Patent Description:
Communication and data security are central to the management of any mission critical operations. Mission critical operations may include a myriad of operations, such as corporate security, national security and international missions. Specifically, securely encrypting and decrypting large amounts of data in the field are either insecure or are challenging and expensive.

For example, when a mobile platform (aircraft) collects sensitive information on a mission in an adversary territory, the collected information needs to be persistently stored in memory, but does not need to be read back in plain text form when isolated from a key management system that stores the original key material. There are numerous opportunities for the collected information to be comprised when an adversary gets hold of the memory device that contains the collected information. For example, the aircraft may get shot down or captured by an adversary. The adversary not only can retrieve the information stored in the memory, but also can generate the original encryption key that is used to protect the collected information.

Therefore, there is a need to provide a secure system to not only secure collected data but also the key that is used to protect the collected data.

<CIT> describes one-time-pad data encryption with media server and relates to protection of information in communication channels between a sender and a communication server and a communication server and a receiver, wherein a Vernam cypher and one time pad personal encryption keys of a sender and a receiver are used for encrypting transmitted data.

<CIT> describes a method and system for securely storing and transmitting data by applying a one-time pad.

<CIT> describes a method that erases key bytes of a one-time pad (OTP) cipher as they are used replacing them with encrypted or decrypted data depending upon the mode of operation of the cipher.

Embodiments of the present invention provide devices, systems, and methods for protecting confidential data and securely transferring one-time pad key materials.

In one embodiment, a system includes a data storage device containing encrypted data to be decrypted, and a Virtual Zeroisation (VZ) storage device. The VZ storage device contains key material that can be used for decrypting data stored on the data storage device. The encrypted data stored on the data storage device is encrypted prior to being stored on the data storage device using the same key material that is stored on the VZ storage device. In one configuration, the VZ storage device is coupled to the data storage device and receives encrypted data from the data storage device. The VZ storage device decrypts the encrypted data by using a portion of the key material, securely erases the used portion of key material, and writes the decrypted data to an available location in the VZ storage device. In one implementation, example key material may include a one-time pad. In certain embodiments, the data is encrypted by XOR'ing the key material with the data and then storing the encrypted data in the data storage device. At a later point in time (e.g., in the field), the data storage device is coupled to the VZ storage device and the encrypted data (i.e., data XOR'ed with key material) is again XOR'ed with the key material stored on the VZ storage device to obtain decrypted data (plaintext).

In another embodiment, a system may include a Virtual Zeroisation (VZ) storage device containing key material, a random number generator configured to generate a sequence of random numbers to encrypt the key material to obtain an encrypted key material, and an XOR circuit configured to perform an XOR operation between the sequence of random numbers and the encrypted key material to recover the key material that is originally contained in the VZ storage device prior to being encrypted by the random number generator. In one embodiment, the random number generator may be a true random number generator.

In yet another embodiment, a system may include a cache device for temporarily storing data to be encrypted, a security storage device coupled to the cache device for encrypting data received from the cache device, and a cache controller for controlling data flow between the cache device and the security storage device. The security device includes an encryption unit for encrypting the data received from the cache device using a key material, and a storage unit coupled to the encryption unit and containing the key material, wherein the security device encrypts the data of the cache device by using a portion of the key material and stores the encrypted data in the used portion of the key material.

Embodiments of the present invention also provide methods for securely transmitting key material and decrypting cipher texts using key material. In one embodiment, a method for securely transmitting key material may include providing a Virtual Zeroisation (VZ) storage device that contains the key material, generating a sequence of random numbers by a random number generator, encrypting the key material to obtain an encrypted key material that is stored in the VZ storage device, decrypting the encrypted key material using the sequence of random numbers to recover the key material, and temporarily storing the recovered key material in a cache device. In one embodiment, the cache device is a volatile memory device. In one embodiment, the method further includes erasing the key material stored in the cache device in response to an event. In some embodiments, the event may be a user triggered event, or environmental changes that are detected by sensors.

In one embodiment, a method is provided for securely storing decrypted data that has been decrypted using key material stored in a VZ storage device. The method may include providing a VZ storage device having a storage device containing key material, providing a nonvolatile device that stores encrypted data to be decrypted, decrypting the encrypted data using the key material, and overwriting the key material with the decrypted data. The method may further include temporarily storing the decrypted data in a cache device, and erasing the decrypted data stored in the VZ storage device. The method may also include erasing the decrypted data stored in the cache device in response to an event. In some embodiments, the event may be a user triggered event, or environmental changes that are detected by sensors.

The following description, together with the accompanying drawings, will provide a better understanding of the nature and advantages of the claimed invention.

Embodiments of the present invention are described with reference to the accompanying drawings. In the drawings, like reference numbers may indicate identical or functionally similar elements.

<FIG> illustrates a virtual zeroisation system <NUM> in accordance with an embodiment of the present disclosure. Referring to <FIG>, the system <NUM> includes a data source <NUM>, a key management system <NUM>, a data consumer <NUM>, and a virtual zeroisation storage device <NUM>. In some embodiments, the data source <NUM> may include a sensor, camera, or other data collecting device mounted on a mobile platform (e.g., an aircraft). As the mobile platform performs its mission, it collects data and stores the collected data into virtual zeroisation storage device <NUM> in an encrypted form. The virtual zeroisation device <NUM>, as shown, is connected to each of the data source <NUM>, data consumer <NUM>, and a key management system <NUM>. Each of the data source <NUM>, data consumer <NUM>, key management system <NUM>, and virtual zeroisation device storage <NUM> communicates with each other through well-known appropriate interfaces and buffers. These are illustrated in the drawing as small rectangles where the connectors to each block are depicted.

The key management system <NUM> provides an encryption key material, to both the data consumer <NUM> and the virtual zeroisation storage device <NUM>. While this key material can be provided in different formats, e.g. as a "public key" which uses a pair of keys, one to encrypt and one to decrypt, in the present disclosure we use a "one-time pad" key material.

A one-time pad is a type of encryption which is impossible to defeat if used correctly. One-time pads are known to be "information-theoretically secure" in that the encrypted message, that is the cipher text, provides essentially no information about the original message to a cryptanalyst. Properly created and used one-time pads are secure even against adversaries with infinite computational power.

In a one-time pad each bit or character from the plain text is encrypted by a modular addition, e.g., an exclusive OR (XOR), with a bit or character from the secret random key (one-time pad) of the same length as the plaintext, thereby providing cipher text. Claude Shannon proved, using information theory considerations, that the one-time pad has a property of "perfect secrecy," that is, the cipher text gives absolutely no additional information about the plain text.

The key management system <NUM> can be any type of device which provides encryption keys for use in encrypting data from the data source as will be described further below. In one embodiment, however, the key management system provides keys, in the form of a one-time pad, which are used to encrypt and decrypt the data from the data source <NUM>. This one-time pad key information can be provided using various techniques; however, in the embodiment we employ quantum technology to generate truly random key material. One suitable approach for accomplishing this is to use the techniques described in our co-pending commonly assigned patent application serial number<CIT>, and entitled "QKD Key Management System.

Referring to <FIG>, the virtual zeroisation storage device <NUM> can be understood as including a virtual zeroisation control function (unit) <NUM> and a storage device <NUM>. The storage device <NUM> can include any type of memory or storage device, e.g. a hard disk drive, a flash memory, etc. The virtual zeroisation control function <NUM> includes an external input/output interface <NUM>, an encryption function (unit) <NUM>, and internal input/output interface <NUM>. As used herein, a function or a unit may include logic (hardware and/or software) for performing the specific functions.

The virtual zeroisation device <NUM> is initially configured by being loaded with the one-time pad key from the key management system <NUM>. The key management system <NUM> has a key management system interface (illustrated as a small rectangle) through which the encryption key material, i.e. one-time pad, is transmitted to both the virtual zeroisation device <NUM> through the virtual zeroisation storage device interface and to the data consumer <NUM> via the data consumer interface. The external input/output function (unit) <NUM> passes one-time pad key material from the key management system <NUM> to the internal input/output function (unit) <NUM> via the bypass channel <NUM>. In the virtual zeroisation device <NUM>, the one-time pad key is stored in the storage device <NUM>.

When the virtual zeroisation device <NUM> is placed in operation, the data source <NUM> (e.g. a camera on the mobile platform) transmits its "plain text" data through the data source interface to the virtual zeroisation storage device <NUM> via the virtual zeroisation storage device interface. The virtual zeroisation storage device <NUM> receives the plain text data from the data source <NUM>, and passes it over a plain text channel <NUM> to the encryption unit <NUM>. The internal input/output interface <NUM> passes one-time pad key material read from the storage device <NUM> via the storage channel <NUM> to the encryption function (unit) <NUM> via the key input channel <NUM>. Using the one-time pad key material, the encryption unit encrypts the plain text data and stores it in storage device <NUM> as a cipher text through a cipher text channel <NUM>. In some embodiments, the virtual zeroisation storage device <NUM> may read a block of key material into internal temporary storage (e.g. a register) in the encryption unit (<NUM>), securely erase the key material from the storage device, encrypt the incoming block of data with the temporary copy of the key material, erase the temporary copy of the key material, and write the encrypted data (cipher text) to the storage device (<NUM>). In one embodiment, the encrypted data (cipher text) may be written to the same location in the storage device as the key material was read. In another embodiment, the encrypted data (cipher text) may be written to a different location in the storage device as the key material was read. Viewing from outside the VZ storage device <NUM>, it would appear as the cipher text is stored in the storage device <NUM>, it writes over the portion of the one-time pad key that has been consumed for encryption, thereby erasing it from the storage device <NUM>. In any case, the virtual zeroisation control function <NUM> causes key material read from the storage device <NUM> to be permanently erased from the storage device <NUM>, thereby assuring that the key material can only be read once from the storage device <NUM>, and is not recoverable from the virtual zeroisation storage device <NUM> after being read.

Upon return from the mission, or otherwise recovery of the virtual zeroisation device <NUM>, data from the virtual zeroisation device <NUM> is provided to the data consumer <NUM>. The internal input/output function (unit) <NUM> passes cipher text read from the storage device <NUM> via the storage channel <NUM> to the external input/output function <NUM> via the bypass channel <NUM>. From there it is provided to the data consumer <NUM> where it is decrypted using the one-time pad key material previously provided to the data consumer <NUM>.

Among the advantages of the invention are that, in the implementation, data saved on the storage device <NUM> is encrypted using an information theoretic cipher - the one-time pad - and that the key material used for the encryption cannot be recovered from the device. Further, because used key material is not recoverable, and because all stored data is information-theoretically encrypted, manually initiated zeroisation is not required. In addition, any unused key material remaining in the virtual zeroisation device <NUM> after use provides no value to an adversary - that key material never having been used. Thus, even if the device has been compromised, anti-tamper functionality is not required.

The invention also overcomes other disadvantages of prior art approaches. In many applications, practical problems prevent the use of one-time pads. To be maximally effective, the one-time pad requires perfect randomness. While the system described here can be implemented with key material having less than perfect randomness, the quantum key management system described in our co-pending patent application referenced above generates completely random keys.

A second issue regarding one-time pads is the need to use, and therefore, distribute the same key material to the encryption system (here the virtual zeroisation device) and to the decryption system (here the data consumer). This requires secure communication of the key material between the two systems, and assurance that after use, the key material stored in the encryption system does not become available to the adversary. Our system overcomes this disadvantage by denying an adversary access to the key material on the virtual zeroisation device by erasing the one time-pad from the virtual zeroisation device <NUM> as the key material is used.

<FIG> illustrate the method of operation of the virtual zeroisation device <NUM> for storage and recovery of collected data. In <FIG>, the virtual zeroisation storage device <NUM> is loaded with one-time key material from the key management system <NUM>.

<FIG> illustrates that data collected by the data source <NUM> is written to the virtual zeroisation storage device <NUM>. As the data is saved to the virtual zeroisation storage device <NUM>, it is encrypted with the one-time pad key material. As it is used for encryption, the key material used is erased from the virtual zeroisation storage device <NUM>.

Referring to <FIG>, the data consumer <NUM> reads the collected data, as cipher text, from the virtual zeroisation storage device <NUM>.

Referring to <FIG>, the data consumer <NUM> uses the key material from the key management system <NUM>, enabling the data consumer <NUM> to decrypt the cipher text and access the originally collected data.

As described above, the virtual zeroisation storage device <NUM> is first filled with one-time pad key material using the control unit <NUM> within the virtual zeroisation device <NUM>. As the mobile platform performs its mission, data is collected on the mission, and is written to the storage device <NUM>. As this data is received, it is encrypted using the one-time pad material. Upon return of the mission the collected and encrypted data in the storage device <NUM> is decrypted by the data consumer <NUM> enabling appropriate analysis, e.g., by a data processing system.

If the mobile asset, i.e., the storage device <NUM>, is compromised during the mission, for example by coming under the control of an adversary, the adversary can try to read the collected data in its cipher text form. The data, however, is useless without the key material. Because the cipher text is protected by the information-theoretically secure one-time pad cipher, and because the key material used for the encryption cannot be recovered from the storage device, the collected data remains secure. The remaining unused key material which the adversary reads from the virtual zeroisation storage device <NUM> has not been used for any encryption, and therefore that material is of no value to the adversary.

Among the advantages of the virtual zeroisation storage device over conventional storage devices, whether or not they used fixed length classical encryption, are that data saved on the storage device is encrypted using an information theoretic cipher - the one time pad, and that the key material used for the encryption operation cannot itself be recovered from the device. A third advantage is that because the used key material is not recoverable and because all data is stored in an encrypted form, manually initiated zeroisation of the device is not necessary. Furthermore, because any unused key material remaining on the device is of no value to an adversary, it is not necessary to equip the device with anti-tamper functionality.

<FIG> illustrate the method by which protection of the data on the storage device <NUM> is protected from an adversary. Referring to <FIG>, the virtual zeroisation storage device <NUM> is loaded with one-time key material from the key management system <NUM>.

Referring to <FIG>, data collected by the data source <NUM> is written to the virtual zeroisation device <NUM>. As plain text data is saved to the storage device within the virtual zeroisation device, it is encrypted with the one-time pad cipher. The portion of the key material used for encryption is erased from the storage device <NUM> as the cipher text data is stored in its place.

<FIG> assumes an adversary <NUM> has control of the virtual zeroisation device <NUM>, and reads the collected data (as cipher text), and the unconsumed portion (remaining unused portion) of the key material from the virtual zeroisation storage device <NUM>. Because the cipher text is protected by the information-theoretic secure one-time pad cipher, and because the key material used for the encryption cannot be recovered from the virtual zeroisation storage device <NUM>, the collected data remains secure. The remaining unused key material read from the virtual zeroisation storage device <NUM> has not been used for encryption, and therefore provides no value to the attacker <NUM>.

<FIG> is a block diagram illustrating a virtual zeroisation (VZ) system <NUM> for decrypting a cipher text using a VZ storage device that can only be used once according to one embodiment of the present invention. Referring to <FIG>, the VZ system <NUM> may include a modified VZ storage device <NUM> and a read-only memory device <NUM> containing a cipher text. The read-only memory <NUM> can be any type of memory device that supports read operations. For example, the read-only memory device <NUM> may be a static read-only-memory (ROM) device, electronically erasable and programmable read only memory (EEPROM), electronically programmable read only memory (EPROM), flash memory, compact disc read only memory (CDROM), digital versatile disc (DVD), flash memory, magnetic storage devices (cassette, tape), or a battery backed static random access memory (SRAM) device that can store a cipher text or encrypted information data. The modified VZ storage device <NUM> is initialized with a one-time key material (alternatively referred to as "one-time pad"). The read-only memory device <NUM> has data encrypted with the same one-time key material (one-time pad) that was loaded into the modified VZ storage device <NUM>. During operation, in order to read the data in plain text, it is first read (as cipher text) from the read-only memory device <NUM>. This data is then written to the modified VZ storage device <NUM>. The modified VZ storage device <NUM> "encrypts" the data using the one-time key material stored within it, as is done with a VZ storage device. For the one-time pad algorithm, this second "encryption" with the same key material results in decryption of the original data, thus revealing the plain text of the stored information. Referring to <FIG>, the plain text is now stored in the storage device <NUM> together with the remaining portion of the one-time pad key that has not been consumed by the decrypted cipher text.

Modification to virtual zeroisation (VZ) is desirable because the stored information in the VZ storage device is now in plain text. The modification is an additional secure erasure after the data has been decrypted and read. So at the end of the operation, the VZ storage device has both the remaining key material and the plain text data in the consumed portion of the key material, hence the name "modified VZ storage device". The read-only memory device that was loaded with encrypted data still contains the original encrypted data, but the key required to decrypt it has now been erased from the modified VZ storage device, so it is only possible to decrypt the encrypted data once. For example, the cipher text or encrypted data may be sensitive mission data (for an aircraft going on mission), program code (containing instructions for a computer) or an operating system that needs to be decrypted first prior to use.

<FIG> is a block diagram of a modified VZ storage device <NUM> according to an embodiment of the present invention. Referring to <FIG>, the modified VZ storage device <NUM> may include a VZ storage device <NUM> as shown in <FIG> and an erase unit <NUM> coupled to the storage device <NUM>. The erase unit <NUM> is configured to erase the decrypted data (plain text) stored in the used portion of the key material, after the decrypted data has been read out from the storage device <NUM>. In other words, the decrypted data (the plain text) can only be read out once because it will be erased by the erase unit <NUM> after readout. The modified VZ storage device <NUM> may also be referred to as a read-once VZ storage device. The modified VZ storage device <NUM> may include an interface port <NUM> configured to interface the modified VZ storage device <NUM> to external devices, such as one or more processing units, one or more memory devices (e.g., SRAM), and the like. In one embodiment, the storage device <NUM> is a flash memory device, and the erase unit <NUM> provides the necessary voltages to erase blocks of the flash memory device that stores the decrypted data after the decrypted data has been read out. In another embodiment, the erase unit <NUM> provides the necessary voltages to erase all blocks of the flash memory device. In yet another embodiment, the erase unit <NUM> may also verify that the storage device <NUM> is securely erased. The erase operation may include writing zeroes, ones, or random data to the storage device <NUM>.

<FIG> is a block diagram illustrating a virtual zeroisation (VZ) system <NUM> for decrypting a cipher text using a modified VZ storage device that can only be used once and the decrypted data can only be read-back a limited number of times, in accordance with one embodiment of the present invention. The VZ system <NUM> may include a modified VZ storage device <NUM>' and a read-only memory device <NUM>' that can be similar or the same as the modified VZ storage device <NUM> (<FIG>) and the read-only memory device <NUM> shown in <FIG> and described above. That is, cipher text (encrypted data) stored in the read-only memory <NUM>' was previously encrypted using the same key material as that contained in the modified VZ storage device <NUM>'. As the encrypted data is decrypted by the modified VZ storage device <NUM>' using the key material of the modified VZ storage device <NUM>', the decrypted data takes the place of the consumed portion of the key material in the modified VZ storage device <NUM>'. In one embodiment, the VZ system <NUM> may further include a cache device <NUM> and a cache controller <NUM>. The cache device <NUM> may be a static random access memory (SRAM) device, a dynamic random access memory (DRAM) device, or a flash memory device. The cache device <NUM> is thus a readable and writeable cache memory. The plain text data (decrypted data) in the modified VZ storage <NUM>' is written to the cache device <NUM> under the control of the cache controller <NUM>. It is to be understood that, as the decrypted data is read out to the cache device <NUM>, it is erased by the erase unit <NUM>.

In some embodiments, the VZ system <NUM> may further include a configuration device <NUM> that enables a user to enter operations or environment parameters to limit the read operation of the plain text stored in the modified VZ storage device <NUM>'. For example, a user can enter a time-based parameter that limits the read-back operation of the plain text of the modified VZ storage device <NUM>' to a predetermined time duration (e.g., <NUM> hours) or an operation-based parameter to limit the number of read-back operations, e.g., the plain text data will be erased after two read-back operations. In some other embodiments, the VZ system <NUM> may further include an event detection device (unit) <NUM> coupled to a multitude of sensors (<NUM>-<NUM>, <NUM>-<NUM>, etc.) configured to detect, for example, a voltage change, a temperature change, a tamper attempt, an alarm signal, a device error, an IO error, and the like and generates a signal to the cache controller to cause the plain text in the cache device <NUM> to be erased.

In accordance with the present invention, the decrypted data is stored in the cache device <NUM>. Time-based, operations-based and external controls can be used to permit time-limited, or operations-limited multiple reads of the decrypted data before it is securely erased. It may be possible to operate in this mode without a physical cache. As the modified VZ storage device <NUM>' holds the plain text, if the second secure erasure is delayed, then the plain text can be read from it multiple times. However, it will be more secure to use a volatile cache to hold the plain text because the modified VZ storage device has a nonvolatile storage, and it may not be possible to erase it properly under all error or attack scenarios.

<FIG> is a block diagram illustrating a one-time key recovery system <NUM> according to one embodiment of the present invention. The one-time key recovery system <NUM>, as shown, may include a random number generator (RNG) <NUM>, a VZ storage device <NUM>, and an XOR logic circuit <NUM>. The RNG <NUM> generates random sequences of signals that can be, for example, binary signals representing by logic "<NUM>" and "<NUM>", or analog signals representing by a positive voltage and a negative voltage. In one exemplary embodiment, the RNG <NUM> is a true random number generator that generates true random sequences of binary signals <NUM> and provides the true random sequences of binary signals to the VZ storage device <NUM> to encrypt the true random sequence <NUM> with the one-time pad key stored in the VZ storage device <NUM>. The VZ storage device <NUM> may be the VZ storage device <NUM> shown in <FIG> and described above. In one embodiment, referring to <FIG>, the RNG <NUM> provides a copy of the true random sequence of binary signals <NUM> to the VZ storage device <NUM> through the external I/O port <NUM> and encrypts the random sequence of binary signals <NUM> with the one-time pad key stored in storage <NUM>. That is, the random sequence of binary signals <NUM> randomizes the one-time pad key. In order words, the VZ storage device <NUM> will output a double-encrypted data stream <NUM>. The XOR logic circuit <NUM> performs an exclusive-or (XOR) operation on the data stream <NUM> of the VZ storage device <NUM> and a data stream <NUM> of the RNG <NUM> which is the exact copy of the true random sequences of binary signals <NUM> that is encrypted with the one-time pad key and stored in the VZ storage device <NUM>. The result of the XOR operation produces the original one-time pad key <NUM> at the output of the XOR logic circuit <NUM>.

In one embodiment, the one-time key recovery system <NUM> enables a secure transport of the one-time pad key by scrambling the one-time pad key in the storage <NUM> of the VZ storage device <NUM> with a true random binary sequence of binary signals. The one-time pad key can be securely recovered by performing an XOR-operation of the scrambled one-time pad key with the exact copy of the true random binary sequence of binary signals.

According to the present invention, the one-time pad key recovery supports read-once, and read-multiple operations by the addition of the RNG <NUM> in the VZ storage device. By writing the true random sequence <NUM> of the RNG <NUM> to the VZ storage device <NUM>, reading back the encrypted RNG stream <NUM>, then XOR-ing this encrypted stream with a copy of the RNG stream <NUM> (same as the true random sequence <NUM>), the one-time key material can be recovered from the VZ storage device <NUM>, while at the same time the key material is securely erased from the VZ storage device <NUM>. The recovered one-time key may then be saved in a battery-backed SRAM or a flash memory (not shown) that may be integrated within the one-time key recovery system <NUM>. In the case where the one-time key recovery system <NUM> supports read-multiple operations, it functions as the key management <NUM> as shown in <FIG>. That is, the recovery key of the system <NUM> can be provided to the virtual zeroisation storage device <NUM> and to the data consumer <NUM>, as shown in <FIG>. In the case where the one-time key recovery system <NUM> supports read-once operations, it functions as a read-once VZ system <NUM> described in reference to <FIG>. That is, the recovered one-time key stored in the flash memory or battery-backed SRAM will be erased after it has been read out. The erasure can be performed by disconnecting or powering off the battery supply when an SRAM is used, or performing an erase operation when a flash device is used.

In one embodiment, the RNG <NUM> may be an external module or unit of the one-time key recovery system <NUM>. In another embodiment, the RNG <NUM> and the XOR logic circuit <NUM> may be integrated within the VZ storage device <NUM> as an integrated device.

In one embodiment, the recovered one-time pad key will be used as the one-time key material for the virtual zeroisation (VZ) device <NUM> as shown in <FIG>. The thus loaded VZ storage device <NUM> can be used to encrypt data collected by the data source <NUM>, as shown in <FIG>.

In one embodiment, the encrypted data of the VZ storage device <NUM> is provided to the data consumer <NUM> that can decrypts it using the recovered one-time pad key <NUM>, as shown in <FIG>.

<FIG> is a block diagram illustrating a VZ system 8A that may store decrypted data for a limited use according to one embodiment of the present invention. Referring to <FIG>, the VZ system 8A may include a one-time pad key recovery system <NUM>' that is similar to the one-time pad key recovery system <NUM> shown in <FIG>. The VZ system 8A may also include a RNG <NUM>' that is the same as the RNG <NUM>, i.e., the RNG <NUM>' provides a copy of a true random binary sequence of binary signals <NUM> that is the same as the true random binary sequence of binary signals <NUM>. The output XOR <NUM> provides the recovered one-time key <NUM>. The VZ system 8A may further include an XOR operator <NUM> that receives the recovered one-time key <NUM> and the cipher text <NUM> provided by the read-only memory device <NUM> and outputs a plain text <NUM>. Additionally, the VZ system 8A may include a random access memory cache device <NUM> and a cache controller <NUM>. The random access memory cache device <NUM> is configured to store the plain text <NUM> under the control of the cache controller <NUM>. The cache controller <NUM> performs synchronization of the cache device <NUM> and the one-time key recovery system <NUM>' and controls the cache device <NUM> to store the recovered plain text <NUM> based on parameters that are user-configurable or event triggered. The cache device is a volatile memory device, e.g., a static random access memory device or a dynamic random access memory device, which will lose its content when the power supply is turned off.

In one embodiment, the VZ system 8A may further include an event detector <NUM> and a configuration device <NUM> that enables a user to enter parameters to limit the read out of the plain text stored in the cache device <NUM>. In one embodiment, the read out operation of the cache device <NUM> may be time based, e.g., the one-time pad key stored in the cache device will be erased after a predetermined period of time (e.g., <NUM> hours). In one embodiment, the read out operation of the cache device <NUM> may be operations-based, e.g., the plain text stored in the cache device <NUM> may be erased after a predetermined number of read operations, e.g., the one-time pad key is erased after five read operations. In one embodiment, the cache controller <NUM> provides an erase signal to the cache device <NUM> to cause the erasure of the content of the cache device when a voltage change, a temperature change, a tamper attempt, or a device error (e.g., an error in the VZ storage <NUM>, an error in the RNG <NUM>, an error in the cache controller, an error in the configuration device, etc.) is detected. In one embodiment, the user may cause the erasure of the cache device <NUM> by pressing an erase button coupled to the event detector <NUM> or through the configuration device.

<FIG> is a block diagram illustrating a VZ system 8B that enables a limited use of a recovered one-time pad key according to one embodiment of the present invention. Referring to <FIG>, the VZ system <NUM> may include a one-time pad key recovery system <NUM>' that is similar to the one-time pad key recovery system <NUM> shown in <FIG>. The VZ system <NUM> may also include a RNG <NUM>' that is the same as the RNG <NUM>, i.e., the RNG710' provides a copy of a true random binary sequence of binary signals <NUM> that is the same as the true random binary sequence of binary signals <NUM>. In one embodiment, the RNG <NUM> and the RNG <NUM>' may be the same device, i.e., the RNG <NUM> may be first used to encrypt the key material in the VZ storage <NUM>, thereafter the RNG <NUM> is removed and sent to the data consumer <NUM> to recover the one-time key <NUM>. The output XOR <NUM> provides the recovered one-time key <NUM>. Additionally, the VZ system <NUM> may include a random access memory cache device <NUM> and a cache controller <NUM>. The random access memory cache device <NUM> is configured to store the plain text <NUM> under the control of the cache controller <NUM>. The cache controller <NUM> performs synchronization of the cache device <NUM> and the one-time key recovery system <NUM>' and controls the cache device <NUM> to store the recovered one-time key <NUM> based on parameters that are user-configurable or event triggered.

In one embodiment, the VZ system 8B may further include an event detector <NUM> and a configuration device <NUM> that enables a user to enter parameters to limit the read out of the plain text stored in the cache device <NUM>. In one embodiment, the read out operation of the cache device <NUM> may be time based, e.g., the one-time pad key stored in the cache device will be erased after a predetermined period of time (e.g., <NUM> hours). In one embodiment, the read out operation of the cache device <NUM> may be operations-based, e.g., the plain text stored in the cache device <NUM> may be erased after a predetermined number of read operations, e.g., the one-time pad key is erased after five read operations. In one embodiment, the cache device <NUM> will erase its content when a voltage change, a temperature change, a tamper attempt, or a device error (e.g., an error in the VZ storage <NUM>, an error in the RNG <NUM>, an error in the cache controller, an error in the configuration device, etc.) is detected. In one embodiment, the user may cause the erasure of the cache device <NUM> by pressing an erase button (e.g., an electronic switch or a mechanical switch) to activate the cache controller <NUM> to generate an erase signal to the cache device <NUM>.

Referring to <FIG>, the VZ system 8B may be used to store the recovered one-time key <NUM> directly to the cache device <NUM> that enables a limited use of the recovered one-time key based on user configured parameters.

In one embodiment, the read out operation of the cache device <NUM> may be operations-based, e.g., the one-time pad key stored in the cache device will be erased after a predetermined number of read operations, e.g., the one-time pad key is erased after five read operations. In one embodiment, the cache device <NUM> may contain the plain text <NUM> when the cipher text is decrypted using the recovered one-time key <NUM>. In another embodiment, the cache device <NUM> may contain the recovered one-time key <NUM> when the XOR operator <NUM> is bypassed. In both cases, the cache device <NUM> may erase its content when a voltage change, a temperature change, a tamper attempt, or a device error (e.g., an error in the VZ storage <NUM>, an error in the RNG <NUM>, an error in the cache controller, an error in the configuration device, etc.) is detected. In one embodiment, the VZ system <NUM> may include a multitude of sensors (e.g., sensors <NUM>-<NUM>, <NUM>-<NUM> shown in <FIG>) for detecting environmental changes (voltage, temperature, device errors, tamper attempts, etc.).

<FIG> is a block diagram illustrating a virtual zeroisation (VZ) system <NUM> having limited read-back functionality of written data according to one embodiment of the present invention. Referring to <FIG>, the VZ system <NUM> may include a VZ storage device <NUM>, a cache device <NUM>, a cache controller <NUM>, an event detector device <NUM>, and a configuration device <NUM>. The VZ storage device <NUM> may be similar or the same as the VZ storage device <NUM> shown in <FIG> and described above. The cache device <NUM> may be a static random access memory (SRAM) device, dynamic random access memory (DRAM) device, or flash memory device having a memory size smaller or equal to the storage size of the VZ storage device <NUM>. The cache device <NUM> is thus a readable and writeable cache that can interface with an information collecting system (e.g., the data source <NUM>) <NUM> and write plain text data to the VZ storage device <NUM> through the external input/output function <NUM> (<FIG>). In the embodiment, the cache device <NUM> is disposed between the data source <NUM> and the virtual zeroisation device <NUM> as shown in <FIG>. The cache device <NUM> has an interface port that can interface with an information collecting system (e.g., data source <NUM> in <FIG>) to receive information from the information collecting system and output the received information to the VZ storage device <NUM> for encryption under the control of cache controller <NUM>. The cache controller <NUM> can perform synchronization of the cache device <NUM> and VZ storage device <NUM>, i.e., the cache controller <NUM> can control the cache device <NUM> to read plain text data from the information collecting system (e.g. data source <NUM>) and write the plain text data to the VZ storage device <NUM>.

In one embodiment, the cache device <NUM> is coupled to the information collecting system <NUM> (data source <NUM>) to receive plain text data from the data source and output the plain text data to an information display system (not shown). In other words, data received from the data source is stored in the read/write cache device <NUM>, which then sends the received data to the VZ storage <NUM> under the control of the cache controller <NUM>. The data written to the VZ storage is protected (encrypted) as for VZ. The data in the read/write cache can be read-back multiple times under the control of the cache controller <NUM>. The storage time in the cache device <NUM> is configurable. In some embodiments, the read-back limits of the cache device <NUM> may be time-based, e.g., the cache contents expires (is erased) after a configurable period of time. In some other embodiments, read-back limits of the cache device <NUM> may be operations-based, e.g., the cache contents expires (is erased) after a configurable number of read operations. The user can configure the mode of operation of the VZ system <NUM> through the configuration device <NUM>. In one embodiment, the configuration device <NUM> may include a control panel having an input device (e.g., keyboard, mouse) and a display. In one embodiment, the display may be a touch screen display including a menu such that the user can configure the operation mode of the VZ system <NUM> by selecting appropriate keys or entering desired parameters. In one example, the user may select the time-based read-back limit to be <NUM> hours, so that the content of the cache device <NUM> is erased after <NUM> hours. In another example, the user may select the operation-based read-back to be five read operations, so that the content of the cache device <NUM> is erased after being read five times. In one embodiment, the configuration device <NUM> may have a user interface so that a user can enter event triggered parameters.

In a non-limiting exemplary embodiment, the VZ system <NUM> may further include a multitude of sensors coupled to the event detector <NUM>. For example, the VZ system <NUM> may include a sensor <NUM>-<NUM> for sensing a voltage variation, a sensor <NUM>-<NUM> for sensing a temperature change, a sensor <NUM>-<NUM> for sensing a tampering attempt (e.g., detecting that a device of the VZ system is disconnected), a sensor <NUM>-<NUM> for sensing a device error (e.g., error in the data source, error in the VZ storage device, error in the cache device, etc.). Of course, as those of skill in the art will appreciate, other sensors may also be used.

In one embodiment, the cache controller <NUM> may be external to the cache device <NUM>. In another embodiment, the cache controller <NUM> may be integrated with the cache device <NUM>. In yet another embodiment, the configuration device <NUM>, the event detector device <NUM>, the cache controller <NUM>, and the cache device <NUM> may be integrated as part of a storage device for temporarily storing plain text data.

<FIG> is a simplified flowchart illustrating a method <NUM> of decrypting encrypted data contained in a nonvolatile memory device according to one embodiment of the present invention. The method <NUM> may include, in block <NUM>, providing a decryption device having a storage unit containing a key material. In block <NUM>, the method may further include providing encrypted data stored in a nonvolatile memory that needs to be decrypted to the decryption device. In block <NUM>, the method may also include decrypting the encrypted data by consuming a portion of the key material to obtain decrypted data. In block <NUM>, the method may also include overwriting the consumed portion of the key material with the decrypted data. In block <NUM>, the method may also include temporarily storing the decrypted data in a cache device and erasing the decrypted data stored in the consumed portion of the key material after the decrypted data has been stored in the cache device. In block <NUM>, the method may also include erasing the decrypted data in the cache device in response to an event.

<FIG> is a simplified flowchart illustrating a method <NUM> of transmitting and recovering an encrypted key material containing in a VZ storage device according to one embodiment of the present invention. The method <NUM> may include, in block <NUM>, providing a VZ storage device containing key material. In block <NUM>, the method may further include generating a sequence of random numbers by a random number generator. In block <NUM>, the method may also include encrypting the key material using the sequence of random numbers to obtain an encrypted key material. In block <NUM>, the method may further include decrypting the encrypted key material using an exact copy of the sequence of random signals to recover the key material. In block <NUM>, the method may also include temporarily storing the recovered key material in a cache device. In block <NUM>, the method may also include erasing the key material stored in the cache device in response to an event.

<FIG> is a simplified flowchart illustrating a method <NUM> for securely storing data in a security system that has limited read-back functionality of stored data according to one embodiment of the present invention. The method <NUM> may include temporarily storing unsecure data in a cache device in block <NUM>. In block <NUM>, the method may further include encrypting the unsecure data using a security device containing a key material. In one embodiment, the method may include encrypting the unsecure data by consuming a portion of the key material to obtain an encrypted data and overwriting the consumed portion of the key material with the encrypted data. In block <NUM>, the method may further include reading back the unsecure data stored in the cache device using a cache controller that limits the number of data read-back operations according to a predetermined parameter. In one embodiment, the predetermined parameter is an operation-based parameter. In another embodiment, the predetermined parameter is an event-triggered parameter.

Claim 1:
A system comprising:
a data storage device containing encrypted data to be decrypted; and
a virtual zeroisation, VZ, storage device containing key material for decrypting data,
wherein the VZ storage device comprises
a storage device containing the key material for decrypting data,
an encryption unit configured to decrypt the encrypted data by using a portion of the key material and store the decrypted data in the used portion of the key material, and
an erase unit configured to erase the decrypted data stored in the storage device after the decrypted data has been read out from the storage device;
a cache device comprising volatile memory and coupled to the VZ storage device, the cache device configured to temporarily store the decrypted data received from the storage device;
a cache controller configured to erase the decrypted data from the cache device in response to an event, wherein the event is a user triggered event or environmental changes that are detected by sensors.