Effective key management for data encryption and decryption

A data storage device, comprising:

• a memory device;
• and
• a controller coupled to the memory device, wherein the controller comprises a control path portion, a data path portion, and an admin key management portion, wherein the controller is configured to perform the following in the admin key management portion:
• receive a request to change a key in a key storage;
• fetch all commands for which a doorbell has been rung, wherein the doorbell comprises a doorbell database comprising a mapping of commands queued by a host device, wherein fetching further comprises copying keys corresponding to all the commands for which the doorbell has been rung to the control path portion prior to changing the keys in the key storage, and wherein the doorbell indicates to the controller that new commands are queued by the host device;
• update a key database storing key indexes corresponding to keys stored in the key storage after fetching all commands for which the doorbell has been rung;
• and
• utilize the keys stored in the control path portion to decrypt or encrypt data associated with all the commands fetched for which the doorbell has been rung.

A data storage device, comprising:

• a memory device;
• a controller coupled to the memory device;
• means to receive a key change request from a host device;
• means to fetch all commands for which a doorbell has been rung prior to changing a key as instructed by the host device, wherein the doorbell indicates to the controller that new commands are queued by the host device, and wherein the means to fetch all commands further comprises means to copy keys corresponding to all the commands for which the doorbell has been rung to a secured command context prior to changing the keys in a key storage;
• means to copy a doorbell database for updating, wherein the doorbell database comprises mappings of commands queued by the host device;
• means to change the key in the key storage;
• and
• means to utilize the keys stored in the secured command context to decrypt or encrypt data associated with all the commands fetched for which the doorbell has been rung prior to changing the key as instructed by the host device.