Encryption of memory device with wear leveling

• US 8,495,386 B2
• Filed: 04/05/2011
• Issued: 07/23/2013
• Est. Priority Date: 04/05/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hunt, Simon
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US13/079,889
• Publication Number:
  US 20120260101A1
• Time in Patent Office: 840 Days
• Field of Search: 713164-167, 713/172, 713/189, 713193-194, 726 26- 30, 711100-105, 711/115, 711154-156, 711163-164, 711/170, 711/173
• US Class Current: 713/189
• CPC Class Codes: G06F 12/0246 in block erasable memory, e.g. flash memory
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2212/7201 Logical to physical mapping or translation of blocks or pages
• CPC Class Codes: G06F 2212/7211 Wear leveling

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for encryption of a memory device with wear leveling. In one aspect, a method includes accessing an address map of the memory device, the address map referencing first memory locations and second memory locations of the memory device, wherein the first memory locations store data that are to be encrypted by a full disk encryption operation on the memory device; designating the second memory locations as being encrypted without performing an encryption operation on the second memory locations; and encrypting only the data stored in the first memory locations of the memory device so that the data of the first memory locations and the second memory locations are designated as being disk encrypted.

Claims

1. A method performed by a data processing apparatus, the method comprising:

accessing, by a computer, an address map of a memory device, the address map referencing first memory locations and second memory locations of the memory device, wherein the first memory locations store data that are to be encrypted by a full disk encryption operation on the memory device;

designating, by the computer, the second memory locations as being encrypted without performing an encryption operation on the second memory locations, wherein the second memory locations comprise empty memory locations; and

encrypting, by the computer, only the data stored in memory locations of the memory device not already designated as encrypted, wherein the data of the first memory locations and the second memory locations are designated as being disk encrypted following the encrypting.

2. The method of claim 1, wherein designating the second memory locations as being encrypted comprises:

determining one or more sets of contiguous second memory locations;

for each set of contiguous second memory locations;

determining a corresponding location range, the corresponding location range specifying a beginning logical address and an ending logical address; and

designating the corresponding location range as being encrypted.

3. The method of claim 1, wherein the address map of the memory device represents logical addresses of a disk drive.

4. The method of claim 1, wherein the memory device is a solid-state memory device, and the address map maps logical addresses to physical addresses of the memory device.

5. The method of claim 4, wherein the solid-state memory device is a flash memory device.

6. The method of claim 1, wherein the data stored in memory locations of the memory device not already designated as encrypted are to be encrypted using a non-expansive encryption process.

7. The method of claim 1, further comprising:

accessing, by the computer, a logical addresses map of a memory device, after encrypting the data;

designating, by the computer, the second memory locations as being decrypted; and

decrypting, by the computer, only the data stored in the first memory locations of the memory device so that the data of the first memory locations and the second memory locations are designated as being decrypted.

8. The method of claim 1, wherein:

designating the second memory locations as being encrypted comprised designating from a pre-boot environment the second memory locations as being encrypted; and

encrypting only the data stored in the first memory locations of the memory device comprises encrypting from a host operating system environment only the data stored in the first memory locations of the memory device.

9. The method of claim 1, wherein:

accessing the address map comprises accessing a logical address map of the memory device, the logical address map referencing the first memory locations and second memory locations of the memory device by logical addresses, and wherein the first and second memory locations correspond to physical memory locations that are addressed by physical addresses that are mapped to the logical addresses in a mapping table; and

designating the second memory locations as being encrypted comprises designating the logical addresses corresponding to the second memory locations as being encrypted.

10. A system, comprising:

a data processing apparatus;

a memory device;

instructions stored in a computer readable medium, the instructions being executable to cause the data processing apparatus to perform operations comprising;

accessing an address map of the memory device, the address map referencing first memory locations and second memory locations of the memory device,

wherein the first memory locations store data that are to be encrypted by a full disk encryption operation on the memory device;

designating the second memory locations as being encrypted without performing an encryption operation on the second memory locations, wherein the second memory locations comprise empty memory locations; and

encrypting only the data stored in memory locations of the memory device not already designated as encrypted, wherein the data of the first memory locations and the second memory locations are designated as being disk encrypted following the encrypting.

11. The system of claim 10, wherein designating the second memory locations as being encrypted comprises:

determining one or more sets of contiguous second memory locations;

for each set of contiguous second memory locations;

determining a corresponding location range, the corresponding location range specifying a beginning logical address and an ending logical address; and

designating the corresponding location range as being encrypted.

12. The system of claim 10, wherein the address map of the memory device represents logical addresses of a disk drive.

13. The system of claim 10, wherein the memory device is a solid-state memory device, and the address map maps logical addresses to physical addresses of the memory device.

14. The system of claim 13, wherein the solid-state memory device is a flash memory device.

15. The system of claim 10, wherein the data stored in memory locations of the memory device not already designated as encrypted are to be encrypted using a non-expansive encryption process.

16. The system of claim 10, wherein the instructions further comprise the data processing apparatus to perform operations comprising:

accessing a logical addresses map of a memory device, after encrypting the data;

designating the second memory locations as being decrypted; and

decrypting only the data stored in the first memory locations of the memory device so that the data of the first memory locations and the second memory locations are designated as being decrypted.

17. The system of claim 10, wherein:

designating the second memory locations as being encrypted comprised designating from a pre-boot environment the second memory locations as being encrypted; and

encrypting only the data stored in the first memory locations of the memory device comprises encrypting from a host operating system environment only the data stored in the first memory locations of the memory device.

18. The system of claim 10, wherein:

accessing the address map comprises accessing a logical address map of the memory device, the logical address map referencing the first memory locations and second memory locations of the memory device by logical addresses, and wherein the first and second memory locations correspond to physical memory locations that are addressed by physical addresses that are mapped to the logical addresses in a mapping table; and

designating the second memory locations as being encrypted comprises designating the logical addresses corresponding to the second memory locations as being encrypted.

19. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

access an address map of a memory device, the address map referencing first memory locations and second memory locations of the memory device;

determine that data at the second memory locations is to be left unencrypted by a full disk encryption operation on the memory device, wherein the full disk encryption operation is to encrypt data stored at the first memory locations and the second memory location comprise empty memory locations;

designate the second memory locations as being encrypted; and

encrypt only the data stored in memory locations of the memory device not already designated as encrypted, wherein the encrypting encrypts data of the first memory locations and data of the first memory locations and the second memory locations are designated as being disk encrypted following the encrypting.

20. The storage medium of claim 19, wherein determining that data at the second memory locations is to be left unencrypted by a full disk encryption operation on the memory device includes identifying the second memory locations as empty memory locations.