Method and apparatus for in-line serial data encryption

• US 20040054914A1
• Filed: 04/29/2003
• Published: 03/18/2004
• Est. Priority Date: 04/30/2002
• Status: Active Grant

• Current Assignee: General Dynamics Mission Systems Inc. (General Dynamics Corporation)
• Original Assignee: General Dynamics Advanced Information Systems Incorporated (General Dynamics Corporation)
• Inventors: Sullivan, Patrick L.
• Granted Patent: US 7,650,510 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06

Abstract

A method and apparatus for real-time in-line encryption of data transmitted over a serial channel from a source device to a target device. An encryption unit includes logic configured to receive data packets including headers with control information and data on the channel, which may be a fibre channel bus, serial ATA, serial SCSI, USB or the like. The encryption unit encrypts the data and passes the control information to the target device along with the encrypted data. The encryption unit may filter, convert or reject predetermined commands or types of information in the header to prevent covert channel transmissions. There may be one or multiple source devices, e.g. host computers, and one or multiple target devices, e.g. storage systems, configured in a variety of network topologies. The encryption unit also decrypts data and remaps control information transmitted from the target device(s) to the source device(s).

Claims

1. An encryption system, including:

an input connection configured to receive serial data and associated control information from a first device, an output connection configured to connect to a second device;

an encrypt module configured to encrypt the data bits and to leave the control information substantially unaltered;

a transmit module configured to transmit the encrypted data bits and the control information to the second device.

2. The encryption system of claim 1, wherein:

the first device includes a processor-based system; and

the second device includes a storage system.

3. The encryption system of claim 1, wherein the encrypt module is configured to encrypt the data in multiple data subsets of a predetermined size.

4. The encryption system of claim 3, wherein the predetermined size is variable.

5. The encryption system of claim 4, wherein the transmit module is further configured to transmit size information identifying the predetermined size to the second device.

6. An encryption system, including:

an input connection configured to receive bits of serial data and associated control information from a first device,

an output connection configured to connect to a second device;

an encrypt module configured to encrypt the data bits and to leave the control information substantially unaltered;

a control translation module configured to remove at least one command from the received control information and to replace the removed command with an equivalent command; and

a transmit module configured to transmit the encrypted data bits and the control information including the equivalent command to the second device.

7. The encryption system of claim 6, wherein the control translation module is further configured to reject at least one command that does not correspond to a predetermined set of allowed commands.

8. The encryption system of claim 6, wherein the control translation module is further configured to reject at least one command that corresponds to a predetermined set of disallowed commands.

9. A method of encrypting data that is sent from a first device via a serial bus and directed to a second device, including the steps of:

receiving the data along with associated control information;

encrypting at least a portion of the data; and

transmitting the encrypted data with the associated control information to the second device, where the associated control information is transmitted in an unencrypted form.

10. The method of claim 9, wherein the portion of data that is encrypted in the encrypting step has a predetermined size.

11. The method of claim 10, wherein the predetermined size is variable.

12. The method of claim 10, wherein the transmitting step further includes the step of transmitting information relating to the predetermined size to the second device.

13. A method of encrypting data that is sent from a first device via a serial bus and directed to a second device, including the steps of:

receiving the data along with associated control information;

encrypting at least a portion of the data;

determining an equivalent command for at least one received command associated with the control information;

replacing the received command with the equivalent command;

transmitting the encrypted data with the associated control information including the equivalent command to the second device, where the associated control information is transmitted in an unencrypted form.

14. The method of claim 13, further including the step of rejecting data associated with a command for which no equivalent is determined.

15. The method of claim 13, further including the step of rejecting data associated with a command that is determined to be one of a predetermined set of disallowed commands.

16. A data transmission system, including:

a computer having a serial communications port;

a serial bus coupled to the serial communications port;

a recipient device coupled to the serial bus; and

an encryption unit connected in-line to the serial bus between the computer and the recipient device, the encryption unit including an encrypt module configured to receive data and associated control information transmitted from the computer via the serial bus and to encrypt the data; and

a transmit unit configured to transmit the control information with the encrypted data to the recipient device.

17. The system of claim 16, wherein the recipient device includes a decryption module configured to decrypt the transmitted data.

18. The system of claim 16, wherein:

the encrypt module includes a command replacement module configured to replace at least one command associated with the control information with a predetermined equivalent command; and

the transmit unit is configured to block data associated with a command for which no predetermined equivalent command is located.

19. The system of claim 16, wherein:

the encrypt module includes a command replacement module configured to replace at least one command associated with the control information with a predetermined equivalent command; and

the transmit unit is configured to transmit only data associated with commands for which predetermined equivalent commands are located.

20. The system of claim 16, including a filtering unit configured to filter transmitted data based upon at least one predetermined criterion.

21. The system of claim 20, wherein the criterion includes detection of a disallowed form of data associated with the control information.

22. The system of claim 21, wherein the disallowed form of data includes an address pointer.

23. The system of claim 21, wherein the disallowed form of data includes at least one command associated with a predetermined type of attack.

24. The system of claim 16, wherein:

the encryption unit is further configured to receive recipient device data and associated control information transmitted from the recipient device via the serial bus and directed to the computer, and to encrypt the recipient device data; and

the transmit unit is further configured to transmit the encrypted recipient device data with its associated control information to the computer.

25. The system of claim 24, wherein the computer includes a decryption module configured to decrypt the encrypted recipient device data.