METHOD, SYSTEM AND PROGRAM PRODUCT FOR SECURING DATA WRITTEN TO A STORAGE DEVICE COUPLED TO A COMPUTER SYSTEM

• US 20100037063A1
• Filed: 08/11/2008
• Published: 02/11/2010
• Est. Priority Date: 08/11/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Grenchus, Edward J. JR., Kolosna, David P., Pryor, Robert F., Chontos, John D.
• Granted Patent: US 9,177,488 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method, system and program product for securing data written to a storage device coupled to a computer system. The method includes providing a detachable data security key device for controlling access to data written to a storage within a computer system and attaching the security key device to the computer system for enabling access to the data written to the storage. Further, the method includes detaching the security key device from the computer system for disabling access to the data written to the storage, wherein removal of the security key device from the computer system renders the data written to the storage unreadable. In an embodiment, the security key device includes an encryption key module coupled to the security key device for encrypting the data written to the storage and includes a decryption key module coupled to the security key device for decrypting the data written to the storage.

Claims

1. A method for securing data written to a computer system, said method comprising the steps of:

providing a first detachable data security key device for controlling access to data written to a storage within a computer system;

attaching said first detachable data security key device to said computer system for enabling access to said data written to said storage within said computer system; and

detaching said first detachable data security key device from said computer system for disabling access to said data written to said storage within said computer system, wherein removal of said first detachable data security key device from said computer system renders said data written to said storage unreadable.

2. A method according to claim 1, wherein said providing step further comprises the step of:

providing a first encryption key module coupled to said first detachable data security key device for encrypting said data written to said storage within said computer system and providing a first decryption key module coupled to said first detachable data security key device for decrypting said data written to said storage within said computer system.

3. A method according to claim 2, wherein said attaching step further comprises the step of:

utilizing a unique symmetric encryption key provisioned in said first encryption key module coupled to said first detachable data security key device for encrypting said data written to said storage within said computer system.

4. A method according to claim 3, wherein said attaching step further comprises the step of:

utilizing a unique symmetric decryption key provisioned in said decryption key module coupled to said first detachable data security key device for decrypting said data written to said storage within said computer system.

5. A method according to claim 4, further comprising the step of:

replacing said first detachable data security key device with a second detachable data security key device, wherein a new unique symmetric encryption key is provided by said second detachable data security key device for writing new data to said computer system, and wherein a new unique symmetric decryption key is provided by said second detachable data security key device for decrypting said new data written to said storage, and wherein said data written with said first detachable data security key device to said storage within said computer system is not accessible with said second detachable data security key device.

6. A method according to claim 5, wherein said storage within said computer system comprises at least one of:

a hard drive, a hard drive controller card, a computer mother board and a solid state drive.

7. A computer system for securing data stored therein, said computer system comprising:

a central processing unit;

first program instructions to identify a first detachable data control device provided for controlling access to data written to a storage within said computer system;

second program instructions to couple said first detachable data control device to said computer system for enabling access to said data written to said storage within said computer system; and

third program instructions to decouple said first detachable data control device from said computer system for disabling access to said data written to said storage within said computer system, wherein removal of said first detachable data control device from said computer system renders said data written to said storage within said computer system unreadable, and wherein said first, second and third program instructions are stored in said computer system for execution by said central processing unit.

8. The computer system according to claim 7, further comprising:

fourth program instructions to replace said first detachable data control device in said computer system with a second detachable data control device for writing new data to said computer system, wherein said data written with said first detachable data control device to said storage within said computer system is rendered unreadable without said first detachable data control device, and wherein said fourth program instructions are stored in said computer system for execution by said central processing unit.

9. The computer system according to claim 8, wherein said first program instructions include instructions to provide a first encryption key module coupled to said first detachable data control device for encrypting said data written to said storage within said computer system.

10. The computer system according to claim 9, wherein said first program instructions include instructions to provide a first decryption key module coupled to said first detachable data control device for decrypting said data written to said storage within said computer system.

11. The computer system according to claim 10, wherein said second program instructions include instructions to utilize a unique symmetric encryption key provisioned in said first data encryption module of said first detachable data control device for encrypting said data written to said storage within said computer system.

12. The computer system according to claim 11, wherein said second program instructions include instructions to utilize a unique symmetric decryption key provisioned in said first data decryption module of said first detachable data control device for decrypting said data written to said storage within said computer system.

13. The computer system according to claim 12, wherein said storage within said computer system comprises at least one of:

a hard drive, a hard drive controller card, a computer mother board and a solid state drive.

14. A computer program product for securing data written to a computer system, said computer program product comprising:

a computer readable medium;

first program instructions to identify a first removable data security device for controlling access to data written to a storage within a computer system;

second program instructions to couple said first removable data security device to said computer system for enabling access to said data written to said storage within said computer system; and

third program instructions to decouple said first removable data security device from said computer system for disabling access to said data written to said storage within said computer system, wherein removal of said first removable data security device from said computer system renders said data written to said storage unreadable, and wherein said first, second and third program instructions are recorded on said computer readable medium.

15. The computer program product according to claim 14, further comprising:

fourth program instructions to replace said first removable data security device coupled to said computer system with a second removable data security device for writing new data to said computer system, wherein said data written to said storage within said computer system is rendered unreadable without said first removable data security device, and wherein said fourth program instructions are recorded on said computer readable medium.

16. The computer program product according to claim 15, wherein said first program instructions include instructions to provide a first encryption module within said first removable data security device for encrypting said data written to said storage within said computer system.

17. The computer program product according to claim 16, wherein said first program instructions include instructions to provide a first decryption module within said first removable data security device for decrypting said data written to said storage within said computer system.

18. The computer program product according to claim 17, wherein said second program instructions include instructions to utilize a unique symmetric encryption key provisioned in said first data encryption module of said first removable data security device for encrypting said data written to said storage within said computer system.

19. The computer program product according to claim 18, wherein said second program instructions include instructions to utilize a unique symmetric decryption key provisioned in said first data decryption module of said first removable data security device for decrypting said data written to said storage within said computer system.

20. The computer program product according to claim 19, wherein said storage within said computer system comprises at least one of:

a hard drive, a hard drive controller card, a computer mother board and a solid state drive.