Method and System for Intercepting Transactions for Encryption

• US 20070112677A1
• Filed: 11/09/2006
• Published: 05/17/2007
• Est. Priority Date: 11/11/2005
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Casey, John, Bruce, Timothy, Witt, Russell, Helsley, David, Ridner, Osvaldo
• Granted Patent: US 7,886,161 B2
• Time in Patent Office: Days
• US Class Current: 705/50
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00

Abstract

The present invention is directed to a method and system for intercepting transactions for encryption. In accordance with a particular embodiment of the present invention, an application for a storage device is monitored. A transaction for the storage device is intercepted. An encryption request within the transaction is identified. Performance of the transaction is emulated by performing the encryption request in a predetermined exit point of the application.

Claims

1. A method for intercepting transactions for encryption, comprising:

monitoring communication between an application and a storage device;

intercepting a transaction between the application and the storage device;

identifying an encryption request within the transaction; and

emulating performance of the transaction by performing the encryption request in a predetermined exit point defined by the application.

2. The method of claim 1, wherein the transaction is a write transaction, and wherein the encryption request is an encrypt data request.

3. The method of claim 1, wherein the transaction is a read transaction, and the encryption request is a decrypt data request.

4. The method of claim 1, further comprising allocating an encryption buffer space based on a caller buffer space allocated to the application.

5. The method of claim 4, wherein emulating performance of the transaction by performing the encryption request in a predetermined exit point defined by the application comprises decrypting data from the encryption buffer space into the caller buffer space.

6. The method of claim 4, wherein emulating performance of the transaction by performing the encryption request in a predetermined exit point defined by the application comprises encrypting data from the caller buffer space into the encrypted buffer space.

7. The method of claim 1, wherein identifying an encryption request within the transaction comprises accessing a unit control block (UCB), the UCB comprising a pointer to an I/O queue (IOQ), the IOQ comprising a pointer to an I/O supervisor block (IOSB) that points to one or more channel command words (CCW) that define the transaction.

8. A system for intercepting transactions for encryption, comprising:

a storage device; and

a processor, the processor operable to execute a program of instructions operable to;

monitor communication between an application and a storage device;

intercept a transaction between the application and the storage device;

identify an encryption request within the transaction; and

emulate performance of the transaction by performing the encryption request in a predetermined exit point defined by the application.

9. The system of claim 8, wherein the transaction is a write transaction, and wherein the encryption request is an encrypt data request.

10. The system of claim 8, wherein the transaction is a read transaction, and the encryption request is a decrypt data request.

11. The system of claim 8, wherein the program of instructions is further operable to allocate an encryption buffer space based on a caller buffer space allocated to the application.

12. The system of claim 11, wherein the program of instructions is further operable to decrypt data from the encryption buffer space into the caller buffer space.

13. The system of claim 11, wherein the program of instructions is further operable to encrypt data from the caller buffer space into the encrypted buffer space.

14. The system of claim 8, wherein the program of instructions is further operable to access a unit control block (UCB), the UCB comprising a pointer to an I/O queue (IOQ), the IOQ comprising a pointer to an I/O supervisor block (IOSB) that points to one or more channel command words (CCW) that define the transaction.

15. Logic encoded in media, the logic being operable, when executed on a processor, to:

monitor communication between an application and a storage device;

intercept a transaction between the application and the storage device;

identify an encryption request within the transaction; and

emulate performance of the transaction by performing the encryption request in a predetermined exit point defined by the application.

16. The logic of claim 15, wherein the transaction is a write transaction, and wherein the encryption request is an encrypt data request.

17. The logic of claim 15, wherein the transaction is a read transaction, and the encryption request is a decrypt data request.

18. The logic of claim 15, wherein the logic is further operable to allocate an encryption buffer space based on a caller buffer space allocated to the application.

19. The logic of claim 18, wherein the logic is further operable to decrypt data from the encryption buffer space into the caller buffer space.

20. The logic of claim 18, wherein the logic is further operable to encrypt data from the caller buffer space into the encrypted buffer space.

21. The logic of claim 15, wherein the logic is further operable to access a unit control block (UCB), the UCB comprising a pointer to an I/O queue (IOQ), the IOQ comprising a pointer to an I/O supervisor block (IOSB) that points to one or more channel command words (CCW) that define the transaction.