ENCRYPTION MANAGEMENT IN AN INFORMATION HANDLING SYSTEM

• US 20100146582A1
• Filed: 12/04/2008
• Published: 06/10/2010
• Est. Priority Date: 12/04/2008
• Status: Abandoned Application

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Kopp, Michele A., McCall, Don C., Stufflebeam, Kenneth Wade JR., Molsberry, Frank H., Konetski, David, Jaber, Muhammed
• Application Number:
  US12/328,213
• Publication Number:
  US 20100146582A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A method of enforcing an encryption policy in an information handling system for receiving a request for access to data, automatically identifying from a plurality of encryption policies a particular encryption policy associated with the requested data, selecting an available encryption implementation module capable of enforcing the identified encryption policy, and initiating an encryption or decryption of the requested data using the selected encryption implementation module.

Claims

1. A method of enforcing an encryption policy in an information handling system comprising steps of:

receiving a request for access to data;

automatically identifying from a plurality of encryption policies a particular encryption policy associated with the requested data;

selecting an available encryption implementation module capable of enforcing the identified encryption policy; and

initiating an encryption or decryption of the requested data using the selected encryption implementation module.

2. The method of claim 1 wherein selecting an available encryption implementation module comprises:

determining a performance characteristic of each of multiple available encryption implementation modules capable of enforcing the identified encryption policy; and

selecting an encryption implementation module based at least on a comparison of the determined performance characteristics.

3. The method of claim 1 wherein the encryption policy specifies an encryption algorithm and key source, the method further comprising:

accessing an encryption key from the key source specified by the policy for use by the selected encryption implementation module.

4. The method of claim 3 wherein the key source is located remote from the information handling system.

5. The method of claim 1 wherein:

each encryption policy specifies an encryption algorithm; and

the encryption algorithm specified by a first encryption policy is different from the encryption algorithm specified by a second encryption policy.

6. The method of claim 1 wherein the key source specified in a first encryption policy is different from the key source specified in a second encryption policy.

7. The method of claim 1 further comprising:

providing a user interface for setting one of the plurality of encryption policies by a user on a second information handling system; and

communicating this set encryption policy to the first information handling system.

8. Software embodied in tangible computer-readable media and, when executed by a processor, operable to:

receive a request for access to data;

automatically identify from a plurality of encryption policies a particular encryption policy associated with the requested data;

select an available encryption implementation module capable of enforcing the identified encryption policy; and

initiate an encryption or decryption of the requested data using the selected encryption implementation module.

9. The software of claim 8 wherein:

each of a plurality of encryption implementation modules provides a data interface; and

an abstraction layer provides a standardized interface to receive the request and initiate the encryption or decryption of the requested data independent of the data interface provided by the selected encryption implementation module.

10. The software of claim 8 wherein the encryption policy specifies an encryption algorithm and key source, the method further comprising:

accessing an encryption key from the key source specified by the policy for use by the selected encryption implementation module.

11. The software of claim 10 wherein the key source is located remote from the information handling system.

12. The software of claim 8 wherein:

each encryption policy specifies an encryption algorithm; and

the encryption algorithm specified by a first encryption policy is different from the encryption algorithm specified by a second encryption policy.

13. The software of claim 8 wherein the key source specified in a first encryption policy is different from the key source specified in a second encryption policy.

14. The software of claim 8 further operable to:

provide a user interface for setting one of the plurality of encryption policies by a user on a second information handling system; and

communicate this set encryption policy to the first information handling system.

15. An information handling system comprising:

a processor;

a memory coupled to the processor; and

a security policy enforcement subsystem enabled to;

receive a request for access to data;

automatically identify from a plurality of encryption policies a particular encryption policy associated with the requested data;

select an available encryption implementation module capable of enforcing the identified encryption policy; and

initiate an encryption or decryption of the requested data using the selected encryption implementation module.

16. The information handling system of claim 15 wherein the security policy enforcement system comprises:

a security policy manager; and

an encryption services module configured to provide services to the security policy manager and to discover and request services of the encryption implementation module.

17. The information handling system of claim 15 wherein the encryption policy specifies that the encryption implementation module utilize encryption specific hardware that protects the encryption key from unauthorized access.

18. The information handling system of claim 15 wherein the encryption policy specifies an encryption algorithm and key source, the security policy enforcement subsystem further enabled to:

access an encryption key from the key source specified by the policy for use by the selected encryption implementation module.

19. The information handling system of claim 18 wherein the key source is located remote from the information handling system.

20. The information handling system of claim 15 wherein:

each encryption policy specifies an encryption algorithm; and

the encryption algorithm specified by a first encryption policy is different from the encryption algorithm specified by a second encryption policy.