Abstract: Apparatus and method for providing data security through cascaded encryption. In accordance with various embodiments, input data are encrypted in relation to a first auxiliary data value to provide first level ciphertext. The first level ciphertext are encrypted using a second auxiliary data value associated with a selected physical location in a memory to produce second level ciphertext, which are thereafter stored to the selected physical location. In some embodiments, migration of the stored data to a new target location comprises partial decryption and re-encryption of the data using a third auxiliary data value associated with a new target physical location to produce third level ciphertext, and the storage of the third level ciphertext to the new target physical location.

Abstract: Method and apparatus for sanitizing a memory using bit-inverted data. In accordance with various embodiments, a memory location is sanitized by sequential steps of reading a bit value stored in a selected memory cell of the memory, inverting the bit value, and writing the inverted bit value back to the selected memory cell. The memory cell may be erased between the reading and writing steps, as well as after the writing step. Random bit values may be generated and stored to the memory cell, and run-length limited constraints can be used to force bit-inversions.

Abstract: A method including: reading a portion of stored data from a storage medium, decrypting the portion of stored data, then if changes are requested, making the changes to the portion of stored data to produce changed data, encrypting the changed data, and writing the encrypted changed data to the storage medium. An apparatus that performs the method is also included.

Abstract: A method of providing security in a computer system includes producing an output block of data from an input block of data, which may be performed by one or more logic circuits. The output block of data may be produced by a cipher that includes a plurality of parallel, different mixing functions and a combination function. In this regard, producing the output block of data includes applying the plurality of parallel, different mixing functions to the input block of data to produce a plurality of updated blocks of data, with each mixing function mapping the input block of data to a respective one of the plurality of updated blocks of data. And producing the output block of data includes combining the plurality of updated blocks of data in the combination function to produce the output block of data.

Abstract: A system and method includes a processing unit connected with a memory, the processing unit configured to access data from the memory. A memory transaction unit is added between the processing unit and the memory. The memory transaction unit is configured to perform dummy read- and write-operations at random memory locations at random times and/or insert random delays before real accesses by the processing unit from the memory.

Abstract: A method of providing security in a computer system includes dividing a block of data into initial left and right halves, and calculating updated left and right halves for each of a plurality of rounds. Calculating the updated left half includes applying a first function to an input left half to produce a first result, and mixing the first result with an input right half. Calculating the updated right half includes applying a second function to the input left half to produce a second result, and mixing the second result with a round key. The input left and right halves are the initial left and right halves for the first round, and thereafter the updated left and right halves for an immediately preceding round. And method may include producing a block of ciphertext with a key composed of the updated left and right halves for the last round.

Abstract: A method of providing security in a computer system includes producing a plurality of sub-keys from key material and a respective address of a memory location in a memory and possibly other information. The method may include mixing the sub-keys together using a binary tree of exclusive-or operations, and to produce an intermediate result. The method may include performing a scrambling operation on the intermediate result to produce a key with which a block of ciphertext may be produced. And the method may include performing a write operation to write the block of ciphertext at the memory location having the respective address. In this regard, the memory may include a window of memory locations each of which stores a respective block of ciphertext produced with a respective key that changes from memory location to memory location.

Abstract: A method of providing security in a computer system includes performing a memory refresh of a window of memory locations in a memory, and in which each memory location stores a version value and a block of ciphertext. The version value may be updated with each write operation at a memory location; and the block of ciphertext may be produced with a key that changes with each write operation and from memory location to memory location. The memory refresh may include performing a periodic read operation followed by a corresponding write operation at each memory location. Between the read and write operations, the version value stored at the memory location may be compared with a chronologically earliest version value stored at any memory location of the window, and validity of the block of ciphertext stored at the memory location may be verified based on the comparison.

Abstract: A method of providing security in a computer system includes producing an initial block of data from a respective address of a memory location. An updated block of data may be calculated for each round of a plurality of rounds in a substitution-permutation network. This may include mixing an input block through a substitution layer including a plurality of substitution boxes, and a linear transformation layer including a permutation, to produce the updated block, before or after which respectively the input block or updated block may be mixed with a round key. The input block may be the initial block for the first round, and the updated block for an immediately preceding round for each round thereafter. A block of ciphertext may be produced with a key composed of the updated block for the last round, and the block of ciphertext may be written at the memory location.

Abstract: A method provides security in a computing system including a processor having a logical address space and external system memory having physical address space. The method comprises hiding memory access patterns, including dynamically remapping the logical address space to the physical address space in response to data accesses to the logical address space.

Abstract: Methods of securely authenticating a host to a storage system are provided. A series of authentication sessions are illustratively performed. Each of the authentication sessions includes the host transmitting an authentication request to the storage system. The storage system authenticates the host based at least in part upon a content of the authentication request. After each successful authentication of the host to the storage system, an encryption key that was utilized in encrypting the authentication request that was transmitted to the storage system is deleted. After each encryption key deletion, a new encryption key that is different than the previous key is optionally stored and is utilized in the next authentication session.

Abstract: A method of providing security in a computer system includes producing an output block of data from an input block of data, which may be performed by one or more logic circuits in at most one clock cycle. The output block of data may be produced by a cipher that includes a plurality of parallel, different mixing functions and a combination function. In this regard, producing the output block of data includes applying the plurality of parallel, different mixing functions to the input block of data to produce a plurality of updated blocks of data, with each mixing function mapping the input block of data to a respective one of the plurality of updated blocks of data. And producing the output block of data includes combining the plurality of updated blocks of data in the combination function to produce the output block of data.

Abstract: A method of providing security for data stored in external memory in a computing system comprises storing a reference updatable hash value for each protected window of the external memory. Each reference value is stored in internal memory of the computing system. The method further comprises continually generating a current hash value for each protected window and comparing each current hash value to its corresponding reference hash value.

Abstract: Methods of securely authenticating a host to a storage system are provided. A series of authentication sessions are illustratively performed. Each of the authentication sessions includes the host transmitting an authentication request to the storage system. The storage system authenticates the host based at least in part upon a content of the authentication request. After each successful authentication of the host to the storage system, an encryption key that was utilized in encrypting the authentication request that was transmitted to the storage system is deleted. After each encryption key deletion, a new encryption key that is different than the previous key is optionally stored and is utilized in the next authentication session.

Abstract: The disclosure is related systems and methods for using operation durations of a data storage medium to generate random numbers. In one embodiment, a device may comprise a random number generator circuit configured to store a value representing a duration of an operation on the data storage medium, and generate a random number based on the value. Another embodiment may be a method comprising recording durations of access operations to a data storage medium, and generating a random number based on the durations.

Abstract: Method and apparatus for the non-destructive, selective purging of data from a non-volatile memory. In accordance with various embodiments, multiple copies of a selected set of confidential user data having a common logical address are stored to a confidential data portion of a non-volatile memory so that each copy is in a different location within the confidential data portion. A nondestructive purge of all said copies from the confidential data portion is carried out responsive to an externally supplied selective purge command so that all said copies are erased and other, non-purged confidential user data remain stored in the confidential data portion.

Abstract: A method of protecting information in a data storage device is provided. The method includes receiving, in the data storage device, encrypted data via a host computer in which the data storage device is employed. The encrypted data is then decrypted, and re-encrypted, in the data storage device, either before storage or just before data is transferred back to the host computer. The decryption and re-encryption (transcription) is performed substantially independently of the host computer. In addition, a data storage device, readable by a computer system, for implementing the above method for protecting information is provided.

Abstract: Apparatus and method for providing data security through cascaded encryption. In accordance with various embodiments, input data are encrypted in relation to a first auxiliary data value to provide first level ciphertext. The first level ciphertext are encrypted using a second auxiliary data value associated with a selected physical location in a memory to produce second level ciphertext, which are thereafter stored to the selected physical location. In some embodiments, migration of the stored data to a new target location comprises partial decryption and re-encryption of the data using a third auxiliary data value associated with a new target physical location to produce third level ciphertext, and the storage of the third level ciphertext to the new target physical location.

Abstract: Apparatus and method for providing data security through cascaded encryption. In accordance with various embodiments, input data are encrypted in relation to a first auxiliary data value to provide first level ciphertext. The first level ciphertext are encrypted using a second auxiliary data value associated with a selected physical location in a memory to produce second level ciphertext, which are thereafter stored to the selected physical location. In some embodiments, migration of the stored data to a new target location comprises partial decryption and re-encryption of the data using a third auxiliary data value associated with a new target physical location to produce third level ciphertext, and the storage of the third level ciphertext to the new target physical location.

Abstract: A method for providing security for plaintext data being transferred between units in a computer system includes steps of dividing a memory into a series of addressable locations, each of the addressable locations having an address at which can be stored version information, a data authentication tag, and ciphertext corresponding to the plaintext. The system retrieves the ciphertext, the version information, and the data authentication tag, and generates encryption keys for decrypting the information stored at the address. If the data authentication tag indicates the plaintext data are valid, then the system provides the decrypted plaintext to the requestor, or encrypts new plaintext data and stores the corresponding ciphertext with new authentication and version information at the first address.