Disk drive with flexible data stream encryption

In a data processing system including a storage device having a cipher engine, a cipher state memory and a storage media, a method for ciphering data, comprising:

• receiving a physical data stream that includes multiple logical data streams;
• maintaining cipher information of the logical data streams in the cipher state memory, wherein the cipher information for each logical data stream contains corresponding state information of the cipher engine based on previously cipher processing the logical data stream, thereby enabling resumption of cipher processing the logical data stream;
• and
• interleaving cipher processing the logical data streams with the cipher engine using the corresponding cipher information in the cipher state memory, wherein the cipher processing interleaving includes (i) interrupting cipher processing a first logical data stream, (ii) storing the cipher information of the first logical data stream in the cipher state memory, (iii) retrieving the cipher information of a second logical data stream from the cipher state memory, and (iv) cipher processing the second logical data stream using the cipher information of the second logical data stream, wherein the cipher processing interleaving occurs during a latency period in which the storage device cannot read the logical data streams from or write the logical data streams to the storage media.

An apparatus for cipher processing multiple logical data streams of a physical data stream in a storage device having a storage media, comprising:

• a cipher state memory for storing cipher information corresponding to each logical data stream;
• a cipher engine for cipher processing each logical data stream using the corresponding cipher information in the cipher state memory, wherein the cipher information for each logical data stream contains corresponding state information of the cipher engine based on previously cipher processing the logical data stream, thereby enabling resumption of cipher processing the logical data stream;
• and
• a controller that (i) manages physical data stream transfer into and out of a buffer, (ii) controls cipher information transfer into and out the cipher state memory for each logical data stream, and (iii) controls the cipher engine to interleave cipher processing the logical data streams using the cipher information for each logical data stream, wherein the controller controls the cipher engine to interleave cipher processing the logical data streams by multitasking cipher processing each logical data stream with one or more other logical data streams by (i) retrieving the cipher information of a first logical data stream from the cipher state memory and controlling the cipher engine to cipher process the first logical data stream using the cipher information of the first logical data stream, and (ii) upon detecting a cipher switching event to switch to a second logical data stream, storing the cipher information of the first logical data stream in the cipher state memory, retrieving the cipher information of the second logical data stream from the cipher state memory, and controlling the cipher engine to cipher process the second logical data stream using the cipher information of the second logical data stream, and wherein the controller switches the cipher processing of the first logical data stream to the second logical data stream at a data block boundary on the storage media in response to the apparatus gaining access to another data block on the storage media during a latency period in which the apparatus cannot read the logical data streams from or write the logical data streams to the storage media.

In a disk drive that includes a transducer, a disk, a cipher engine, a cipher state memory, a buffer and an interface, wherein the transducer reads from and writes to the disk, a method of processing multiple logical data streams, comprising:

• receiving a physical data stream at the interface, wherein the physical data stream includes first and second logical data streams that are interleaved with one another, the first logical data stream includes first data blocks and third data blocks, the second logical data stream includes second data blocks, the first and third data blocks are adjacent to one another in the first logical data stream and are separated from one another by the second data blocks in the physical data stream;
• encrypting the first data blocks with the cipher engine, thereby generating first encrypted data blocks;
• interrupting encrypting the first logical data stream between the first and second data blocks and transferring a first cipher state from the cipher engine to the cipher state memory in response to a first interrupt, wherein the first cipher state contains corresponding state information of the cipher engine based on encrypting the first logical data stream at the first interrupt, and the first cipher state enables the cipher engine to resume encrypting the first logical data stream at the third data blocks;
• encrypting the second data blocks with the cipher engine without using the first cipher state, thereby generating second encrypted data blocks after generating the first encrypted data blocks;
• transferring the first cipher state from the cipher state memory to the cipher engine and resuming encrypting the first logical data stream at the third data blocks with the cipher engine using the first cipher state, thereby generating third encrypted data blocks after generating the second encrypted data blocks;
• and
• writing the first, second and third encrypted data blocks to the disk;
• wherein switching the cipher engine from encrypting the first data blocks to encrypting the second data blocks occurs during and in response to a latency period in which the transducer cannot write user data to the disk due to electromechanical delay in the disk drive.

In a disk drive that includes a transducer, a disk, a cipher engine, a cipher state memory, a buffer and an interface, wherein the transducer reads from and writes to the disk, a method of processing multiple logical data streams, comprising:

• reading an encrypted physical data stream from the disk, wherein the encrypted physical data stream includes first and second encrypted logical data streams that are interleaved with one another, the first encrypted logical data stream includes first encrypted data blocks and third encrypted data blocks, the second encrypted logical data stream includes second encrypted data blocks, and the first and third encrypted data blocks are adjacent to one another in the first encrypted logical data stream and are separated from one another by the second encrypted data blocks in the encrypted physical data stream;
• decrypting the first encrypted data blocks with the cipher engine, thereby generating first data blocks;
• interrupting decrypting the first encrypted logical data stream between the first and second encrypted data blocks and transferring a first cipher state from the cipher engine to the cipher state memory in response to a first interrupt, wherein the first cipher state contains corresponding state information of the cipher engine based on decrypting the first encrypted logical data stream at the first interrupt, and the first cipher state enables the cipher engine to resume decrypting the first encrypted logical data stream at the third encrypted data blocks;
• decrypting the second encrypted data blocks with the cipher engine without using the first cipher state, thereby generating second data blocks after generating the first data blocks;
• transferring the first cipher state from the cipher state memory to the cipher engine and resuming decrypting the first encrypted logical data stream at the third encrypted data blocks with the cipher engine using the first cipher state, thereby generating third data blocks after generating the second data blocks;
• and
• sending a physical data stream to the interface, wherein the physical data stream includes first and second logical data streams decrypted from the first and second encrypted logical data streams, respectively, the first logical data stream includes the first and third data blocks, the second logical data stream includes the second data blocks, and the first and third data blocks are adjacent to one another in the first logical data stream;
• switching the cipher engine from decrypting the first encrypted data blocks to decrypting the second encrypted data blocks during and in response to a latency period in which the transducer cannot read user data from the disk due to electromechanical delay in the disk drive.

In a disk drive that includes a transducer, a disk, a cipher engine, a cipher state memory, a buffer and an interface, wherein the transducer reads from and writes to the disk, a method of processing multiple logical data streams, comprising:

• receiving a physical data stream at the interface, wherein the physical data stream includes first and second logical data streams that are interleaved with one another, the first logical data stream includes first data blocks and third data blocks, the second logical data stream includes second data blocks, the first and third data blocks are adjacent to one another in the first logical data stream and are separated from one another by the second data blocks in the physical data stream;
• encrypting the first data blocks with the cipher engine, thereby generating first encrypted data blocks;
• interrupting encrypting the first logical data stream between the first and second data blocks and transferring a first encryption cipher state from the cipher engine to the cipher state memory in response to a first encryption interrupt, wherein the first encryption cipher state contains corresponding state information of the cipher engine based on encrypting the first logical data stream at the first encryption interrupt, and the first encryption cipher state enables the cipher engine to resume encrypting the first logical data stream at the third data blocks;
• encrypting the second data blocks with the cipher engine without using the first encryption cipher state, thereby generating second encrypted data blocks after generating the first encrypted data blocks;
• transferring the first encryption cipher state from the cipher state memory to the cipher engine and resuming encrypting the first logical data stream at the third data blocks with the cipher engine using the first encryption cipher state, thereby generating third encrypted data blocks after generating the second encrypted data blocks;
• writing the first, second and third encrypted data blocks to the disk;
• then
• reading an encrypted physical data stream from the disk, wherein the encrypted physical data stream includes first and second encrypted logical data streams that are interleaved with one another, the first encrypted logical data stream includes the first encrypted data blocks and the third encrypted data blocks, the second encrypted logical data stream includes the second encrypted data blocks, and the first and third encrypted data blocks are adjacent to one another in the first encrypted logical data stream and are separated from one another by the second encrypted data blocks in the encrypted physical data stream;
• decrypting the first encrypted data blocks with the cipher engine, thereby generating the first data blocks;
• interrupting decrypting the first encrypted logical data stream between the first and second encrypted data blocks and transferring a first decryption cipher state from the cipher engine to the cipher state memory in response to a first decryption interrupt, wherein the first decryption cipher state contains corresponding state information of the cipher engine based on decrypting the first encrypted logical data stream at the first decryption interrupt, and the first decryption cipher state enables the cipher engine to resume decrypting the first encrypted logical data stream at the third encrypted data blocks;
• decrypting the second encrypted data blocks with the cipher engine without using the first decryption cipher state, thereby generating the second data blocks after generating the first data blocks;
• transferring the first decryption cipher state from the cipher state memory to the cipher engine and resuming decrypting the first encrypted logical data stream at the third encrypted data blocks with the cipher engine using the first decryption cipher state, thereby generating the third data blocks after generating the second data blocks;
• sending another physical data stream to the interface, wherein the other physical data stream includes the first and second logical data streams decrypted from the first and second encrypted logical data streams, respectively, the first logical data stream includes the first and third data blocks, the second logical data stream includes the second data blocks, and the first and third data blocks are adjacent to one another in the first logical data stream;
• switching the cipher engine from encrypting the first data blocks to encrypting the second data blocks and from encrypting the second data blocks to encrypting the third data blocks during and in response to latency periods in which the transducer cannot write user data to the disk due to electromechanical delay in the disk drive;
• and
• switching the cipher engine from decrypting the first encrypted data blocks to decrypting the second encrypted data blocks and from decrypting the second encrypted data blocks to decrypting the third encrypted data blocks during and in response to latency periods in which the transducer cannot read user data from the disk due to electromechanical delay in the disk drive.