The Key Per IO (KPIO) project was a joint initiative between NVM Express® and the Trusted Computing Group (TCG) Storage Work Group to define a new KPIO Security Subsystem Class (SSC) under TCG Opal SSC for NVMe® class of Storage Devices. Self-Encrypting Drives (SED) perform continuous encryption on user accessible data based on contiguous LBA ranges per namespace. This is done at interface speeds using a small number of keys generated/held in persistent media by the storage device. KPIO allows a large number of encryption keys to be managed and securely downloaded into the NVM subsystem. Encryption of user data then occurs on a per command basis (each command may request to use a different key). These specifications are now available. This presentation will examine how to use this new capability to support use cases such as Support of EU - GDPR Support of data erasure when data is spread over many disks, support of data erasure of data that is mixed with other data needing to be preserved (multitenancy), assigning an encryption key to a single sensitive file or host object.
How to use an Encryption Key per IO
- Understand how encryption of data at rest protects that data today.
- Understand how fine grain encryption (KPIO) will be used to protect data at rest in the future.
- Understand possible use cases for KPIO (multi-tenant use of a common device, EU GDP use cases, others)
- Understand the NVMe KPIO APIs and the interdependencies with key management
---
2023 has been an interesting and challenging year for storage security.
The IEEE Security In Storage Work Group (SISWG) produces standards that many storage developers, storage vendors, and storage system operators care about, including: a) A family of standards on san
Operators of data storage systems are legally obligated to protect customer data, and can be subject to significant penalties.
Selling to the US Government can require getting FIPS (Federal Information Processing Standards) certification.Many storage products are based on Linux and Open Source code, which by themselves do
DMTF has released SPDM version 1.3, with a number of enhancements to the protocol.
Data immutability and retention locking have gained enormous traction over the last many years owing to a severe surge in number of cyber and ransomware attacks.
- Jagannathdas RathDell Technologies
The Storage Work Group under the Trusted Computing Group is active in security technologies related to data storage and focuses on data at rest encryption mechanisms.
SNIA Developer Conference
September 15-17, 2025
SDC 2025 is brought to you by SNIA. SNIA is an industry association committed to its mission of worldwide leadership developing and promoting architectures, standards, education and vendor-neutral collaboration.
