Key Per IO Security Subsystem Class for NVM Express Storage Devices
summary
Proposal creates an NVMe/TCG Opal Security Subsystem Class that lets hosts download millions of wrapped Media Encryption Keys into the device and use per-command keying by referencing a 16-bit key tag; a Key Encryption Key (KEK) is provisioned first, keys live in a volatile key cache (not in NVM) so a purge-on-power-off erases secrets, and discovery plus key load use TCG security send/receive; supports GDPR-style erasure and per-file keys while aiming to keep wire-speed performance.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:40Encryption
- 1:58Disclaimers
- 2:49Concept
- 6:20Use Cases
- 8:26Key Provisioning
- 10:08Security Capabilities
- 11:51Benefits
- 13:04Standardization
- 13:30Discovery
- 14:35Key Tag
- 16:57Commands
- 18:50Write Command
- 22:59Recap
- 23:27Hosts
- 24:26Air Handling
- 24:55Technical Proposal
- 25:43Scuzzy and SATA
- 26:37Questions
- 26:54Raw Encrypted Data
related talks
38mHardware-based KMS Plug-in to Protect Secrets in Kubernetes
39mSecured I/O in the Cloud with NVMe-Over-TCP
16mOpening the I/O gates with confidential containers
31mSecure IO
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
32mSelf-Encrypting Drive (SED) Standardization Proposal for NVDIMM-N Devices
40mKeeping secrets in your opponent's hands
30mKernel Hardening With Protection Keys