A command to perform a data operation at a memory device is received. The command includes an encryption key tag. A first key table is accessed from local memory. The first key table includes a first set of key entries corresponding to a first set of encryption keys. The first key table is searched to determine whether it includes an entry corresponding to the encryption key tag. Based on determining the first key table does not include an entry corresponding to the tag, a second key table is accessed from RAM. The second key table includes a second set of key entries corresponding to a second set of encryption keys. A key entry corresponding to the encryption key tag is identified from the second key table. The key entry includes an encryption key corresponding to the encryption key tag. The command is processed using the encryption key.

Techniques for storing encrypted data using a storage service system are described herein. A computer system of a computation layer of the storage service system receives an encrypted key manifest, which is then decrypted using a cryptoprocessor of the computer system of the computation layer to produce a partition key. The partition key is then provided to a file system abstraction layer so that, as data is provided to the computation layer for storage, the file system abstraction layer can use the partition key to encrypt data and store the encrypted data in the storage layer.

A storage system management application contains control logic configured to enable the storage system management application to fully orchestrate setup of a containerized cloud communication system within embedded operating system, with minimal interaction from an end user. Upon receipt of an instruction to initiate cloud access, the storage system management application enrolls a cloud tethering subsystem and establishes a secure communication channel to the cloud tethering subsystem. The storage system management application also creates a cloud protection environment within the operating system for use by the cloud tethering subsystem, and registers the storage system to the cloud tethering subsystem. The storage system management application also creates external network interfaces on the cloud tethering subsystem and configures one or more private cloud provider endpoints on the cloud tethering subsystem.

A peripheral device package for use in a host computing device has a plurality of compute elements and a plurality of resources shared by the plurality of compute elements. A datastructure is stored in a hidden memory of the peripheral device package. The data structure holds metadata about ownership of resources of the peripheral device package by a plurality of user runtime processes of the host computing device which use the compute elements. At least one of the user runtime processes is a secure user runtime process. The peripheral device package has a command processor configured to use the datastructure to enforce isolation of the resources used by the secure user runtime process.

A command to perform a data operation at a memory device is received. The command includes an encryption key tag. A first key table is accessed from local memory. The first key table includes a first set of key entries corresponding to a first set of encryption keys. The first key table is searched to determine whether it includes an entry corresponding to the encryption key tag. Based on determining the first key table does not include an entry corresponding to the tag, a second key table is accessed from RAM. The second key table includes a second set of key entries corresponding to a second set of encryption keys. A key entry corresponding to the encryption key tag is identified from the second key table. The key entry includes an encryption key corresponding to the encryption key tag. The command is processed using the encryption key.

Described embodiments provide systems and methods for securing offline data for shared accounts of a shared computing device. Cache files can be generated for a plurality of users of an application executable on the device to store user data corresponding to individual users of the application. An encryption key can be generated for one or more of the cache files and the encryption key can be associated with at least one user of the application. The encryption key can be associated with a user identifier so that the encryption key is not accessible by other users of the computing device. The user data can be encrypted in one of the cache files with the encryption key. The encrypted user data can be presented to a user via the shared computing device based on receipt of a user identifier that enables access to the encryption key.

A storage system management application contains control logic configured to enable the storage system management application to fully orchestrate setup of a containerized cloud communication system within embedded operating system, with minimal interaction from an end user. Upon receipt of an instruction to initiate cloud access, the storage system management application enrolls a cloud tethering subsystem and establishes a secure communication channel to the cloud tethering subsystem. The storage system management application also creates a cloud protection environment within the operating system for use by the cloud tethering subsystem, and registers the storage system to the cloud tethering subsystem. The storage system management application also creates external network interfaces on the cloud tethering subsystem and configures one or more private cloud provider endpoints on the cloud tethering subsystem.

A peripheral device package for use in a host computing device has a plurality of compute elements and a plurality of resources shared by the plurality of compute elements. A datastructure is stored in a hidden memory of the peripheral device package. The data structure holds metadata about ownership of resources of the peripheral device package by a plurality of user runtime processes of the host computing device which use the compute elements. At least one of the user runtime processes is a secure user runtime process. The peripheral device package has a command processor configured to use the datastructure to enforce isolation of the resources used by the secure user runtime process.

A computer comprises a controller and a storage apparatus which is configured to provide a storage area for storing data. The controller and the storage apparatus have a function of achieving encryption and decryption of data through use of an encryption key. The computer is configured to: execute encryption key setting processing for setting the encryption key in the controller and the storage apparatus so that the controller holds the same encryption key as the encryption key of the storage apparatus; and determine whether to enable the function of any one of the controller and the storage apparatus, based on load states of the controller and the storage apparatus when an I/O request is received.

A memory controller and a storage device including the same are disclosed. A memory controller for controlling a nonvolatile memory includes: a security access control module configured to convert biometric authentication data received from a biometric module into security configuration data having a data format according to a security standard protocol and perform, based on the security configuration data, at least one of authority registration and authority authentication of a user authority set for an access control of a secure area of the nonvolatile memory, encrypted user data being stored in the secure area; and a data processing unit configured to, based on an access to the secure area being permitted, encrypt user data received from a host device or decrypt the encrypted user data read from the secure area.