SECURE DATA ENCRYPTION IN SHARED STORAGE USING NAMESPACES

摘要

A data storage device in a distributed computing system has physical block addresses that are each allocated to multiple namespaces. To access the data storage device, a host system issues a command to the data storage device that includes an access key and a virtual block address to be accessed. The data storage device converts the virtual block address to a physical block address of the data storage device using a mapping associated with the access key. Access to a physical data block associated with a particular namespace is granted only if an access key for that namespace is provided to the data storage device.

主权项

1. An information processing system comprising:
a host system; and a storage system that includes
a nonvolatile storage device divided into blocks that are addressable using physical block addresses; anda controller configured to: (i) receive a command issued by the host system, the command including an access key for a namespace and a virtual block address, (ii) convert the virtual block address to a physical block address using a mapping associated with the access key, and (iii) access the nonvolatile storage device at the physical block address converted from the virtual block address.