System and method for storing and reading encrypted data
An information handling system includes a general storage for storing application data of applications hosted by the information handling system. The information handling system also includes a management storage for storing management data used to manage operation of the information handling system. The information handling system further includes a management storage manager that obtains data for storage in the management storage; encrypts the data to obtain encrypted data and authentication data for the encrypted data; generates error correction code data for the encrypted data and the authentication data; and stores, as a new record, the encrypted data, the authentication data, and the error correction code data in the management storage.
1. An information handling system, comprising:
general storage for storing application data of applications hosted by the information handling system;
management storage for storing management data used to manage operation of the information handling system; and
a management storage manager programmed to:
obtain data for storage in the management storage;
encrypt the data to obtain encrypted data and authentication data for the encrypted data, wherein encrypting the data comprises:
obtaining a portion of second authentication data of a parent record to the new record; and
generating the encrypted data and the authentication data using the portion of the second authentication data to obtain an initialization vector for an encryption algorithm that provides the encrypted data;
generate error correction code data for the encrypted data and the authentication data; and
store, as a new record, the encrypted data, the authentication data, and the error correction code data in the management storage as part of the management data.
2. The information handling system of claim 1 , wherein the management storage manager is further programmed to:
obtain a read request for the new record;
decrypt the encrypted data to obtain decrypted data;
make a determination, using the authentication data, that the decrypted data does not match the data; and
in response to the determination:
obtain corrected encrypted data using the error correction code data;
obtain corrected authentication data using the error correction code data;
decrypt the corrected encrypted data to obtain second decrypted data;
make a second determination, using the corrected authentication data, that the second decrypted data matches the data; and
service the read request using the second decrypted data based on the second determination.
3. The information handling system of claim 2 , wherein the management storage manager is further programmed to:
in response to the second determination:
store a copy of the corrected authentication data and a copy of the corrected encrypted data in memory.
4. The information handling system of claim 3 , wherein the management storage manager is further programmed to:
after storing the corrected authentication data and the corrected encrypted data in memory:
obtain a second read request for the new record;
in response to receiving the second read request:
read the copy of the corrected authentication data and the copy of the corrected encrypted data in memory;
decrypt the copy of the corrected encrypted data to obtain third decrypted data; and
service the second read request using the third decrypted data,
wherein the new record is not modified between when the determination is made and the second read request is serviced.
5. The information handling system of claim 4 , wherein the management storage manager is further programmed to:
after servicing the second read request:
update the new record using the copy of the corrected encrypted data and the copy of the corrected authentication data.
6. The information handling system of claim 1 , wherein the data used to manage the operation of the information handling system is used to boot the information handling system.
7. A method for managing a management storage of an information handling system, comprising:
obtaining data for storage in the management storage;
encrypting the data to obtain encrypted data and authentication data for the encrypted data, wherein the authentication data comprises a bit sequence usable to determine whether at least one bit of the encrypted data has been changed after being generated, wherein encrypting the data comprises:
obtaining a portion of second authentication data of a parent record to the new record; and
generating the encrypted data and the authentication data using the portion of the second authentication data to obtain an initialization vector for an encryption algorithm that provides the encrypted data;
generating error correction code data for the encrypted data and the authentication data, wherein the error correction code data comprises a second bit sequence usable for correcting at least one second bit of the encrypted data and authentication data that has been changed after being generated; and
storing, as a new record, the encrypted data, the authentication data, and the error correction code data in the management storage as part of management data used to manage operation of the information handling system.
8. The method of claim 7 , further comprising:
obtaining a read request for the new record;
decrypting the encrypted data to obtain decrypted data;
making a determination, using the authentication data, that the decrypted data does not match the data; and
in response to the determination:
obtaining corrected encrypted data using the error correction code data;
obtaining corrected authentication data using the error correction code data;
decrypting the corrected encrypted data to obtain second decrypted data;
making a second determination, using the corrected authentication data, that the second decrypted data matches the data; and
servicing the read request using the second decrypted data based on the second determination.
9. The method of claim 8 , further comprising:
in response to the second determination:
storing a copy of the corrected authentication data and a copy of the corrected encrypted data in memory.
10. The method of claim 9 , further comprising:
after storing the corrected authentication data and the corrected encrypted data in memory:
obtaining a second read request for the new record;
in response to obtaining the second read request:
reading the copy of the corrected authentication data and the copy of the corrected encrypted data in memory;
decrypting the copy of the corrected encrypted data to obtain third decrypted data; and
servicing the second read request using the third decrypted data,
wherein the new record is not modified between when the determination is made and the second read request is serviced.
11. The method of claim 10 , further comprising:
after servicing the second read request:
updating the new record using the copy of the corrected encrypted data and the copy of the corrected authentication data.
12. The method of claim 7 , wherein the new record is used to boot the information handling system.
13. A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for managing a management storage of an information handling system, the method comprising:
obtaining data for storage in the management storage;
encrypting the data to obtain encrypted data and authentication data for the encrypted data, wherein the authentication data comprises a bit sequence usable to determine whether at least one bit of the encrypted data has been changed after being generated, wherein encrypting the data comprises:
obtaining a portion of second authentication data of a parent record to the new record; and
generating the encrypted data and the authentication data using the portion of the second authentication data to obtain an initialization vector for an encryption algorithm that provides the encrypted data;
generating error correction code data for the encrypted data and the authentication data, wherein the error correction code data comprises a second bit sequence usable for correcting at least one second bit of the encrypted data and authentication data that has been changed after being generated; and
storing, as a new record, the encrypted data, the authentication data, and the error correction code data in the management storage as part of management data used to manage operation of the information handling system.
14. The non-transitory computer readable medium of claim 13 , wherein the method further comprises:
obtaining a read request for the new record;
decrypting the encrypted data to obtain decrypted data;
making a determination, using the authentication data, that the decrypted data does not match the data; and
in response to the determination:
obtaining corrected encrypted data using the error correction code data;
obtaining corrected authentication data using the error correction code data;
decrypting the corrected encrypted data to obtain second decrypted data;
making a second determination, using the corrected authentication data, that the second decrypted data matches the data; and
servicing the read request using the second decrypted data based on the second determination.
15. The non-transitory computer readable medium of claim 14 , wherein the method further comprises:
in response to the second determination:
storing a copy of the corrected authentication data and a copy of the corrected encrypted data in memory.
16. The non-transitory computer readable medium of claim 15 , wherein the method further comprises:
after storing the corrected authentication data and the corrected encrypted data in memory:
obtaining a second read request for the new record;
in response to receiving the second read request:
reading the copy of the corrected authentication data and the copy of the corrected encrypted data in memory;
decrypting the copy of the corrected encrypted data to obtain third decrypted data; and
servicing the second read request using the third decrypted data,
wherein the new record is not modified between when the determination is made and the second read request is serviced.
17. The non-transitory computer readable medium of claim 16 , wherein the method further comprises:
after servicing the second read request:
updating the new record using the copy of the corrected encrypted data and the copy of the corrected authentication data.