US 11,934,322 B1
Multiple encryption keys on storage drives
Ethan L. Miller, Santa Cruz, CA (US); Andrew R. Bernat, Mountain View, CA (US); Ronald Karr, Palo Alto, CA (US); Christopher Golden, Emerald Hills, CA (US); Nicholas George Psaki, Falls Church, VA (US); and David Whitlock, New Orleans, LA (US)
Assigned to PURE STORAGE, INC., Santa Clara, CA (US)
Filed by PURE STORAGE, INC., Mountain View, CA (US)
Filed on Jan. 16, 2019, as Appl. No. 16/249,745.
Claims priority of provisional application 62/653,484, filed on Apr. 5, 2018.
Int. Cl. G06F 12/14 (2006.01); G06F 3/06 (2006.01); G06F 9/54 (2006.01); G06F 21/60 (2013.01)
CPC G06F 12/1408 (2013.01) [G06F 3/061 (2013.01); G06F 3/0659 (2013.01); G06F 3/067 (2013.01); G06F 9/546 (2013.01); G06F 12/1466 (2013.01); G06F 21/602 (2013.01); G06F 2209/548 (2013.01); G06F 2212/1052 (2013.01); G06F 2212/401 (2013.01); G06F 2212/402 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A system comprising:
a storage system comprising one or more storage devices; and
a storage controller operatively coupled to the storage system, the storage controller comprising a processing device, the processing device to:
receive first raw data from a first tenant of the storage system to a first input/output (I/O) queue of a plurality of I/O queues in the storage system, wherein the plurality of I/O queues comprise Non-Volatile Memory Express (NVME) I/O queues;
determine that the first I/O queue corresponds to a first key of a plurality of keys, wherein the first key corresponds to the first tenant, wherein each of the plurality of keys corresponds to a respective I/O queue and a respective tenant, and wherein each of the plurality of keys is used to encrypt data in the respective I/O queue received from the respective tenant;
encrypt the first raw data using the first key to generate first encrypted data;
store the first encrypted data on the storage system, the first encrypted data stored in a same volume as other encrypted data associated with other tenants and other keys;
receive a request, from the first tenant, to read the first encrypted data from the storage system via the first I/O queue;
determine that the first I/O queue corresponds to the first key, wherein the first key corresponds to the first tenant; and
provide first decrypted data to the first tenant via the first I/O queue, wherein the first decrypted data is decrypted using the first key.