Effective key management for data encryption and decryption
Modifying support security parameters without stalling data transfer rather than stalling the data transfer when support security modification requests are received is an effective key management operation for data encryption and decryption. For example, incorporating multiple security partition slots in the device controller. Each slot holds security parameters and an IO counter that holds the current number of pending commands in the device that are going to use that slot. The security partition slots are used as ping-pong buffers allowing the device to modify a second slot while freezing the values on a first slot until completing the previous queued commands that are still under execution. The slots allow support security parameter on-the-fly modifications without stalling any IO traffic. The slots feature is very important for QoS and system performance.
1 . A data storage device, comprising:
a memory device; and
a controller coupled to the memory device, wherein the controller comprises a secure zone that restricts access from the memory device, and the secure zone comprises a plurality of security partitions, and
wherein the controller is configured to:
receive a command;
determine that the command utilizes security attributes;
allocate a security partition of the plurality of security partitions for the command, wherein the security partition allocated is based on a determination whether a current security partition of the plurality of security partitions has pending commands, wherein each of the plurality of security partitions is associated with a different security partition ID, and wherein the allocating comprises:
attaching a first security partition ID associated with the current security partition to the command if the current security partition does not have any pending commands; and
attaching a different security partition ID associated with a different security partition of the plurality of security partitions to the command if the current security partition has pending commands;
increment an input-output (IO) counter corresponding to a security partition associated with the security partition ID attached to the command, wherein the IO counter represents a number of pending commands utilizing security attributes allocated to a corresponding security partition;
obtain security related attributes from the allocated security partition associated; and
execute the command, wherein the controller is further configured to decrement the IO counter corresponding to the security partition associated with the security partition ID attached to the command, wherein incrementing the IO counter is in response to allocating a command utilizing security attributes to the security partition, and wherein decrementing the IO counter is in response to completing execution of a command utilizing security attributes allocated to the security partition.
2 . The data storage device of claim 1 , wherein the controller is further configured to:
receive a completion posting request;
decrement the IO counter corresponding to the security partition associated with the security partition ID attached to the command; and
post a completion entry.
3 . The data storage device of claim 1 , wherein each security partition of the plurality of security partitions includes:
a key table;
a security access table;
a security range table; and
an IO counter.
4 . The data storage device of claim 3 , wherein the key table is different for each security partition of the plurality of security partitions.
5 . The data storage device of claim 1 , wherein the command utilizes only one security partition of the plurality of security partitions.
6 . The data storage device of claim 1 , wherein the command, after being received, comprises:
a logical block address (LBA);
parsing results; and
a security partition ID.
7 . The data storage device of claim 1 , wherein the controller is further configured to receive a security attribute change request.
8 . The data storage device of claim 7 , wherein the controller is further configured to:
stop fetching new commands;
initialize the allocated security partition;
use the allocated security partition, wherein using the allocated security partition comprises:
receiving one or more new commands after allocating the security partition for the command; and
attaching a same security partition ID to the one or more new commands as the command prior to enabling command fetching; and
enable command fetching.
9 . The data storage device of claim 8 , wherein the controller is further configured to flush a command path prior to allocating the security partition for the command.
10 . A data storage device, comprising:
a memory device; and
a controller coupled to the memory device, wherein the controller comprises a secure zone that restricts access from the memory device, and the secure zone comprises at least two security partition slots, and
wherein the controller is configured to:
receive a security attribute change request;
allocate a security partition slot of the at least two security partition slots based on a determination whether a current security partition slot has pending commands, wherein each security partition slot has different security attributes, and wherein the allocating the security partition slot comprises:
allocating the current security partition slot of the at least two security partition slots to a command if the current security partition slot does not have any pending commands; and
allocating the other security partition slot of the at least two security partition slots to the command if the current security partition slot has pending commands;
increment an input-output (IO) counter corresponding to a security partition slot allocated to the command, wherein the IO counter represents a number of pending commands utilizing security attributes allocated to a corresponding security partition slot;
initialize the allocated security partition slot; and
enable command fetching, wherein the controller is further configured to decrement the IO counter corresponding to the security partition slot allocated to the command, wherein incrementing the IO counter is in response to allocating a command utilizing security attributes to the security partition slot, and wherein decrementing the IO counter is in response to completing execution of a command utilizing security attributes allocated to the security partition slot.
11 . The data storage device of claim 10 , wherein the controller is further configured to:
stop fetching new commands upon receiving the security attribute change request; and
flush a command path prior to allocating the security partition slot.
12 . The data storage device of claim 11 , wherein the controller is further configured to continue data transfer in between stopping fetching the new commands and enabling command fetching.
13 . The data storage device of claim 10 , wherein each security partition slot has a different security partition identification (ID) and wherein the controller is further configured to attach the different security partition ID to any new commands received.
14 . The data storage device of claim 10 , wherein the controller is further configured to determine whether there are any pending IO commands pending for the allocated security partition slot, wherein the determining occurs prior to enabling command fetching.
15 . A data storage device, comprising:
memory means; and
a controller coupled to the memory means, wherein the controller comprises a secure zone that restricts access from the memory means, and the secure zone comprises:
a first security partition slot; and
a second security partition slot, and
wherein the controller is configured to:
determine whether there are commands with security attributes pending for a current security partition slot;
process at least one first command with security attributes associated with the current security partition slot if there are no pending commands with security attributes pending for the current security partition slot;
receive a security attribute change request;
process the at least one first command with security attributes associated with the second security partition slot if there are pending commands with security attributes pending for the current security partition slot; and
decrement an input-output (IO) counter associated with a security partition slot responsive to processing a command with security attributes associated with the security partition slot, wherein the IO counter represents a number of pending commands utilizing security attributes allocated to a corresponding security partition slot, wherein incrementing the IO counter is in response to allocating a command utilizing security attributes to the security partition slot, and wherein decrementing the IO counter is in response to completing execution of a command utilizing security attributes allocated to the security partition slot.
16 . The data storage device of claim 15 , wherein the controller is configured to delete a security partition slot upon executing all pending commands pending for the security partition slot.
17 . The data storage device of claim 15 , wherein the controller is configured to determine whether any new commands utilize any security attributes.