Technology for fine-grain encryption and secure key injection on self-encrypting drives

A data processing system, comprising:

• a processor;
• nonvolatile storage responsive to the processor;
• storage appliance software (SAS) in the nonvolatile storage;
• and
• a self-encrypting drive (SED) responsive to the processor, the SED comprising:
• an SED controller and a nonvolatile storage medium (NVSM) responsive to the SED controller, wherein the SED controller enables the SED to perform operations comprising:
• receiving an encrypted media encryption key (eMEK) for a client;
• decrypting the eMEK into an unencrypted media encryption key (MEK) for the client;
• receiving a write request from the client via the SAS, wherein the write request includes data to be stored and a key tag value associated with the MEK;
• using the key tag value to select the MEK for the write request;
• using the MEK for the write request to encrypt the data from the client;
• storing the encrypted data in a first physical region of the NVSM allocated to the client;
• writing encrypted data for the client to a second physical region of the NVSM, wherein the first and second physical regions are not contiguous;
• and
• utilizing the MEK for the client in conjunction with accessing the first physical region and in conjunction with accessing the second physical region;
• and
• wherein the SAS enables the processor to receive the write request from the client and, in response to the write request, (a) determine the key tag value for the client, (b) include the key tag value for the client in the write request, and (c) forward the write request to the SED.

A method for protecting data in a self-encrypting drive (SED), the method comprising:

• at an SED controller of the SED, receiving an encrypted media encryption key (eMEK) for a client;
• at the SED controller, decrypting the eMEK into an unencrypted media encryption key (MEK) for the client;
• receiving a write request from the client, wherein the write request includes data to be stored and a key tag value associated with the MEK;
• using the key tag value to select the MEK for the write request;
• using the MEK for the write request to encrypt the data from the client;
• using a nonvolatile storage medium (NVSM) responsive to the SED controller to store the encrypted data in a first physical region of the NVSM allocated to the client;
• writing encrypted data for the client to a second physical region of the NVSM, wherein the first and second physical regions are not contiguous;
• and
• utilizing the MEK for the client in conjunction with accessing the first physical region and in conjunction with accessing the second physical region.