Storage device with cryptographic capabilities

Additional data security is achieved by incorporating cryptographic processing into a storage drive which is controllable by the drive user. By utilizing user supplied keys and related information, the user can control the cryptographic processing of information and maintain its security and integrity. Further, this additional processing can be achieved without compromising the data storage capabilities of the storage drive. Enhanced security is further achieved through the use of a dual cryptographic process which includes both a two-way encryption/decryption process in conjunction with a one-way encryption process which is utilized to produce decryption check bytes during storage operations and to check existing decryption check bytes following storage. Added convenience is provided to the user by providing encryption capabilities while also continuously providing decryption capabilities within the storage device itself.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS Referring now to FIG. 1 , there is shown a schematic diagram illustrating the overall operation of the present invention. As is well known, a computer or piece of computer hardware 10 contains an operating system 12 and any number of applications 14 . Among other things, the application 14 typically requires some interaction with a storage device 30 so that data can be stored and retrieved in a desired fashion. In order to accommodate the cooperation between the application 14 and storage device 30 , the computer 10 includes a storage device driver 16 , which coordinates all storage operations. Storage device driver 16 receives data from application 14 with instructions to store that particular data in a certain fashion. Storage device driver then communicates over a storage bus 18 with storage device 30 . Together, the computer 10 and storage device 30 , along with accompanying storage bus 18 makes up a computer system 20 which is capable of many different operations and functions. As is well known, application 14 could include any number of programs including word processors, database programs, spreadsheets, financial software, internet communication software, etc. Clearly the schematic diagram shown in FIG. 1 is only one exemplary embodiment of a computer system 20 . As is well known, additional components could easily be added depending on the needs of computer system 20 . For example, additional storage devices may be included, printers, communication modems, etc. In the present application, computer system 20 is intended to be very flexible and embody many different configurations. As previously mentioned, there is often a need to provide encryption for information that is used within computer system 20 . In the present invention, it is anticipated that non-encrypted data 22 will be transferred between application 14 and storage device 16 across storage bus 18 . This allows the most flexibility for data processing within computer system 20 and minimizes the risk of hacking the cryptographic algorithm and the compromise of data security. While there is some risk that the data could be attacked prior to storage, the overall security of the data is maximized by insuring that all stored data is appropriately protected. Storage device 30 receives non-encrypted material 22 from storage bus 18 , and then internally provides mechanisms to encrypt the data prior to storage on a storage medium 32 . Stated alternatively, storage device 30 includes the necessary components to perform cryptographic processing of data. This transformation creates encrypted data 34 , which is stored on storage medium 32 within storage device 30 . It is anticipated that storage medium 32 would include removable storage devices such as optical disks, magnetic disks, magnetic tape, and other storage media. By using the encryption method of the present invention, any data contained on storage medium 32 would then be protected and readable by only the specific storage device 30 used for storage, or other appropriately coordinated storage devices. As an alternative embodiment, the storage device 30 of the present invention could include a hard disk drive, which would be capable of storing encrypted data utilizing the encryption methods described herein. In order to provide additional data security, the methods and devices of the present invention utilize a two-phase encryption methodology. Similarly, a two-phase decryption methodology is utilized to achieve this additional level of security. Referring to FIGS. 2 and 3 , there are shown flow diagrams which illustrate the two-phase encryption/decryption methodologies utilized. More specifically, FIG. 2 illustrates the formatting/encryption of data for storage, while FIG. 3 illustrates the decryption methodology for retrieving data encrypted according to the method of FIG. 2 . Referring now specifically to the flow diagram shown in FIG. 2 , the process begins when user data 42 is provided to the encryption device within storage device 30 . User data 42 (which corresponds with unencrypted data 22 discussed above) is simultaneously presented to a two-way encryption process 44 and a one-way encryption process 46 . Two-way encryption process 44 may include several well-known encryption methodologies. For example, the Rijndael Algorithm, or Advanced Encryption Standard (AES), is utilized in one embodiment of the present invention for two-way encryption. (AES is administered by the National Institute of Standards and Testing (NIST).) Two-way encryption process 44 produces encrypted data 48 which is presented to an error control coding process 50 . One-way encryption process 46 provides a simultaneous encryption methodology to the user data and produces a number of decryption check bytes. Further details of the one-way decryption algorithm are outlined below. In addition to the user data 42 , control data 52 , which is generated by storage device 30 , is also stored on the storage medium. As can be seen in FIG. 2 , all of these processes are combined to generate recorded data 56 which includes various components. More specifically, these components include error control bytes 58 , control data with decryption check bytes 60 , and the encrypted user data 48 . The recorded data 56 , or record 56 , is then stored on storage media 32 for later retrieval. Referring now to FIG. 3 , there shown the process for the retrieving and decryption of user data. Recorded data 56 is first presented to error correction process 62 to correct for any recording errors. Next, the corrected data is provided to decryption process 64 . Decryption process 64 is a companion to two-way encryption process 44 such that the decryption process is essentially reversed. This provides decrypted data which is then provided to a check bytes evaluation process 66 , and to the one-way encryption process 46 . The previously produced check bytes are also parsed from the stored data. The one-way encryption process 46 is identical to that utilized during the recording of data outlined in FIG. 2 . One-way encryption process 46 again produces check bytes (the second check bytes), which are provided to check byte evaluation process 66 . Check byte evaluation process 66 analyzes whether or not the check bytes produced match the recorded value. If this is true, (i.e. the check bytes match) that suggests that correct decryption has occurred and the correct keys are being used. Based on these conclusions, the information is returned to the user. In the preferred embodiment, data transfers in cryptographic mode are performed by a user taking the following actions: The desired cryptographic key would be set into the data transfer buffer of the host computer. The key would then be set in the drive by means of a Set Key command. Upon successful completion of the Set Key command, a Validate Key command would be sent to verify that the key was correctly loaded into the drive. These steps would put the drive in cryptographic processing mode. Once the key has been validated, the user would perform as many reads and writes as desired, setting the Encrypt/Decrypt bits in the commands to reflect how the data should be handled. Upon completion of data transfer operations, the Set Key command would be issued with the Clear bit set, in order to zero out the cryptographic key and remove the drive from cryptographic mode. As outlined, cryptographic processing can be implemented in a fashion that is simple to use and conforms to established interface standards. Obviously, modifications could be made to this process while continuing to achieve the overall protection scheme. The two-way algorithm is the main algorithm that is used for encrypting the data to be stored and decrypting the retrieved data. It is essential that the two-way algorithm generates an output that is the same size as the input. The Rijndael algorithm is a preferred two-way encryption algorithm as it has many of the characteristics desired for this application (e.g., key sizes of 128, 196, and 256 bits, symmetric algorithm, simplicity, implementation flexibility, and suitability for 8-bit processors). The fact that the Rijndael algorithm uses a minimum key-length of 128 bits, means that data encrypted with it should remain secure for at least 100 years. Since Rijndael is a symmetric algorithm, it is able to offer more security than an asymmetric algorithm given the same key size. A symmetric algorithm uses the same key for encryption and decryption. an asymmetric algorithm uses one-key (the public key) for encryption and another key (the private key) for decryption. A 128-bit symmetric key is about as secure as a 2304-bit asymmetric key. Additionally, the Rijndael algorithm displays high performance operation relative to other encryption algorithms. The one-way encryption algorithm is the mechanism that is used for generation of the decryption check bytes. In the preferred embodiment, three primary criteria are desired for the one-way algorithm: the algorithm must be fast, it will preferably generate a result having a designated number of output bytes, and it must generate a transformation as a result of the input data and the key. A number of existing algorithms, including the Secure Hash Algorithm (SHA), Snerfu, N-Hash, and Message Digest 5 (MD5), are possible, but none of them possessed all of the desired characteristics. Most existing one-way algorithms appear to be geared towards things such as digital signatures and as such, use a smaller input and generate a larger output than desired. In order to meet the desired characteristics, a new algorithm was developed for the preferred embodiment. While this new algorithm is preferable, any number of one-way description algorithms can be used without departing from the spirit of the present invention. In the preferred embodiment the one-way algorithm is a high-speed process which reduces 2048 bytes of data into a 4-byte value based upon a supplied 128-bit encryption key. In the algorithm 2048 bytes are used for the input, a 128-bit encryption key, and a 4-byte output is used, however the algorithm could easily be modified to use other input sizes. The algorithm consists of two functions, one for setting up the algorithm and another for actually performing the hashing. A Set Key function is responsible for setting up rotate counts used in the algorithm based upon the supplied encryption key. A 128-bit key is sent into the Set Key function, where it is broken up into 5-bit chunks. Each set of 5 bits is loaded into 1 of 25 rotate control registers, to produce a rotate count between 0 and 31. Since only 125-bits of the key are used for setting the rotate counts, the remaining 3-bits are discarded. As mentioned above, the one-way algorithm reduces the 2048-byte input into a 4 byte output. Each 4-bytes of input is used to create a double word. Upon creation of each double word, the contents are rotated to the right by the bit count in the current rotate control register. Each rotate control register is used in a sequential fashion for one double word rotation, until the last register been used, at which point the sequence is restarted with the first register. Upon completion of the double word rotation, the results are exclusive-or'd with the previous results. The final hash value is the result of the 512 exclusive-or'd and rotated double word inputs. Once again, other one-way algorithms are possible for use in the present invention. Referring now to FIGS. 4 and 5 , there are shown more specific data flow diagrams for the storage and retrieval of information. Specifically, FIG. 4 illustrates the data flow of information within storage device 30 during a data storage operation. As can be seen, computer 10 provides information via storage bus 18 to the storage device 30 . As previously mentioned, the preferred embodiment utilizes a small computer system interface (SCSI) to communicate between storage device 30 and computer 10 . Naturally, any number of other communication mechanisms could be used such as a serial bus, USB, specialized port, removable memory apparatus (flash card interface, PCMCIA, etc.), network connection or other communication methods. In the scheme illustrated in FIG. 4, a SCSI processor 70 will receive the necessary information and commands from computer 10 . An internal data bus 72 will then transfer information to a data buffer 74 . The information to be stored is then transferred to encryption processor 76 which carries out all of the above referenced encryption processes. Next, the encrypted record is passed to parity syndrome generator 78 and ultimately via read/write servo 80 to laser 82 . Laser 82 is then utilized to write the information to optical storage medium 32 . A somewhat similar process is utilized to read data from storage medium 32 . Once again, laser 82 is utilized to read the stored information in conjunction with a read/write servo 80 . This read information is then passed via data bus 72 to parity syndrome generator 78 . Following the processing within parity syndrome generator 78 , data is then passed to a data buffer 84 which cooperates with an error correction processor 86 , a main processor 88 , and a decryption processor 90 to perform the decryption processes outlined above. Data buffer 82 , is then capable of transferring data via data bus 72 back to the SCSI processor 70 and ultimately to host computer 10 . In one approach, separate encryption and decryption chips (i.e., programmable logic, ASIC, or similar chips) can be used for implementing cryptographic processing. The encryption chip would reside in the write data path between the Data Buffer, and the Parity Syndrome Generator 78 . By placing the encryption chip before the Parity Syndrome Generator 78 , the encrypted data is covered by the drive's Error Correction Coding (ECC) scheme. A failure to encrypt the data before applying the ECC, could result in undecipherable read data. Operation of the encryption chip would be essentially automatic whenever writes to disc are occurring, provided the drive is in cryptographic mode. Due to the fact that the error correction is typically done by a main processor in the drive, the decryption chip would have to exist essentially as a co-processor on the main data bus. When non-zero syndromes are generated by the Parity Syndrome Generator 78 during a read, the main processor must go into the Data Buffer, and perform the error correction, based upon parameters supplied by the ECC chip. Once error correction is performed, the main processor would instruct the decryption chip to decrypt the appropriate sector. An attempt to decrypt a sector before error correction has been performed, could result in undecipherable data. While the preferred embodiment has distributed processing tasks to various components, it is understood that this distribution could be accomplished in different ways. For example, it is possible that encryption and decryption could be done through one chip. Other modifications can be made, depending on other design criteria for the storage device 30 . For example, cryptographic processing could be accomplished in software or an expansion slot added to the drive. This opens up the possibility of further customizing the cryptographic processing. Additional security is provided by implementing cryptographic processing in storage device 30 by protecting against a brute-force key attack. For example, an attempt to perform a brute-force key attack on storage device 30 by repeatedly reading the same sector with different cryptographic keys, could be performed at a rate of 60 milliseconds (ms) per attempt. The rate at which attempts can be made is strictly governed by the rotational latency of storage device 30 . In an embodiment where a storage disc rotates at a rate of 16.67 Hz, there are only 16.67 opportunities per second to read a particular sector. The time required to change the decryption key does not factor into the time per attempt, as the 3.2 ms required to change the key is significantly smaller than the 60 ms rotational latency. With a 4-byte decryption check value, it should on average, take approximately 2 billion attempts before a randomly chosen key produces decrypted data that will produce the correct decryption check bytes. On storage device 30 , 2 billion reads of a single sector would take approximately 4.1 years. The same brute-force attack on data residing in memory on a 500 MHz Intel Pentium III™ equipped PC, could be accomplished in approximately 150 days. Without even adding any additional security logic, storage device 30 provides an additional factor of 10 with regard to security in the face of a brute-force key attack over a mid-range PC. Additional security mechanism could easily be added to increase the security even further. Simply adding a 2-second delay in the storage device 30 whenever incorrect decryption check bytes are detected would increase the 4.1 -year time span to 140 years. Those skilled in the art will further appreciate that the present invention may be embodied in other specific forms without departing from the spirit or central attributes thereof. In that the foregoing description of the present invention discloses only exemplary embodiments thereof, it is to be understood that other variations are contemplated as being within the scope of the present invention. Accordingly, the present invention is not limited in the particular embodiments, which have been described in detail therein. Rather, reference should be made to the appended claims as indicative of the scope and content of the present invention.