System and method for providing data integrity
View Patent ↗Systems and methods for providing data integrity for stored data are disclosed. A method may include, in connection with the receipt of a read command at a storage resource, reading a data block from the storage resource, the data block including a data field, a data integrity field indicating the integrity the data field, and an encryption indicator field indicating whether the data block is encrypted with a current cryptographic key for the storage resource. The method may further include determining whether the data field is encrypted with the current cryptographic key based at least on the encryption indicator field. The method may additionally include returning at least a portion of the data block in reply to the read command in response to determining that the data field is encrypted with a cryptographic key other than the current cryptographic key.
1. A method comprising:
receiving a read command at a storage resource, wherein the read command is received in connection with an initialization of a storage array;
reading a data block from the storage resource, the data block comprising:
a data field,
a data integrity field, indicating the integrity of the data field, and
a key counter value field indicating a cryptographic key used to encrypt the data field;
comparing the key counter value field to a key counter register associated with the storage resource, wherein the key counter register is modified each time a cryptographic key of the storage resource is modified, the modified cryptographic key is to be used to encrypt the data field when the data block is to be written to the storage resource;
returning at least a portion of the data field if the key counter value field does not equal the key counter register;
determining whether the data field is corrupted based on the data integrity field, if the key counter value field equals the key counter register; and
returning an error indication if the data field is corrupted.
2. The method of claim 1 , further comprising returning at least a portion of the data field in reply to the read command if the data field is not corrupted.
3. The method of claim 1 , further comprising returning an indication that the data field was encrypted with a previous cryptographic key if the key counter value does not equal the key counter register.
4. The method of claim 1 , wherein the storage resource comprises a full-disk encryption storage resource.
5. The method of claim 1 , further comprising returning an indication that the read command has completed.
6. A storage resource comprising:
a cryptographic key;
a key counter register; and
a non-transitory computer-readable storage medium;
the storage resource configured to:
receive a read command at a storage resource, wherein the read command is received in connection with an initialization of a storage array;
read a data block from the storage medium, the data block comprising:
a data field,
a data integrity field, indicating the integrity of the data field, and
a key counter value field indicating a cryptographic key used to encrypt the data field;
compare the key counter value field to the key counter register, wherein the key counter register is modified each time the cryptographic key is modified, the modified cryptographic key is to be used to encrypt the data field when the data block is to be written to the storage resource;
return at least a portion of the data field if the key counter value field does not equal the key counter register;
determine whether the data field is corrupted based on the data integrity field, if the key counter value field equals the key counter register; and
return an error indication if the data field is corrupted.
7. The storage resource of claim 6 , further configured to return at least a portion of the data field in reply to the read command if the data field is not corrupted.
8. The storage resource of claim 6 , further configured to return an indication that the data field was encrypted with a previous cryptographic key if the key counter value does not equal the key counter register.
9. The storage resource of claim 6 , wherein the storage resource comprises a full-disk encryption storage resource.
10. The storage resource of claim 6 , further configured to return an indication that the read command has completed.