SECURE ARCHIVE

• US 20100275039A1
• Filed: 01/16/2008
• Published: 10/28/2010
• Est. Priority Date: 01/16/2007
• Status: Active Grant

• Current Assignee: Waterfall Security Solutions Ltd.
• Original Assignee: Waterfall Security Solutions Ltd.
• Inventors: Frenkel, Lior, Zilberstein, Amir
• Granted Patent: US 8,756,436 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up

Abstract

Storage apparatus (20) includes a memory (30) and an encryption processor (28), which is configured to receive and encrypt data transmitted from one or more computers (24) for storage in the memory. A one-way link (32) couples the encryption processor to the memory so as to enable the encryption processor to write the encrypted data to the memory but not to read from the memory.

Claims

1. Storage apparatus, comprising:

a memory;

an encryption processor, which is configured to receive and encrypt data transmitted from one or more computers for storage in the memory; and

a one-way link, coupling the encryption processor to the memory so as to enable the encryption processor to write the encrypted data to the memory but not to read from the memory.

2. The apparatus according to claim 1, wherein the encryption processor is configured to encrypt the data using an encryption key that is not available to the one or more computers.

3. The apparatus according to claim 2, wherein for each transmission of the data from the one or more computers, the encryption processor is configured to select the encryption key from among a plurality of possible encryption keys, and to convey an indication of the selected encryption key to the memory in addition to the encrypted data.

4. The apparatus according to claim 1, wherein the memory is configured to store the encrypted data without decryption prior to storage.

5. The apparatus according to claim 1, wherein the encryption processor is configured to receive the data from the one or more computers over a network.

6. The apparatus according to claim 1, wherein the encryption processor is configured to apply a time stamp to each of at least some items of the data that are written to the memory.

7. The apparatus according to claim 1, and comprising:

a monitoring processor, which is coupled to the memory so as to generate an indication of a status of the data stored in the memory; and

a further one-way link, coupling the monitoring processor to at least one of the computers so as to enable the monitoring processor to convey the indication of the status to the at least one of the computers but not to receive inputs from the one or more computers.

8. A method for data storage, comprising:

receiving data transmitted from one or more computers for storage in a memory;

encrypting the received data using an encryption processor before passing the data to the memory;

conveying the encrypted data from the encryption processor to the memory over a one-way link, which permits the encryption processor to write the encrypted data to the memory but not to read from the memory; and

storing the encrypted data in the memory.

9. The method according to claim 8, wherein encrypting the received data comprises encrypting the data using an encryption key that is not available to the one or more computers.

10. The method according to claim 9, wherein encrypting the data comprises, for each transmission of the data from the one or more computers, selecting the encryption key from among a plurality of possible encryption keys, and conveying an indication of the selected encryption key to the memory in addition to the encrypted data.

11. The method according to claim 8, wherein storing the encrypted data comprises writing the encrypted data to the memory without decryption prior to storage.

12. The method according to claim 8, wherein receiving the data comprises receiving the data from the one or more computers over a network.

13. The method according to claim 8, and comprising applying a time stamp to each of at least some items of the data that are written to the memory.

14. The method according to claim 8, and comprising:

generating an indication of a status of the data stored in the memory using a monitoring processor coupled to the memory; and

conveying the indication from the monitoring processor to at least one of the computers via a further one-way link, which permits the monitoring processor so to convey the indication of the status to the at least one of the computers but not to receive inputs from the one or more computers.