in the second selected physical location while maintaining the second level ciphertext in the first physical location.

2. The method of claim 1, further comprising subsequent steps of erasing the first physical location to remove the second level ciphertext stored therein and incrementing the total accumulated count for the first physical location.

3. The method of claim 1, in which the second auxiliary data value further comprises a physical block address (PBA) value of the selected physical location in the non-volatile memory.

4. The method of claim 3, in which the second auxiliary data value further comprises X bits of the total accumulated count appended to Y bits of the PBA value to form a sequence of Z bits where Z=X+Y and the Z bits are repeated to provide the second auxiliary data value with a total of 2Z bits.

5. The method of claim 1, in which the non-volatile memory comprises a flash memory array of flash memory cells.

6. The method of claim 1, in which the non-volatile memory comprises a selected one of a disc memory, an array of spin-torque transfer random access memory (STRAM) cells, or an array of resistive random access memory (RRAM) cells.

7. The method of claim 1, wherein the non-volatile memory is a flash memory arranged into a plurality of erasure blocks, the first physical memory location is disposed within a selected erasure block, and the total accumulated count indicates the total number of erasure operations that have been previously applied to the selected erasure block.

8. A data storage device, comprising a memory module comprising a non-volatile solid-state memory, and a controller circuit configured to store input data received from a host in a first physical address of the memory by applying multi-level encryption to the input data in relation to a first auxiliary data value associated with a first physical address in the non-volatile memory to generate a first set of ciphertext and by storing the first set of ciphertext to the first physical address in the non-volatile memory, the controller circuit further configured to migrate the input user data from the first physical address to a second physical address in the non-volatile memory by decrypting the first set of ciphertext using the first auxiliary value to provide partially decrypted ciphertext that remains encrypted by at least one level of said multi-level encryption, by re-encrypting the partially decrypted ciphertext in relation to a different, second auxiliary data value associated with the second physical address in the non-volatile memory to generate a second set of ciphertext, and by writing the second set of ciphertext to the second physical address in the non-volatile memory while the first set of ciphertext remains stored in the first physical address in the non-volatile memory, the first auxiliary data value comprising an accumulated count of erasure operations that have taken place to erase the first physical address in the non-volatile memory and a physical block address (PBA) value associated with the first physical address in the non-volatile memory.

9. The data storage device of claim 8, in which the controller circuit applies a first level of encryption using a logical block address (LBA) value associated with the input data, and applies a second level of encryption using the accumulated count of erasure operations and the PBA value associated with the first physical address in the non-volatile memory.

10. The data storage device of claim 8, in which memory is a flash memory, the first physical address in the non-volatile memory is disposed within a first erasure block of the flash memory, the accumulated count is the total number of times the first erasure block has been erased, and the second physical address in the non-volatile memory is disposed within a different, second erasure block of the flash memory.

11. The data storage device of claim 8, the controller circuit migrating the data to the second physical location responsive to a garbage collection operation in which the first physical address in the non-volatile memory is prepared for an erasure operation.

12. The data storage device of claim 8, in which the memory is a flash memory.

13. The data storage device of claim 8, in which the memory is a spin torque transfer random access memory (STRAM).

14. The data storage device of claim 8, in which the memory is a resistive random access memory (RRAM).

15. The data storage device of claim 8, in which the second auxiliary data value comprises an accumulated count of erasure operations that have taken place to erase the second physical location in the non-volatile memory.

16. A method comprising:

encrypting input data in relation to a first auxiliary data value to provide first level ciphertext;

subsequently encrypting the first level ciphertext in relation to a second auxiliary data value associated with one or more attributes of a first physical location in a non-volatile memory to provide second level ciphertext, the second auxiliary data value comprising an accumulated count value indicative of a total number of erasure operations that have taken place to erase the first physical location in the non-volatile memory and a physical block address (PBA) value of the selected physical location in the non-volatile memory;

storing the second level ciphertext in the first physical location of the non-volatile memory; and

subsequently migrating the input data from the first physical location to a second physical location in the non-volatile memory by partially decrypting the second level ciphertext to recover the first level ciphertext from the first physical location without recovering the corresponding input data in an unencrypted form, re-encrypting the recovered first level ciphertext using a third auxiliary data value associated with the second physical location to provide third level ciphertext, and storing the third level ciphertext in the second selected physical location while maintaining the second level ciphertext in the first physical location.

17. The method of claim 16, wherein the first auxiliary data value comprises a logical block address (LBA) associated with the input data.

18. The method of claim 16, further comprising erasing the first physical location to remove the second level ciphertext stored therein and incrementing the accumulated write count value for the first physical location.

19. The method of claim 16, in which the second auxiliary data value further comprises X bits of the accumulated count value appended to Y bits of the PBA value to form a sequence of Z bits where Z=X+Y and the Z bits are repeated to provide the second auxiliary data value with a total of 2Z bits.

20. The method of claim 16, wherein the memory is a flash memory and wherein the encrypting, subsequently encrypting, storing and subsequently migrating steps are carried out by a programmable processor having associated programming in a local memory.