Storage compute services for encrypted data
Aspects of a storage device are provided that perform partial decryption of host encrypted data and encryption of host provided data using received or generated keys for data targeted for compute services. The storage device may include a non-volatile memory and a controller. The controller may receive encrypted data, receive a key associated with a portion of the encrypted data, and decrypt the portion of the encrypted data based on the key without decrypting a remainder of the encrypted data. The controller may also receive data, receive or generate a key associated with a portion of the data, encrypt the portion of the data based on the key without encrypting a remainder of the data based on the key, and store the encrypted portion of the data in the non-volatile memory for subsequent decryption. As a result, a balance between encrypted data storage and decrypted data security may be achieved.
1. A storage device, comprising:
a controller configured to:
receive encrypted data,
receive a key associated with a portion of the encrypted data,
receive a compute request associated with the key,
decrypt the portion of the encrypted data based on the key without decrypting a remainder of the encrypted data,
process the decrypted portion of the encrypted data in response to the compute request, and
transmit a result of processing the decrypted portion of the encrypted data.
2. The storage device of claim 1 , wherein the encrypted data includes data from a plurality of sensors, and the portion of the encrypted data includes the data from one of the sensors.
3. The storage device of claim 1 , wherein the encrypted data includes a transport stream having a plurality of sub-streams, and the portion of the encrypted data includes one of the sub-streams.
4. The storage device of claim 1 , wherein the controller is further configured to receive a plurality of keys associated with respective portions of the encrypted data, and to decrypt each of the respective portions based on a corresponding one of the keys.
5. The storage device of claim 1 , wherein the controller is further configured to receive the encrypted data from a first host, and to receive the compute request and the key from a second host.
6. The storage device of claim 1 , further comprising:
a non-volatile memory;
a volatile memory;
wherein, in response to receiving the encrypted data, the controller is further configured to store the encrypted data in the volatile memory and to write the encrypted data from the volatile memory to the non-volatile memory;
wherein, in response to receiving the compute request and the key, the controller is further configured to store the key in the volatile memory, to read the encrypted data from the non-volatile memory, and after decrypting the portion of the encrypted data, to store the decrypted portion of the encrypted data in the volatile memory; and
wherein, after processing the decrypted portion of the encrypted data, the controller is further configured to refrain from storing in the non-volatile memory the decrypted portion, the key, and metadata associated with the processing.
7. The storage device of claim 1 , wherein the encrypted data comprises a plurality of portions including the portion, the key is associated with a group of the portions, and the controller is further configured to decrypt the group of the portions based on the key without decrypting the remainder of the encrypted data outside the group.
8. The storage device of claim 1 , wherein the controller is further configured to receive a plurality of keys associated with respective groups of portions of the encrypted data, and to decrypt each of the respective groups based on a corresponding one of the keys.
9. A storage device, comprising:
a non-volatile memory;
a volatile memory;
a controller configured to receive data, to receive a key associated with a portion of the data, and to encrypt the portion of the data based on the key without encrypting a remainder of the data based on the key,
wherein, in response to receiving the key, the controller is further configured to store the key in the volatile memory; and
wherein, after encrypting the portion of the data, the controller is further configured to store the encrypted portion of the data in the non-volatile memory, and to refrain from storing the key and metadata associated with the encrypting in the non-volatile memory.
10. The storage device of claim 9 , wherein the controller is further configured to decrypt the encrypted portion of the data based on the key without decrypting the remainder of the data.
11. The storage device of claim 9 , wherein the controller is further configured to receive a plurality of keys associated with respective portions of the data, and to encrypt each of the respective portions based on a corresponding one of the keys.
12. The storage device of claim 11 , wherein the controller is further configured to decrypt one of the encrypted respective portions based on the corresponding one of the keys without decrypting the remainder of the encrypted respective portions.
13. The storage device of claim 9 , wherein the controller is further configured to receive a compute request associated with the key, and to decrypt the encrypted portion of the data and to process the decrypted portion in response to the compute request.
14. A storage device, comprising:
a volatile memory
a non-volatile memory; and
a controller configured to receive data, to generate a key associated with a portion of the data, to encrypt the portion of the data based on the key without encrypting a remainder of the data based on the key,
wherein, in response to receiving the key, the controller is further configured to store the key in the volatile memory; and
wherein, after encrypting the portion of the data, the controller is further configured to store the encrypted portion of the data in the non-volatile memory, and to refrain from storing the key and metadata associated with the encrypting in the non-volatile memory.
15. The storage device of claim 14 , wherein the controller is further configured to transmit the encrypted portion of the data to a host in response to a retrieval request from the host.
16. The storage device of claim 15 , wherein the controller is further configured to transmit the key to the host in response to the retrieval request.
17. The storage device of claim 14 , wherein the controller is further configured to generate a plurality of keys associated with respective portions of the data, and to encrypt each of the respective portions based on a corresponding one of the keys.