Protecting information on a computer readable medium
First Claim
1. A method providing security for a plurality of data records stored on a computer-readable medium within a computing system, wherein said computer readable medium additionally stores a first data structure, starting at a first location within said computer readable medium, locating data records in said plurality thereof, said method comprises an encryption subroutine executed as said computing system is being shut down and a decryption subroutine executed as said computing system is being initialized, said encryption subroutine includes receiving a request to shut down said computing system, reading said first data structure from said computer readable medium, encrypting said first data structure to produce an encrypted version of said first data structure, deleting said first data structure from said computer readable medium, and storing said encrypted version of said first data structure in nonvolatile storage, starting at a second location within said nonvolatile storage, and said decryption subroutine includes determining that electrical power has been turned on in said computing system, reading said encrypted version of said first data structure from said nonvolatile storage, decrypting said encrypted version of said first data structure to form said first data structure, and writing said data structure to said computer readable medium, starting at said first location.
2 Assignments
0 Petitions
Accused Products
Abstract
Data stored on a computer readable medium in a computing system is protected from being read within another computing system by encrypting a data structure, such as the FAT table of a disk recorded using a FAT-based file system or a portion of the master file table of a disk recorded using an NTFS file system. This data structure is used to find the files on the medium. Encryption and decryption preferably occur within a cryptographic processor of the computing system, with this data structure in a hard drive being encrypted as the computing system is shut down and decrypted after power on. In an alternate embodiment, a utility program provides for selective encryption and decryption of a data structure in a removable computer readable medium.
143 Citations
25 Claims
-
1. A method providing security for a plurality of data records stored on a computer-readable medium within a computing system, wherein
said computer readable medium additionally stores a first data structure, starting at a first location within said computer readable medium, locating data records in said plurality thereof, said method comprises an encryption subroutine executed as said computing system is being shut down and a decryption subroutine executed as said computing system is being initialized, said encryption subroutine includes receiving a request to shut down said computing system, reading said first data structure from said computer readable medium, encrypting said first data structure to produce an encrypted version of said first data structure, deleting said first data structure from said computer readable medium, and storing said encrypted version of said first data structure in nonvolatile storage, starting at a second location within said nonvolatile storage, and said decryption subroutine includes determining that electrical power has been turned on in said computing system, reading said encrypted version of said first data structure from said nonvolatile storage, decrypting said encrypted version of said first data structure to form said first data structure, and writing said data structure to said computer readable medium, starting at said first location.
-
13. A method providing security for a plurality of data records stored on a computer readable medium within a computing system, wherein
said computer medium additionally stores a first data structure starting at a first location within said removable computer readable medium, locating data records in said plurality thereof, said method comprises an encryption subroutine executed to encrypt said first data structure and a decryption subroutine subsequently executed to decrypt an encrypted version of said first data structure, said encryption subroutine includes reading said first data structure from said computer readable medium, encrypting said first data structure within a cryptographic processor in said computing system using an encryption key to produce an encrypted version of said first data structure, deleting said first data structure from said computer readable medium, and storing said encrypted version of said first data structure in nonvolatile storage, starting at a second location within said nonvolatile storage, and said decryption subroutine includes reading said encrypted version of said first data structure from said nonvolatile storage, decrypting said encrypted version of said first data structure within said cryptographic processor in said computing system using a decryption key generated from data stored in secure storage accessed by said cryptographic processor to form said first data structure, and writing said data structure to said computer readable medium, starting at said first location.
-
19. A computing system providing secure storage of a plurality of data records comprising:
-
a first computer readable medium storing said plurality of data records and a first data structure providing locations and sequences for accessing data within said data records;
a first drive unit recording data on said first computer readable medium and reading data from said computer readable medium;
nonvolatile storage;
a cryptographic processor, wherein said cryptographic processor is programmed to execute an internal encryption routine to encrypt a data structure, forming an encrypted version of said data structure using an encryption key, and to execute subsequently an internal decryption routine, decrypting said encrypted version of said data structure, using a decryption key;
secure storage accessed by said cryptographic processor, holding data used within said cryptographic processor to derive said decryption key;
a microprocessor, separate from said cryptographic processor, wherein said microprocessor is programmed to execute a data structure encryption routine to encrypt said first data structure and to execute subsequently a data structure decryption routine to decrypt an encrypted version of said first data structure, wherein said data structure encryption routine includes causing said cryptographic processor to read said first data structure from said computer readable medium, to execute said internal encryption routine, encrypting said data structure to form said encrypted version of said first data structure, and to write said encrypted version of said first data structure to nonvolatile storage, wherein said first data structure is additionally deleted from said first computer readable medium during execution of said data structure encryption subroutine, and wherein said data structure decryption subroutine includes causing said cryptographic processor to read said encrypted version of said first data structure from nonvolatile storage, to decrypt said encrypted version of said first data structure, forming said first data structure, and to write said first data structure to said computer readable medium, starting at said first location. - View Dependent Claims (20, 21, 22, 23, 24, 25)
-
Specification