Secure pipeline manager
View Patent ↗A method for data storage includes supplying data to and from a host to a storage memory via a secure data path. A first CPU is employed to control operation of the storage memory, and a second CPU is employed to control operation of the secure data path.
1. A method and a device for data storage comprising:
performing in a data storage device that includes:
a storage memory,
a storage memory manager,
a host interface,
a secure data path between said host interface and said storage memory, said secure data path including two or more cryptographic processors (crypto-processors) arranged in series along the secure data path,
a main Central Processing Unit (CPU) configured to manage operations of the data storage device and to direct the storage memory manager to transfer data to and from the storage memory via the secure data path, and
a control CPU that is configured to consume less power than the main CPU, wherein the control CPU does not perform the operations of the main CPU and wherein the Control CPU is configured to control the two or more cryptographic processor;
transferring data to and from a host to said host interface by:
transferring data to and from the storage memory, under control of the main CPU via said storage memory manager, wherein the transferring is performed via the secure data path;
performing encryption operations under control of the control CPU, using the two or more cryptographic engines in series, wherein said control CPU has access to secret keys required to control operation of said secure data path and said main CPU does not have access to said secret keys; and
placing the main CPU in an idle mode such that the main CPU does not consume an appreciable amount of power for at least a period of time while encryption operations are performed under control of the control CPU.
2. The method for data storage according to claim 1 , wherein said secure data path includes software with one or more algorithms, including: AES (Advanced Encryption Standard), DES (Data Encryption Standard), 3DES (Triple DES), SHA1 (Secure Hash Algorithm 1), SHA256 (Secure Hash Algorithm 256), SHA384 (Secure Hash Algorithm 384), SHA512 (Secure Hash Algorithm 512) and RC4 (Rivest Cipher 4).
3. The method for data storage according to claim 1 , wherein the performing encryption operations using the two or more cryptographic engines in series comprises storing data in a Random Access Memory (RAM) and retrieving data from the RAM.
4. A device for data storage comprising:
a storage memory,
a storage memory manager,
a host interface,
a secure data path between said host interface and said storage memory;
two or more cryptographic processors (crypto-processors) arranged in series along the secure data path,
a main Central Processing Unit (CPU) configured to manage operations of the device and to direct the storage memory manager to transfer data to and from the storage memory via the secure data path, and
a control CPU that is configured to consume less power than the main CPU, wherein the control CPU does not perform the operations of the main CPU and wherein the Control CPU is configured to perform encryption operation on the data transferred via the secure data path using the two or more crypto-processors in series, wherein said control CPU has access to secret keys required to control operation of said secure data path and said main CPU does not have access to said secret keys;
wherein the main CPU is configured to operate in an idle mode such that the main CPU does not consume an appreciable amount of power for at least a period of time while the control CPU performs encryption operations.
5. The device for data storage according to claim 4 , further comprising:
a Random Access Memory (RAM) operative to store data output from a first crypto-processor and operative to provide input to a second crypto-processor.