Patent ID: 8504849

Claim:
A method for protecting data stored in a storage device, the method comprising: performing by a controller in the storage device, wherein the storage device is in communication with a host device: receiving a request for generation of a key value, the request including a distinct reference name for the key value; generating the key value and saving the key value and its reference name, wherein the reference name is assigned to the key value after the key value has been generated, and wherein the key value is accessible only internally within the storage device; receiving one or more policies applicable to usage of the key value, the one or more policies concerning different permissions, granted to authenticated entities, to request the storage device to use the key value for encrypting and/or decrypting data; and saving the one or more policies, wherein a request received by the storage device, which request contains the reference name for using the key value in encryption or decryption of data written or read, respectively, in the storage device, would be granted or denied based on the one or more policies.