Recovery of encrypted data from a secure storage device

• US 20070101434A1
• Filed: 09/19/2006
• Published: 05/03/2007
• Est. Priority Date: 07/14/2005
• Status: Active Grant

• Current Assignee: Data Locker Incorporated
• Original Assignee: Ironkey Incorporated (Proofpoint Incorporated)
• Inventors: Jevans, David
• Granted Patent: US 8,438,647 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

An exemplary software product to recover encrypted data from a target secure storage device can comprise software operational when executed by a processor to receive a recovery request to recovery the encrypted data, send a transfer command to the target secure storage device, receive an authorization request from the target secure storage device in response to the transfer command, respond to the authorization request, and receive the encrypted data from the target secure storage device.

Claims

1. An encrypted data recovery software product to recover the encrypted data from a target secure storage device, the software product comprising:

software operational when executed by a processor to receive a recovery request to recover the encrypted data;

send a transfer command to the target secure storage device;

receive an authorization request from the target secure storage device in response to the transfer command;

respond to the authorization request; and

receive the encrypted data from the target secure storage device.

2. The software product of claim 1, wherein the software product is further operational when executed by the processor to

retrieve an encryption key from an authorized secure storage device;

and

decrypt the encrypted data with, at least in part, the encryption key.

3. The software product of claim 1, wherein the software product is further operational when executed by the processor to

retrieve a plurality of encryption keys from a plurality of authorized secure storage devices;

unlock a decryption key with the plurality of encryption keys; and

decrypt the encrypted data with the decryption key.

4. The software product of claim 1, wherein the transfer command is digitally signed.

5. The software product of claim 1, wherein respond to the authorization request comprises the software product further operational when executed by the processor to

digitally sign at least a part of an authorization request response with an encryption key;

and

send the digitally signed authorization request response to the target secure storage device.

6. The software product of claim 1, wherein respond to the authorization request comprises software operational when executed by the processor to

decrypt at least a part of the authorization request with an encryption key from an authorized secure storage device;

and

send the encrypted authorization request to the target secure storage device.

7. The software product of claim 1, wherein the encrypted data is stored within a single data partition within the target secure storage device.

8. The software product of claim 1, wherein the encrypted data from the target secure storage device is from at least one data partition within the target secure storage device and the at least one data partition is determined by the response to the authorization request.

9. The software product of claim 1, wherein the software product is further operational when executed by the processor to transmit an authentication identifier to the target secure storage device.

10. The software product of claim 2, wherein the authentication identifier is a password.

11. The software product of claim 2, wherein the authentication identifier is a biometric identifier.

12. The software product of claim 1, wherein the software product is further operational when executed by the processor to store a verification encryption key within the target secure storage device.

13. The software product of claim 12, wherein the verification encryption key can verify the transfer request.

14. The software product of claim 12, wherein the verification encryption key can verify an authorization request response.

15. The software product of claim 1, wherein the software product is further operational when executed by the processor to store an encrypted decryption key within the target secure storage device.

16. The software product of claim 15, wherein the encrypted decryption key may be decrypted by one or more public encryption keys.

19. The method of claim 9, further comprising:

retrieving a plurality of encryption keys from a plurality of authorized secure storage devices;

unlocking a decryption key with the plurality of encryption keys; and

decrypting the encrypted data with the decryption key.

23. The method of claim 9, wherein the encrypted data is stored within a single data partition within the target secure storage device.

17. A method to recover encrypted data from a target secure storage device, the method comprising:

receiving a recovery request to recover the encrypted data;

sending a transfer command to the target secure storage device;

receiving an authorization request from the target secure storage device in response to the transfer command;

responding to the authorization request; and

receiving the encrypted data from the target secure storage device.

18. The method of claim 17, further comprising:

retrieving an encryption key from an authorized secure storage device; and

decrypting the encrypted data with, at least in part, the encryption key.

20. The method of claim 17, wherein the transfer command is digitally signed.

21. The method of claim 17, wherein responding to the authorization request comprises:

digitally signing at least a part of an authorization request response with an encryption key from an authorized secure storage device; and

sending the digitally signed authorization request response to the target secure storage device.

22. The method of claim 17, wherein responding to the authorization request comprises:

decrypting at least a part of the authorization request with an encryption key from an authorized secure storage device; and

sending the encrypted authorization request to the target secure storage device.

24. The method of claim 17, wherein the encrypted data from the target secure storage device is from at least one data partition within the target secure storage device and the at least one data partition is determined by the response to the authorization request.

25. The method of claim 17, further comprising transmitting an authentication identifier to the target secure storage device.

26. The method of claim 25, wherein the authentication identifier is a password.

27. The method of claim 25, wherein the authentication identifier is a biometric identifier.

28. The method of claim 17, further comprising storing a verification encryption key on the target secure storage device.

29. The method of claim 28, wherein the verification encryption key can verify the transfer request.

30. The method of claim 28, wherein the verification encryption key can verify an authorization request response.

31. The method of claim 17, further comprising storing an encrypted decryption key within the target secure storage deceive.

32. The method of claim 31, wherein the encrypted decryption key may be decrypted by one or more public encryption keys.

33. A system to recover encrypted data from a target secure storage device, the system comprising:

an interface configured to couple with the target secure storage device; and

a processor configured to

receive a recovery request to recover the encrypted data;

send a transfer command to the target secure storage device;

receive an authorization request from the target secure storage device in response to the transfer command;

respond to the authorization request; and

receive the encrypted data from the target secure storage device.

34. The system of claim 33, wherein the processor is further configured to

retrieve an encryption key from an authorized secure storage device;

and

decrypt the encrypted data with, at least in part, the encryption key.

35. The system of claim 33, wherein the processor is further configured to

retrieve a plurality of encryption keys from a plurality of authorized secure storage devices;

unlock a decryption key with the plurality of encryption keys; and

decrypt the encrypted data with the decryption key.