Data-at-rest (DAR) encryption for integrated storage media

A method for providing transparent, in-line encryption of data-at-rest (DAR) stored by a host controller of a host device, the method comprising:

• instantiating an encryption core comprising:
• a storage device proxy;
• an encryption engine;
• a plurality of host device proxies, each host device proxy among the plurality of host device proxies interfacing the host controller to one persistent storage device among a plurality of persistent storage devices via the storage device proxy, the storage device proxy providing an abstract reference to an aggregated memory space provided by the plurality of persistent storage devices to the host controller as a single persistent storage device;
• and
• a security interface, for controlling, via the storage device proxy, exposure of the aggregated device memory space to the host controller, and for controlling host controller access to the aggregated device memory space;
• receiving a write command to initiate a write operation from the host controller at the storage device proxy;
• determining an encryption state of the encryption engine;
• and
• processing the write command based on the encryption state determined by the security interface;
• wherein the plurality of persistent storage devices include an encrypted storage device providing memory to the host device for storing encrypted DAR and a recovery storage device providing memory storing unencrypted recovery data usable to repair system resources of the host device.

A system for providing transparent, in-line encryption of data-at-rest (DAR) stored by a host controller of a host device, the system comprising:

• an encryption device, disposed between the host controller and a plurality of persistent storage devices, the encryption device comprising:
• a processor;
• and
• a computing device that comprises a first set of instructions to be performed that when executed by the processor causes the system to at least:
• instantiate an encryption core comprising:
• a storage device proxy;
• an encryption engine having access to at least one encryption key;
• a plurality of host device proxies, each host device proxy among the plurality of host device proxies interfacing the host controller to one persistent storage device among the plurality of persistent storage devices via the storage device proxy, the storage device proxy providing an abstract reference to an aggregated memory space provided by the plurality of persistent storage devices to the host controller as a single persistent storage device;
• and
• a security interface, for controlling, via the storage device proxy, exposure of the aggregated device memory space to the host controller, and for controlling host controller access to the aggregated device memory space;
• receive a read command to initiate a read operation from the host controller at the storage device proxy,
• determine an encryption state of the encryption engine;
• and process the read command is based on the encryption state determined by the security interface;
• wherein the plurality of persistent storage devices include an encrypted storage device providing memory to the host device for storing encrypted DAR and a recovery storage device providing memory storing unencrypted recovery data usable to repair system resources of the host device.