Systems and methods for low-latency encrypted storage

摘要

Encrypted storage often introduces unwanted latency in access. This delay can result in a processor having to wait for critical data thus slowing performance. Generally speaking, the latency is at most an issue when reading from encrypted storage, since the processor may need the information read from encrypted storage to proceed. During a write operation, there typically is not an issue because the processor does not need to wait for the end of the write operation to proceed. A variant of counter (CTR) mode for a block cipher can be used to perform the majority of the decryption operation without knowledge of the ciphertext, therefore the majority of the decryption operation can be performed concurrently with the retrieval of the ciphertext from memory. In order to further secure the encrypted storage, a light encryption can be performed to further obfuscate the ciphertext.

主权项

1. A encrypted storage device comprising:
a memory; an encryption module; and an XOR module coupled to the memory and the encryption module; wherein the encryption module comprises: a counter function that converts a memory address and a nonce into an address based counter; and a block cipher that encrypts the address based counter into an address based pad; wherein encrypted data read from the memory at the memory address is XORed by the XOR module with the address based pad to produce unencrypted data and unencrypted data is XORed by the XOR module with the address based pad to produced encrypted data that is stored into the memory at the memory address, and wherein the nonce comprises a one-time random number shared between an encrypting party and a decrypting party; and further comprising a light encryption block cipher coupled to the XOR module and an input/output of the encrypted storage device; and wherein the light encryption block cipher comprises a plurality of parallel block ciphers having a block size smaller than the block size of the block cipher in the encryption module.