Patent ID: 8819450

Claim:
A method for ensuring data integrity of data in a full-disk encryption storage resource comprising: in connection with the receipt of a read command at a storage resource, reading a data block from the storage resource, the data block including a data field, a data integrity field indicating the integrity of the data field, and a key counter value field indicating a cryptographic key used to encrypt the data block; determining whether the data field is encrypted with the current cryptographic key by comparing the key counter value field to the current value of a key counter register associated with the storage resource, wherein the key counter register is modified each time a cryptographic key of the storage resource is modified; in response to determining that the data field is encrypted with a cryptographic key other than the current cryptographic key, returning at least a portion of the data block in reply to the read command; based at least on the data integrity field, determining whether the data block is corrupted; in response to determining that the data block is corrupted and determining that the data field is encrypted with the current cryptographic key, returning an error indication in reply to the read command; in response to receiving an indication that the cryptographic key of the storage resource has been modified, modifying the value of the key counter register by incrementing the key counter register; and appending the value of the key counter register to a second encrypted data block subsequently written to the storage resource.