Source: https://patents.google.com/patent/AU2002326226B2/en
Timestamp: 2019-05-20 23:26:22
Document Index: 20708892

Matched Legal Cases: ['art 30', 'art 12', 'art 30', 'art 14', 'art 30', 'art 30', 'art 14', 'art 30', 'art 30', 'art 12', 'art 30', 'art 30', 'art 30']

AU2002326226B2 - Method and device for encryption/decryption of data on mass storage device - Google Patents
Method and device for encryption/decryption of data on mass storage device Download PDF
AU2002326226B2
AU2002326226B2 AU2002326226A AU2002326226A AU2002326226B2 AU 2002326226 B2 AU2002326226 B2 AU 2002326226B2 AU 2002326226 A AU2002326226 A AU 2002326226A AU 2002326226 A AU2002326226 A AU 2002326226A AU 2002326226 B2 AU2002326226 B2 AU 2002326226B2
AU2002326226A
AU2002326226A1 (en
Kai Wilhelm Nessler
2001-09-28 Priority to US32516801P priority Critical
2001-09-28 Priority to US60/325,168 priority
2002-09-25 Application filed by High Density Devices AS filed Critical High Density Devices AS
2002-09-25 Priority to PCT/NO2002/000342 priority patent/WO2003027816A1/en
2003-06-26 Publication of AU2002326226A1 publication Critical patent/AU2002326226A1/en
2008-06-12 Publication of AU2002326226B2 publication Critical patent/AU2002326226B2/en
WO 03/027816 PCT/N002/00342 1 Method and device for encryption/decryption of data on mass storage device Field of the Invention s The present invention relates to a method and a device for secure encryption (enciphering), scrambling, decryption (deciphering) and de-scrambling of data, and more specifically, to a method and a device for secure encryption and decryption of data when writing to or reading from a mass storage device, such as a disk unit, tape unit or other electronic/mechanic/optical mass storage media (called mass storage), connected to a computer or other electronic equipment such as digital camera, digital sound/video recorders (called computer systems), by a mass storage bus.
It is known to secure information by encryption before it is stored on a mass storage media. Encrypted files or data segments must be decrypted before they can be used.
When data is written back to the storage unit, the data must be re-encrypted. This process involves extra procedure handling for the user, and is often the reason why such precautions are rarely effective in use.
Most computer operating systems are also constructed to use work files (swap files, temporary files) of information currently processed. Sensitive data can remain available in the work files. Even if the user thinks that the job is done, and data are written WO 03/027816 PCT/N002/00342 2 encrypted and safe to a disk, a person skilled in the art will be able to extract data and documents from the work files.
WO 03/027816 PCT/N002/00342 3 US patent number 5,513,262 (van Rumpt 'et. discloses an electronic device for enciphering and deciphering data sent to and from a mass storage device in a computer system by inserting the electronic device in the bus connecting the computer system and the mass storage device.
The connecting bus passes command codes, for example for a hard disk drive controller.
The commands will be recognized by the electronic device and it will let pass the commands unchanged, while data is enciphered/deciphered on the fly when they passes the bus to and from the mass storage device through the electronic device.
One possible solution is a key hard coded into the unit, but a replaceable key is more attractive, if for example a used key accidentally is disclosed. The manufacture of the encryption/decryption device must also keep track of all used codes, if for example a used electronic device collapses, it must be replaced to gain access to the stored data.
Therefore there must exist an index linking hard coded keys to specific devices, which in itself represents a security risk.
UK patent application number GB 2,264,374 (Nolan) discloses another device to be inserted between a host computer and a mass storage device. Data flows between several data buffers, which may be acceptable for a low speed tape recording system, but the structure of the device cannot serve a modern high-speed hard disk drive.
Moreover, the encryption/decryption depends on the data block organisation in the storage, which make the encryption/decryption device computer system dependent.
However, the patent discloses a separate terminal where an operator can enter encryption/decryption keys directly to the encryption/decryption device without WO 03/027816 PCT/N002/00342 4 involving the central processing unit in the computer system. Even when using a separate channel supplying keys from a separate key storage media, like a smart card, the data stream may be compromised and/or manipulated.
One major drawback in the prior art is that all methods known so far utilise one algorithm and one key for the whole content on the storage media. Equal data sets will be encrypted with the same pattern that can be used to crack the key and the encryption method used. A simple example illustrating this scenario would be that the English word "is" would be encrypted to for example By recognising that "is" is a very to frequent phrase in an English text, and that this two-letter combination quite often is the second phrase in a sentence, this observation and pattern may help to crack the code that is used.
In a preferred embodiment of the present invention, a method and device is provided that allows different operating systems to be totally independent and isolated, even when stored on the same mass storage media, and loaded into a computer system only WO 03/027816 PCT/N002/00342 when a correct key is inserted in a device according to the present invention for that operating environment. In one embodiment of the invention, a user/administrator of a computer system will have his own key stored encrypted on a key carrier that transfers the key to the encryption/decryption device on a secure channel. This arrangement allows the user/administrator access to own data files and permitted operating environmnent. When such a key is removed from the device, the possible action performed, according to a preferred embodiment of the invention, can be one of the following: shutting down the computer, just stopping executing programs in the computer, stopping executing programs after a predefined time period or just leaving the computer running until the computer system is rebooted. At this point, the key would be required when the booting starts again. The method and device according to this particular embodiment of the invention provides a substantial improvement of data security in a computer server system over prior art.
Fig. 2 depicts a schematic view of a secure channel transferring an encryption/decryption key from a smart card, or other type of carrier of the key, to a device according to the present invention Fig. 3 depicts a schematic layout and interconnections of functional units in an electronic device according to a preferred embodiment of the present invention.
WO 03/027816 PCT/N002/00342 6 Fig. 7 depicts a schematic view of the comparator system according to the embodiment of the invention depicted in fig. 3.
Disclosure of the Invention A mass storage device is connected to a computer system by a mass storage bus (such to as cable, copper or fibre etc.) that provides the transfer of data, control codes and status codes between the mass storage device and the computer system.
There are several types of such bus systems and protocols used for this purpose.
Examples are SCSI, IDE, AT, ATA, USB, FireWire, FiberChannel and others. These bus types are well known for a person skilled in the art.
An electronic device 13, according to an embodiment of the invention, is shown in fig.
1. A mass storage device is communicating with a computer through the device 13 that provides a first end 12 communicating with the computer 10 via the bus segment 11, and a second end 14 communicating with a mass storage bus device 16 via the bus segment 15. The bus segment 15 is typically using a standard mass storage bus protocol as known to a person skilled in the art. The bus segment 11 can use the same protocol as the segment 15, but can be different, for example a serial bus while the segment 15 is a parallel bus. The device 13 will anyhow receive data or transmit data to and from the both ends linking the computer system 10 with the mass storage device 16. Data sent from the computer system 10 via segment 11 is encrypted on the fly in the device 13, while data sent from the mass storage device 16 via the segment 15 to the computer system 10 is decrypted on the fly in the same device 13. In an embodiment of the present invention, where the segment 11 and the segment 15 utilises different bus protocols, the device 13 also serves as a translator between the two protocols while, on the same time, providing encryption/decryption of user data on the fly.
According to the present invention, the device 13 can be arranged in different ways. For example, the functional units as depicted in fig. 3 can be arranged as an integral part of a hard disk controller. In this case the bus segment 11 is typically a mass storage bus.
WO 03/027816 PCT/N002/00342 7 The bus 15 will typically be an internal bus definition connecting directly to the hard disk driver system.
In some mass storage bus protocols, however, it will not be possible to extend the Command/Control codes to achieve actions in the device 13. In another example of an embodiment of the present invention, it is possible to "borrow" some blocks of data on an unused area on the mass storage media, typically an area outside the storage device limit (hidden area). The device 13 can use such an area as a communication window to the computer, and it can be used in the same manner, as known to a person skilled in the art, as when the Command/Control codes where extended. The computer system and the WO 03/027816 PCT/N002/00342 8 device 13 can read and write messages (commands, instructions, data etc.) to each other through this window.
Referring now to fig. 3, user data are the data to be stored on the mass storage media.
Encryption and decryption is performed by sending user data as input to well documented encryption algorithms such as DES, AES etc. The encryption/decryption device 13, according to the present invention, has an internal crypto bus 32 that connects different hardware sections 41a, 41b, 41n in the device 13 running specific algorithms each attached to the user data input flow, flowing to and from the first end 12 and the second end 14 via internal buses inside the device 13 and under supervision of the device controlling part 30. For a person skilled in the art, it is readily understood that 41a, 41b, 41n may implement any one of a known algorithm, for example in a hard wired processor arrangement for each algorithm, for maximum speed considerations, but also specially developed solutions for specific demands such as military use, satellite communication links etc. (for example scrambling algorithms) can be implemented.
In yet another embodiment of the invention, the algorithms can be executed in a micro controller arrangement, where the action of selecting a specific algorithm, is by loading different program counter content in the micro controller. Each of said program counter contents corresponds to the start address of each algorithm stored in a common program memory. The program memory can be a fixed non-volatile memory or a random access memory initialised at power up time from the computer system 10 for example. Such transfers can also be encrypted and/or be subject to rigid authentication procedures as known to a person skilled in the art.
Large mass storage devices need to organise data to be manageable by a computer system and provide a functional file system for a user or an application program. The basic formatting is a block/sector division of a media. Generally it is necessary to have addressable areas with sub addressable units within the area on a mass storage media to constitute functional mass storage solutions such as file systems. An addressable area on a mass storage media is usually a consecutive physically addressable area of the media, limited by a lower and upper address defining the span of the addressable area. Mass storage systems are usually arranged in a hierarchy of logic layers defining different types of for example storage areas and systems. An example is the RAID disk system definitions. An address to such an area is usually referred to as a logic address. In the present invention will all references be to the lowest level of address the physical WO 03/027816 PCT/N002/00342 9 address on the media. The embodiments of the present invention can be used with all kinds of logical storage layers and systems on top of the physical media.
According to a preferred embodiment of the present invention, such addressable areas s (blocks/sectors) can be individually encrypted with its own encryption key and /or algorithm. The block 40 in the device 13 receives the address of an area such as a block/sector number and selects one of the algorithms to be run in the sections 41a, 41n on basis of a comparison of this number with the address (sub address within the area) associated with a data item to be stored or read from the mass storage device 16. Fig. 7 illustrates the comparator block 40. The start address and end address of a block of data (the limits of an addressable area on the media) is stored in the comparator as "Start Block" and "Stop Block", respectively. When the address of a user data item (sub address within the area) is received, the user data item address is compared with the aforementioned "Start Block" and "Stop Block" addresses. If the user data item address is greater than or equal to the "Start Block" address and the user data item address is less or equal to the "Stop Block, a Boolean operation AND in the comparator detects this condition, and sends out a "is mine" signal to one of the algorithm sections 41a, 41b, 41n that this particular "is mine" signal is connected to enabling the algorithm when true. Otherwise, the signal is false, inhibiting running the aforementioned algorithm.
In an embodiment of the invention, will all the hard wired processor algorithm sections 41a, 41b, 41n contain a memory area with the same number of memory cells as there are algorithm sections. The linking of an "is mine" signal to a specific algorithm section will then be accomplished by entering logic 1 in the cell with an address equal to the number of the algorithm section, otherwise zero. By combining each "is mine" signal from each comparator with all the cells with corresponding address as the number of the "is mine" signal, will the selection of an algoritlhm be interchangeable prograrmnable.
In an embodiment of the algorithm sections by a micro controller, can associating correct content of the program counter with the associated "is mine" signal do the selection and interchangeable programming.
WO 03/027816 PCT/N002/00342 Figure 4 illustrates an example of encryption of data elements (blocks/sectors or addressable areas) where data are different, but the same key is used.
Figure 5 illustrates the same encryption scheme as in fig. 4, but in this example two of the data elements are the same and the same key is used. The encrypted data elements will therefore be the same constituting a pattern that may be a security risk.
The optionally generated number is used to prevent that two identical blocks (or sequences of data) of data will be encrypted identical, as shown in fig. 5. The random numbers are generated and stored in a table inside the device 13 addressed by the block/sector/addressable area number. In an embodiment of the present invention, there can be a plurality of tables that are addressed in two steps, first by the selection signal "is mine" generated in the comparator 40 and in the second step the block/sector/ addressable area number. This arrangement provides the same random number for the same block/sector/addressable area number thereby ensuring correct encryption/decryption of the same data elements, while at the same time providing completely random patterns in the encrypted flow of data, even if the same data elements appears and keys are used, as illustrated in fig. 6. The content of the table can be generated internally in the device 13 in a micro controller 51.
Referring now to fig. 3, to write a data block (sequence of data) to a disk, the computer has to tell the disk controller where to write the data via a block/sector number. The encryption/decryption device will receive the command with the block/sector/addressable area number via the part 12 of the device 13. The protocol interpreting part 30 of the device 13 will recognize this as a command and feed it through its interior data path to the part 14 of the device 13. The protocol part 30 will also store this information and feed it to the comparators 40 inside the device 13 as WO 03/027816 PCT/N002/00342 11 described above ("Start Block" and "Stop Block" addresses, address of an user data item, etc.).
When the computer sends the write command, the protocol part 30 will send the write command to the part 14, and set the protocol part 30 ready to do data transfers. Then, the computer starts sending data. The protocol part 30 will collect data from the part 12 via the bus 11, sizing them into 32 bits (which is the size of the internal crypto bus 32, but not limited to this size), and passing the data to the crypto bus 32. The comparator enables the correct algorithm section and associated key and lets the data, on the i0 crypto bus 32, go through the correct algorithm section 41a, 41b, and 41n.
When data is read from the mass storage device 16, the computer sends a read command, and the protocol part 30 will arrange the data flow such that the data is read form the mass storage device to the computer via the correct decryption function inside the device 13 in a similar manner as described above.
When the read/write data traffic starts, the comparator section 40, which contains the set of comparators describing addressable areas on the mass storage media that are encrypted with different algorithms ("Start Block" and "Stop Block" addresses), will send the output signal "is mine" that corresponds to the current sector thereby selecting correct algorithm section 41a, 41b,. 41n and associated key.
The encryption/decryption algorithms, 41a, or 41n, will start collecting data arranging them to the bit size the algorithm use. When the correct number of bits is collected, data will be sent through the current algorithm section 41a, 41n selected by the comparator 40. After encryption/decryption, data will be split into the crypto bus bit size and sent from the output of the current algorithm 41a, 41n back to the crypto bus 32 down to the protocol part 30, that split the data to the bit size of the bus 15 or 11, and sending the data to either the computer 10 (decryption) or to the mass storage device 16 (encryption). The encryption sections 41a, 41n also gets information from the comparator when a new data block starts, to be able to use CBC or other encoding functions to extend security.
The protocol part 30 issues also all the necessary "hand shake" signals being part of the bus segments 11 and WO 03/027816 PCT/N002/00342 12 The method and device according to the present invention is not limited as described to a certain encryption/decryption algorithm. The sections 41a, 41b, 41n can all implement any type of algorithm or scrambling of data. In a preferred embodiment of the present invention, each section 41a, 41b, 41n will have storage "slots" for an associated key with that particular algorithm.
In a best mode embodiment of the invention, a device as depicted in fig. 1 and fig. 2 is implemented where the keys are interchangeably and replaceable arranged in each section 41a, 41b,, 41n in memory allocations, selected by the comparator system depicted in fig. 7 when the signal "is mine" selects a section 41a, 41b, 41n running the current algorithm selected by the comparator Initialising the encryption/decryption system according to the preferred embodiment of the invention includes providing a start block address, a stop block address, a key and an indicator of which algorithm section 41a, 41b, 41n to use for the different blocks/sector or addressable portion of a storage media. Fig. 2 depicts a system with a smart card reader 61a for reading a smart card 63a (key carrier) containing the start block address, stop block address, key and algorithm indicator. Other means for providing this information to the device 13, such as an infrared communication link or radio link 62b etc., can be used according to the invention.
When the device 13 is started, the internal micro controller 51 will collect keys from the key carrier 63a. The micro controller will send keys to the correct encryption section via a security section 42. The security section will prevent keys to be destroyed if the micro controller 51 should start running malfunctioning code. The micro controller will also load the comparator values.
To use this functionality, extended codes as described above, can be utilised to transfer a block of data to and from the ram 31 either to/from the computer system 10 via the bus segment 11 or to/from the mass storage device 16 via the bus segment 15. Another method of accessing the ram 31, is to use it as a memory location outside the disk WO 03/027816 PCT/N002/00342 13 boundary, and thereby accessing the memory as if it was part of the disk system, although hidden. These actions are controlled by the protocol part One action the ram 31 can do is to send an interrupt to the internal micro controller 51, when for instance the ram 31 is full. The micro controller 51 can then read data from the ram 31 and do processing on the data. The micro controller can also write to the ram 31.
The computer system 10 can also read data from the ran 31. By building an easy communication protocol, the computer can communicate with the micro controller 51.
In a preferred embodiment of the present invention, such a protocol is implemented, and lo also a protocol where the micro controller 51 can relay this information to the key carrier 63, 65. In this manner, we have a communication channel both to the micro controller and to the key carrier 63, 65 via the computer system 10, and directly internally inside the device 13. These communication cannels are used to load keys to the key carrier 63, 65 as well as loading keys to the algorithm sections 41a, 41n.
Whichever implementation, the ram 31 can be utilised in several useful applications. In one embodiment of the present invention, the ranm is used to load e-mails or other types of electronic data such as files, network traffic etc. to the ram 31, encrypt the content of the ram in one selected section 41a, 41b, 41n, and then read the encrypted data back to the computer system 10 where further actions on the data will be executed. If the length of the data exceeds the size of the ram 31, the communication protocol will split the data and then loop the different sections of the data through the process as described above until the end of the data.
One important aspect of the present invention, is to provide a secure handling of encryption keys. In a preferred embodiment of the invention, a key is first transferred to the mnicro controller from the computer system 10. Then the device 13 can perform a selected encryption of the key, and then the micro controller 51 can transfer and load the encrypted key to the key carrier 63, 65, for example a smart card. In this simple manner WO 03/027816 PCT/N002/00342 14 the method and device according to the present invention provide a secure channel and transfer of encrypted encryption keys used in the system.
One important aspect of the present invention is to use keys encrypted on key carriers such as smart cards. The key carrier technology permits to "hide" data content inside the carrier. This feature heightens the security of a key. An even more important aspect of key carrier technology is that it is possible to let the key carrier in itself generate a random encryption key for a session. In this manner the whole key process will proceed without intervention of any human actions thereby increasing the security of the keys even further.
The present invention protects the loading of external keys by encrypting data to/from the key carrier 63, 65. According to the present invention, after detection of a key carrier 63, 65, the device 13 will send a public key to the key carrier 63, 65. The key carrier 63, 65 will then encrypt, with the public key, a session key to the device 13, then the device 13 and the key carrier 63, 65 can start to communicate. An alternative way is to use a key exchange scheme (for example Diffie-Hellman key exchange) to define session keys. The session key will encrypt all data on the communication channel The invention will send check messages to the key carrier 63, 65 to ensure that the key carrier 63, 65 and key device interface 61 is still on-line. This check messages will be sent at random time intervals with enough data to be sure that the key device interface 61 and key carrier 63, 65, and the device 13 can authenticate each other. If the key carrier 63, 65 detects irregularities, it will be shut down. If the device 13 detects irregularities, it will be shut down. One exception to this scheme is that the keys can have a lifetime parameter. This parameter tells the device 13 how long time period the keys shall "live" in the device 13 after a key is removed. If the key is removed, according to the present invention, the device 13 will not shut down the key before the WO 03/027816 PCT/N002/00342 lifetime has reached the predefined time period. All other detectable "tampering" with the key or the key device interface 61, will cause the device 13 to shut down all keys.
Shut down, means, that keys are detectably removed from the device 13, and the device 13 will no longer gain access to the protected area defined by the key.
As shown in fig. 8 a hard disk device 16 can be split in several independent isolated areas of storage. A MBR Master Boot Record) contains the necessary information a computer system first is loading when a system is booted. The content of the MBR tells the computer system where and how to load the operating system from the hard disk drive. The MBR for different operating systems on the same hard disk drive can be stored together with an encryption key in for example a smart card, in accordance with an embodiment of the invention. As described above, the MBR on the smart card can be loaded to the ram 31, be decrypted and then be used as the MBR of the hard disk drive 16 connected to the device 13.
WO 03/027816 PCT/N002/00342 16 One aspect of the present invention is to provide one key and one algorithm for a particular addressable portion of the storage media.
Yet another aspect of the present invention is to provide an increased security when encrypting a such addressable portion of a storage media with that particular key and algorithm by providing a random number together with the key for randomisation of the patterns constituted on the media after encryption, even if successive data records are alike and encrypted with the same key and algorithm. The random numbers are stored in to a table permitting recovery of a particular random number used when decrypting the data encrypted with this random number selected by the information about the block/sector number or address of the addressable part of the media.
1. Method for encryption (enciphering, scrambling)/decryption (deciphering, descrambling) of data items transferred to or from a mass Sstorage media, where the mass storage media comprises physically addressable areas, wherein the method comprises the steps of: Iproviding a plurality of encryption/decryption algorithms with Sassociated encryption/decryption keys; and IDselecting one of said plurality of encryption/decryption algorithms with said associated key and using said one of said plurality of encryption/ Sdecryption algorithms with said associated key on a data item to be transferred to or from an addressable area enclosing said data item on the mass storage media, wherein, the selection of said one algorithm and said associated key is determined by numbers respectively representing locations each of at least two physical addresses defining an upper address limit and a lower address limit of a span of the addressable area enclosing of said data item on said mass storage media.
2. Method according to claim 1, wherein, the step of selecting the encryption/decryption algorithm with associated key, further comprises the step of combining said key with a randomly generated number, by concatenation, subtraction or addition or combination of these operations or any other arithmetic or logic operation on the two items constituting said random number and said key.
3. Method according to claim 2, wherein, said random number is taken from a table, and an address of said table is an index constituted by at least a part of said address of said data item.
4. Method according to claim 3, wherein random generated numbers for combining with said key are stored in said table where the address of 00 18 O said table is based on two physical addresses within said selected c span of addressable area on said media. Method according to claim 4, wherein at least parts of the content c-i of said table storing said randomly generated numbers is statically or dynamically replaceable stored in said table. cIN N 6. Method according to claim 1, wherein said step of selecting said cIN t' algorithm and said associated key comprises the steps of: providing a collection of spans of addressable areas by listing said c lower and upper address limits in pairs; providing a linking such that one entry in said collection of addressable spans of areas is linked to only one of said algorithms not excluding the possibility that one of said algorithms can be linked to a plurality of spans of addressable areas in the sense that one algorithm can be used in more than one span of addressable area of said mass storage media; using the address of a data item comparing it with all said upper and lower address limits in said collection, thereby detectably finding the pair of lower and upper address limits that encloses said address of said data item; and issue a signal or message containing information about said enclosure of said data item address thereby identifying the correct one of said encryption/decryption algorithms by using said linking of algorithms and span of addressable areas.
7. Method according claim 6, wherein said linking of an upper and lower address pair with an encryption/decryption algorithm and associated key either is a predefined static linking or a dynamically linking.
8. Method according to claim 1, wherein said keys associated with said algorithms are transferred from a carrier of a key to said algorithms 00 19 Sover a secure encrypted communication channel by storing cI said key in a storage element readably connected to said algorithm.
9. Method according to claim 8, wherein the transfer of said keys is C done by a secure exchange scheme (Diffie-Hellman key exchange scheme) or with a public private key scheme. IN 10. Method according to claim 8, wherein said transfer of said keys is (N NO done with an authentication process. IND (N
12. Method according to claim 8, wherein said secure communication channel is constituted between a key device interface, receivably connected to said carrier of a key, and an encryption/decryption algorithm.
13. Method according to claim 12, wherein said constituted secure channel is an optical and/or a fibre communication channel.
14. Method according to claim 12, wherein said constituted secure channel is a wireless radio communication channel. Method according to claim 12, wherein said constituted secure channel is a wire based communication channel.
16. Method according to claim 11, wherein said key carrier generates an encryption/decryption key in said embedded processor.
17. Method according to claim 1, characterised in providing the steps of: providing a master boot record of a hard disk system encrypted with one of said plurality of encryption/decryption algorithms with associated key on a key carrier; 00 O reading the content of said smart card thereby enabling a c1 decryption of said master boot record in the identifiable decryption algorithm with associated said key; transferring the decrypted content of the master boot record to a computer system connected to a hard disk drive system thereby enabling booting of a computer operating system and/or a certain part of a file INO system and/or a system/user environment and/or other type of partition (N N and/or information stored encrypted on said hard disk drive system to said cIN Nc, computer system.
19. Device (13) for encryption (enciphering, scrambling)/decryption (deciphering, descrambling) of data items transferred to or from a mass storage media, where the mass storage media comprises physically addressable areas, wherein the device comprises: a plurality of electronic encryption/decryption circuitry sections (41a, 41b, 41n) with a receivable connected memory space for associated encryption/decryption keys; a comparator circuitry (40) partitioned in a plurality of sections comprising in each section two write-able/readable memory locations (100, 101), two electronic comparator units (102, 103) and a logic gate AND (104) interconnected such that said memory location (100) is compared with the content of an address item (105) in said comparator unit (102) to determine if said address item (105) is greater or equal to said memory location (100), and at the same time comparing said address item (105) with the content of said memory location (101) in said comparator unit (103) to determine if said address item (105) is less or equal to the content of said memory location (101), whereby the output of said gate (104) generates an enabling signal, in each said partition of said comparator each said enabling signal is connected to one of said plurality of electronic encryption/decryption circuitry sections (41a, 41b,.. 41n). 00 LI Device according to claim 19, wherein there is a write- able/readable table in the device (13) of random generated numbers, whereby said associated key with said one of selected algorithm, by said Senabling signal, is combined with said random number by a logical or arithmetic operation. INO N 21. Device according to claim 20, wherein the content of said table is (NO Cc predefined and arranged in a plurality of devices (13).
22. Device according to claim 19,wherein said keys associated with said algorithms are transferred from a carrier (63, 65) of a key to said algorithms sections (41a, 41b, 41n) over a secure encrypted communication channel (60) to micro controller (51) in said device (13).
23. Device according to claim 22, wherein the transfer of said keys is done with a Diffie-Hellman key exchange scheme or with a public private key scheme.
24. Device according to claim 22, wherein said transfer of said keys is done with an authentication process. Device according to claim 22, wherein said key carrier (63, 65) is a device comprising processing element(s) and a non-volatile memory.
26. Device according to claim 22, wherein said secure communication channel (60) is established between said key carrier (63, 65) receivable connected to a key device interface and an encryption/decryption section (41a, 41b, 41n) via said micro controller (51) and an electronic security unit (42).
27. Device according to claim 26, wherein said key device interface (61) is a smart card reader. 00 Z
28. Device according to claim 22, wherein said secure channel (60) is San optical and/or fibre communication channel. S29. Device according to claim 22, wherein said secure channel (60) is a wireless radio communication channel. NO N 30. Device according to claim 22,wherein said secure channel (60) is a wire based communication channel. S31. Device according to claim 19, wherein input and output from said plurality of electronic encryption/decryption circuitry sections (41a, 41b, 41n) is done over a crypto bus (32).
32. Device according to claim 18, wherein an internal ram (31) is connected to said crypto bus (32) via a circuit controller
33. Device according to claim 19, wherein an input/output bus (11) and/or an input/output bus (15) in the device (13) can be one of following choice, but not limited to: SCSI, IDE, AT, ATA, USB, FireWire, FiberChannel.
34. Device according claim 19, wherein said input/output bus (11) and input/output bus (15) can be different in which case said device controller execute a protocol translation between said two input/output/buses (11, Device according to claim 19, wherein: a master boot record of a hard disk system encrypted with one of said plurality of encryption/decryption algorithms in said electronic encryption/decryption sections (41a, 41b, 41n) with associated key is stored on a key carrier (63, 00 23 O said micro controller (51) reads and transfer said master boot Srecord for storing in said ram (31); Ca connected computer system (10) can then be booted according to the content of said ram 31 via the device controller (30) and said C interconnecting bus (11). N36. Device according to claim 19, wherein any e-mail or any type of (N N electronic data as networking traffic can be transferred from said computer (NO q system (10) via said bus (11) and device controller (30) to said ram (31), and be encrypted/decrypted over said crypto bus and then be read N back to said computer system (10) for further actions.
37. Method of claim 1, wherein, in said step of providing the plurality of encryption/ decryption algorithms with associated encryption/ decryption keys, i) each algorithm and key is different from other algorithms and keys, ii) each algorithm and key is associated with a different span of physically addressable area of the mass storage media as enclosed by said upper and lower address limit of the span, and iii) each span is separate from all other spans; in said step of selecting, said data item is stored encrypted on said media, based on said one algorithm and said associated key, within the two physical addresses defining the upper and lower address limit of the span of addressable area enclosing said address of said data item on said media; and each number respectively representing locations of each of the least two physical addresses defining the upper address limit and the lower address limit represents a different block/sector of said media.
AU2002326226A 2001-09-28 2002-09-25 Method and device for encryption/decryption of data on mass storage device Ceased AU2002326226B2 (en)
US32516801P true 2001-09-28 2001-09-28
US60/325,168 2001-09-28
PCT/NO2002/000342 WO2003027816A1 (en) 2001-09-28 2002-09-25 Method and device for encryption/decryption of data on mass storage device
AU2002326226A1 AU2002326226A1 (en) 2003-06-26
AU2002326226B2 true AU2002326226B2 (en) 2008-06-12
ID=23266727
AU2002326226A Ceased AU2002326226B2 (en) 2001-09-28 2002-09-25 Method and device for encryption/decryption of data on mass storage device
US (1) US7434069B2 (en)
EP (1) EP1442349A1 (en)
JP (2) JP4734585B2 (en)
KR (1) KR100692425B1 (en)
CN (1) CN1592877B (en)
AU (1) AU2002326226B2 (en)
BR (1) BR0212873A (en)
CA (1) CA2461408C (en)
HK (1) HK1075945A1 (en)
IL (2) IL161027D0 (en)
RU (1) RU2298824C2 (en)
WO (1) WO2003027816A1 (en)
ZA (1) ZA200402355B (en)
JP2005128996A (en) 2003-09-30 2005-05-19 Dainippon Printing Co Ltd Information processing apparatus and system, and program
DE602004017417D1 (en) * 2004-03-18 2008-12-11 St Microelectronics Res & Dev Device having a Schlüsselauswahleniheit and a mechanism for updating the bowl for encryption / decryption of data written in a memory / read.
AU2005317447A1 (en) * 2004-12-13 2006-06-22 Lg Electronics Inc. Method and apparatus for writing and using keys for encrypting/decrypting a content and a recording medium storing keys written by the method
EP1825470A4 (en) * 2004-12-13 2009-04-29 Lg Electronics Inc Method and apparatus for writing and using keys for encrypting/decrypting a content and a recording medium storing keys written by the method
CN100468434C (en) * 2006-06-28 2009-03-11 北京飞天诚信科技有限公司 Protection method and device for opening computer
WO2009012613A1 (en) * 2007-07-20 2009-01-29 Hui Lin Construction and method for encrypting digital information memory card
KR101026647B1 (en) 2010-07-26 2011-04-04 주식회사 유비즈코아 Communication security system and method of the same with key derivation cryptographic algorithm
KR101236991B1 (en) 2011-10-24 2013-02-25 한국전자통신연구원 Apparatus and method for encrypting hard disk
DE102012015348A1 (en) * 2012-08-06 2014-02-06 Giesecke & Devrient Gmbh A method for writing and reading data on a block-oriented storage medium
DE102013212525A1 (en) 2013-06-27 2014-12-31 Siemens Aktiengesellschaft Data storage device for secure data exchange between different security zones
KR101428649B1 (en) * 2014-03-07 2014-08-13 (주)케이사인 Encryption system for mass private information based on map reduce and operating method for the same
US9954681B2 (en) 2015-06-10 2018-04-24 Nxp Usa, Inc. Systems and methods for data encryption
US10013561B2 (en) 2015-10-30 2018-07-03 Ncr Corporation Dynamic pre-boot storage encryption key
CN106100829A (en) * 2016-05-23 2016-11-09 深圳市硅格半导体股份有限公司 Encryption storage method and device
CN107590402A (en) * 2017-09-26 2018-01-16 杭州中天微系统有限公司 Storage data encryption and decryption device and method
JPH04256113A (en) * 1991-02-08 1992-09-10 Toshiba Corp Security control system for computer system
NL9200296A (en) 1992-02-18 1993-09-16 Tulip Computers International A device for, by means of the algorithm of the encryption and decryption of data to and from a hard disk memory.
GB2264374A (en) 1992-02-24 1993-08-25 Systems Limited Kk Programmable protocol converter.
JP3625658B2 (en) * 1998-09-18 2005-03-02 富士通エフ・アイ・ピー株式会社 Encryption method and a recording medium
GB2353191A (en) * 1999-07-09 2001-02-14 Hw Comm Ltd Packet data encryption/decryption
AU3925202A (en) * 2000-11-15 2002-05-27 Netcharge Com Inc Method and system for transmitting data with enhanced security that conforms to a network protocol
2002-09-25 RU RU2004113090/09A patent/RU2298824C2/en active
2002-09-25 CA CA2461408A patent/CA2461408C/en active Active
2002-09-25 AU AU2002326226A patent/AU2002326226B2/en not_active Ceased
2002-09-25 EP EP02760908A patent/EP1442349A1/en not_active Withdrawn
2002-09-25 JP JP2003531293A patent/JP4734585B2/en active Active
2002-09-25 WO PCT/NO2002/000342 patent/WO2003027816A1/en active Application Filing
2002-09-25 BR BR0212873-0A patent/BR0212873A/en not_active Application Discontinuation
2002-09-25 IL IL16102702A patent/IL161027D0/en unknown
2002-09-25 CN CN028233492A patent/CN1592877B/en active IP Right Grant
2002-09-25 KR KR1020047004681A patent/KR100692425B1/en not_active IP Right Cessation
2002-09-30 US US10/259,733 patent/US7434069B2/en active Active
2004-03-23 IL IL161027A patent/IL161027A/en active IP Right Grant
2004-03-25 ZA ZA2004/02355A patent/ZA200402355B/en unknown
2005-09-07 HK HK05107868.9A patent/HK1075945A1/en unknown
2011-02-14 JP JP2011028383A patent/JP2011141883A/en active Pending
CA2461408A1 (en) 2003-04-03
CN1592877B (en) 2010-05-26
US20030070083A1 (en) 2003-04-10
CA2461408C (en) 2012-06-05
ZA200402355B (en) 2005-06-29
IL161027D0 (en) 2004-08-31
JP4734585B2 (en) 2011-07-27
IL161027A (en) 2009-06-15
US7434069B2 (en) 2008-10-07
HK1075945A1 (en) 2011-01-14
CN1592877A (en) 2005-03-09
EP1442349A1 (en) 2004-08-04
KR20040041642A (en) 2004-05-17
JP2011141883A (en) 2011-07-21
BR0212873A (en) 2004-09-14
RU2298824C2 (en) 2007-05-10
WO2003027816A1 (en) 2003-04-03
RU2004113090A (en) 2005-10-27
JP2005504373A (en) 2005-02-10
KR100692425B1 (en) 2007-03-09
JP4392241B2 (en) 2009-12-24 Method and system for promoting security within a computer system employing the supplied storage device