Effective key management for data encryption and decryption
The present disclosure generally relates to effective key management by properly matching keys used for encryption to data that needs to be decrypted after receiving instructions to change or delete keys. By matching the actual key, rather than just a key index, to a command, each command will use the correct key throughout the entire life-span of the command, even if the key is switched or deleted prior to servicing the command. To implement the key management, a snapshot of the doorbell database is taken. All pending commands that are in the snapshot are then fetched prior to updating a key database with either the change or deletion of the key. After fetching of all pending commands from the snapshot and ensuring the keys are stored in a command context, the key database is updated.
1. A data storage device, comprising:
a memory device; and
a controller coupled to the memory device, wherein the controller is configured to:
receive a key for encryption/decryption from a secured command context of the controller, wherein the secured command context is distinct from a key storage of the controller;
receive an indication from a host device to change the key stored in the key storage;
copy a doorbell database for updating, wherein the doorbell database comprises mappings of commands queued by the host device, and wherein a doorbell indicates to the controller that new commands are queued by the host device;
take a snapshot of the doorbell database;
fetch all commands listed in the snapshot of the doorbell database prior to updating a key database, wherein the key database stores key indexes, and wherein each key index points to a respective key stored in the key storage;
ensure copies of keys from the key storage are stored in the secured command context;
change the key in the key storage in response to the ensuring;
decrypt or encrypt data stored in the memory device using the key stored in the secured command context prior to updating the key database; and
deliver the encrypted/decrypted data to the host device.
2. The data storage device of claim 1 , wherein the controller is further configured to:
receive a notification that the host device has placed a command in a command queue;
update the doorbell database; and
fetch the command from the command queue.
3. The data storage device of claim 2 , wherein the controller is further configured to:
extract a key index corresponding to the key from the key database;
copy the key pointed to by the key index to the secured command context; and
read data corresponding to the command from the memory device.
4. The data storage device of claim 1 , wherein the controller is further configured to copy the key, stored in the key storage prior to changing the key, pointed to by the key index of the key database to the secured command context.
5. The data storage device of claim 4 , wherein the controller is further configured to update the doorbell database snapshot.
6. The data storage device of claim 1 , wherein the controller is further configured to update the doorbell database, wherein the doorbell database comprises mappings of commands queued by the host device.
7. A data storage device, comprising:
a memory device; and
a controller coupled to the memory device, wherein the controller comprises a control path portion, a data path portion, and an admin key management portion, wherein the controller is configured to perform the following in the admin key management portion:
receive a request to change a key in a key storage;
fetch all commands for which a doorbell has been rung, wherein the doorbell comprises a doorbell database comprising a mapping of commands queued by a host device, wherein fetching further comprises copying keys corresponding to all the commands for which the doorbell has been rung to the control path portion prior to changing the keys in the key storage, and wherein the doorbell indicates to the controller that new commands are queued by the host device;
update a key database storing key indexes corresponding to keys stored in the key storage after fetching all commands for which the doorbell has been rung; and
utilize the keys stored in the control path portion to decrypt or encrypt data associated with all the commands fetched for which the doorbell has been rung.
8. The data storage device of claim 7 , wherein the controller is further configured to perform the following in the admin key management portion: deliver the updated key database to the control path portion.
9. The data storage device of claim 8 , wherein the controller is further configured to perform the following in the admin key management portion: take a snapshot of the doorbell database.
10. The data storage device of claim 9 , wherein the controller is further configured to perform the following in the control path portion: copy the key pointed to by a key index to a secured command context.
11. The data storage device of claim 10 , wherein the controller is further configured to update the doorbell database snapshot in the admin key management portion based upon copying the key pointed to by the key index to the secured command context.
12. The data storage device of claim 11 , wherein the controller is further configured to update the doorbell database in the control path portion based upon the updated doorbell snapshot from the admin key management portion.
13. The data storage device of claim 7 , wherein the controller is further configured to perform the following in the data path portion: decrypt data, or encrypt data.
14. A data storage device, comprising:
a memory device;
a controller coupled to the memory device;
means to receive a key change request from a host device;
means to fetch all commands for which a doorbell has been rung prior to changing a key as instructed by the host device, wherein the doorbell indicates to the controller that new commands are queued by the host device, and wherein the means to fetch all commands further comprises means to copy keys corresponding to all the commands for which the doorbell has been rung to a secured command context prior to changing the keys in a key storage;
means to copy a doorbell database for updating, wherein the doorbell database comprises mappings of commands queued by the host device;
means to change the key in the key storage; and
means to utilize the keys stored in the secured command context to decrypt or encrypt data associated with all the commands fetched for which the doorbell has been rung prior to changing the key as instructed by the host device.
15. The data storage device of claim 14 , further comprising means to take a snapshot of the doorbell database.
16. The data storage device of claim 15 , further comprising means to update the doorbell database snapshot.
17. The data storage device of claim 16 , further comprising means to update the doorbell database based upon the means to update the doorbell database snapshot.
18. The data storage device of claim 14 , further comprising means to store a key in a control path portion of the controller, wherein the means to store the key in the control path portion of the controller is distinct from a key storage location within the data storage device.