Secure data encryption in shared storage using namespaces
AssigneeKabushiki Kaisha Toshiba
InventorDaisuke HASHIMOTO
Life of this patent
Estimating the term…
Abstract
A data storage device in a distributed computing system has physical block addresses that are each allocated to multiple namespaces. To access the data storage device, a host system issues a command to the data storage device that includes an access key and a virtual block address to be accessed. The data storage device converts the virtual block address to a physical block address of the data storage device using a mapping associated with the access key. Access to a physical data block associated with a particular namespace is granted only if an access key for that namespace is provided to the data storage device.
Claims1
A storage system comprising:
- a controller;
- and
- a nonvolatile memory that is configured by the controller with a plurality of namespaces, wherein
- the plurality of namespaces comprises first and second namespaces that are unlocked separately, the first namespace being unlocked using a first key and the second namespace being unlocked separately using a second key that is different from the first key, and
- the controller:
- (i) extracts a namespace identification code from a command issued by a host system,
- (ii) generates an encryption/decryption key as the first key for transforming data to be written in or read from the first namespace based on information contained in the command, and
- (iii) accesses the first namespace corresponding to the namespace identification code to write data in or read data from the first namespace.
Dependencies are inferred from the claim text.