# US 8,751,831 B1 · Achieving strong cryptographic correlation between higher level semantic units and lower level components in a secure data storage system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,831 B1 - Document ID: US8751831B1 - Status: Granted - Kind: B1 - Application number: 13/451,878 - Filed: 2012-04-20 - Granted: 2014-06-10 - Earliest claimed: 2006-06-27 - Assignees: EMC Corporation - Applicants: Roger F Osmond; Gil Goren - Inventors: Roger F Osmond; Gil Goren - Web page: https://patentgrep.com/patent/US8751831B1 ## CPC - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A data storage architecture for networked access by clients includes a file server capable of communication with the clients via the network, physical storage organized as a plurality of logical volumes, and an encryption device in communication with both the file server and the physical storage. The encryption device is operable in response to signaling from the file server, including an indication of a range of blocks of data, to cause encryption of the range of blocks with an encryption key that is unique within the physical storage. The encryption device includes nested tables mapping block ranges to encryption keys. Consequently, undesirable key sharing across files, file systems, and other units can be avoided down to the block level. ## Claims ### Claim 1 Data storage apparatus available to at least one client via a network, comprising: a file server capable of communication with the client via the network; physical storage; an encryption device in communication with both the file server and the physical storage; wherein the encryption device is operable in response to signaling from the file server, including an indication of a range of blocks of data, to cause encryption of the range of blocks with an encryption key that is unique within the physical storage; wherein the file server includes at least one nested table indicative of a mapping of component ID to block range; wherein the file server is operative to signal a block map indicative of a range of blocks corresponding to a component ID to the encryption device via an out-of-band control channel. ### Claim 2 (depends on 1) The apparatus of claim 1 wherein the encryption device is embedded with the physical storage. ### Claim 3 (depends on 1) The apparatus of claim 1 wherein the range of blocks defines a portion of a file. ### Claim 4 (depends on 1) The apparatus of claim 1 wherein the range of blocks defines a single file. ### Claim 5 (depends on 1) The apparatus of claim 1 wherein the range of blocks defines a single file system. ### Claim 6 (depends on 1) The apparatus of claim 1 wherein the range of blocks defines multiple files. ### Claim 7 (depends on 1) The apparatus of claim 1 wherein the range of blocks defines multiple file systems. ### Claim 8 (depends on 1) The apparatus of claim 1 wherein the range of blocks defines logical collections of files, parts of files and or file systems representing distinct communities. ### Claim 9 (depends on 1) The apparatus of claim 1 where the file server is further operative to signal the component ID via the out of band channel. ### Claim 10 (depends on 9) The apparatus of claim 9 wherein the file server is further operative to signal a server ID via the out-of-band control channel. ### Claim 11 (depends on 9) The apparatus of claim 9 wherein the component ID is an ID of a component selected from the group consisting of file system, file, group of files, community, and partial file. ### Claim 12 (depends on 10) The apparatus of claim 10 wherein the server ID is the World Wide Name of the file server. ### Claim 13 (depends on 10) The apparatus of claim 10 wherein the encryption device includes at least one nested table indicative of a mapping of block range to encryption key. ### Claim 14 (depends on 1) The apparatus of claim 1 wherein new data is encrypted with a per-file system default key. ### Claim 15 (depends on 1) The apparatus of claim 1 wherein new data is encrypted with a per-array default key. ### Claim 16 (depends on 14) The apparatus of claim 14 wherein the new data is rekeyed with a subset key. ### Claim 17 A method for storing data in physical storage available to at least one client via a file server capable of communication with the client via a network, comprising the steps of: with an encryption device in communication with both the file server and the physical storage, in response to signaling from the file server including an indication of a range of blocks of data, causing encryption of the range of blocks with an encryption key that is unique within the physical storage; wherein the file server includes at least one nested table indicative of a mapping of component ID to block range; wherein the file server is operative to signal a block map indicative of a range of blocks corresponding to a component ID to the encryption device via an out-of-band control channel. ### Claim 18 (depends on 17) The method of claim 17 wherein the range of blocks defines a portion of a file. ### Claim 19 (depends on 17) The method of claim 17 wherein the range of blocks defines multiple files. ### Claim 20 (depends on 17) The method of claim 17 wherein the range of blocks defines multiple file systems. ### Claim 21 (depends on 17) The method of claim 17 wherein new data is encrypted with a per-array default key. ### Claim 22 A system available to at least one client via a network, comprising: a file server capable of communication with the client via the network; physical storage; an encryption device in communication with both the file server and the physical storage; wherein the encryption device is operable in response to signaling from the file server, including an indication of a range of blocks of data, to cause encryption of the range of blocks with an encryption key that is unique within the physical storage; wherein the file server includes at least one nested table indicative of a mapping of component ID to block range; wherein the file server is operative to signal a block map indicative of a range of blocks corresponding to a component ID to the encryption device via an out-of-band control channel.