System and Method for General Purpose Encryption of Data

• US 20110225431A1
• Filed: 03/10/2010
• Published: 09/15/2011
• Est. Priority Date: 03/10/2010
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Kopp, Michele, Stufflebeam, Kenneth W. JR.
• Granted Patent: US 8,930,713 B2
• Time in Patent Office: Days
• US Class Current: 713/190
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Systems and methods for reducing problems and disadvantages associated with traditional approaches to encryption and decryption of data are provided. An information handling system may include a processor, a memory communicatively coupled to the processor, and an encryption accelerator communicatively coupled to the processor. The encryption accelerator may be configured to encrypt and decrypt information in accordance with a plurality of cryptographic functions, receive a command from the processor to perform an encryption or decryption task upon data associated with an input/output operation, and in response to receiving the command, encrypt or decrypt the data associated with the input/output operation based on a particular one of the plurality of cryptographic functions.

Claims

1. An information handling system, comprising:

a processor;

a memory communicatively coupled to the processor; and

an encryption accelerator communicatively coupled to the processor, the encryption accelerator configured to;

encrypt and decrypt information in accordance with a plurality of cryptographic functions;

receive a command from the processor to perform an encryption or decryption task upon data associated with an input/output operation; and

in response to receiving the command, encrypt or decrypt the data associated with the input/output operation based on a particular one of the plurality of cryptographic functions.

2. An information handling system according to claim 1, wherein the plurality of cryptographic functions includes at least one of an encryption algorithm, an algorithm mode, a cryptographic hash, and a sign function.

3. An information handling system according to claim 1, wherein the command further includes a designation of the particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task.

4. An information handling system according to claim 3, wherein the designation of the particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task is based on at least one of:

a user associated with the information handling system, a port to which a storage resource associated with the input/output operation is coupled, a type of storage resource associated with the input/output operation, a manufacturer of a storage resource associated with the input/output operation, a model of a storage resource associated with the input/output operation, a serial number of a storage resource associated with the input/output operation, a logical path of a storage resource associated with the input/output operation, and any other characteristic of a storage resource associated with the input/output operation.

5. An information handling system according to claim 1, the encryption accelerator further configured to:

load an encryption key in response to receiving the command; and

encrypt or decrypt the data associated with the input/output operation based on the encryption key.

6. An information handling system according to claim 5, further comprising a cryptoprocessor communicatively coupled to the processor and the encryption accelerator, the cryptoprocessor configured to unwrap the encryption key for use in connection with the encryption or decryption task.

7. An information handling system according to claim 6, wherein the cryptoprocessor comprises a Trusted Platform Module.

8. An information handling system according to claim 5, wherein the encryption key loaded is based on at least one of:

a user associated with the information handling system, a port to which a storage resource associated with the input/output operation is coupled, a type of storage resource associated with the input/output operation, a manufacturer of a storage resource associated with the input/output operation, a model of a storage resource associated with the input/output operation, a serial number of a storage resource associated with the input/output operation, a logical path of a storage resource associated with the input/output operation, and any other characteristic of a storage resource associated with the input/output operation.

9. A method for encryption and decryption of data, comprising:

receiving a command by an encryption accelerator to perform an encryption or decryption task upon data associated with an input/output operation, the command designating a particular one of a plurality of cryptographic functions stored on the encryption accelerator; and

in response to receiving the command, encrypting or decrypting the data associated with the input/output operation based on the particular one of the plurality of cryptographic functions.

10. A method according to claim 9, wherein the plurality of cryptographic functions includes at least one of an encryption algorithm, an algorithm mode, a cryptographic hash, and a sign function.

11. A method according to claim 9, wherein the designation of the particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task is based on at least one of:

a user associated with the information handling system, a port to which a storage resource associated with the input/output operation is coupled, a type of storage resource associated with the input/output operation, a manufacturer of a storage resource associated with the input/output operation, a model of a storage resource associated with the input/output operation, a serial number of a storage resource associated with the input/output operation, a logical path of a storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.

12. A method according to claim 9, further comprising:

loading an encryption key by the encryption accelerator in response to receiving the command; and

encrypting or decrypting the data associated with the input/output operation based on the encryption key.

13. A method according to claim 12, wherein the encryption key is unwrapped by a cryptoprocessor communicatively coupled to the encryption accelerator.

14. A method according to claim 13, wherein the encryption key loaded is based on at least one of:

a user associated with the information handling system, a port to which a storage resource associated with the input/output operation is coupled, a type of storage resource associated with the input/output operation, a manufacturer of a storage resource associated with the input/output operation, a model of a storage resource associated with the input/output operation, a serial number of a storage resource associated with the input/output operation, a logical path of a storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.

15. An encryption accelerator, comprising:

logic for encrypting and decrypting information in accordance with a plurality of cryptographic functions;

logic for receiving a command from the processor to perform an encryption or decryption task upon data associated with an input/output operation; and

logic for encrypting or decrypting the data associated with the input/output operation based on a particular one of the plurality of cryptographic functions in response to receiving the command.

16. An encryption accelerator according to claim 15, wherein the logic for encrypting and decrypting information in accordance with the plurality of cryptographic functions includes at least one of an encryption algorithm, an algorithm mode, a cryptographic hash, and a sign function.

17. An encryption accelerator according to claim 15, further comprising logic for receiving a designation of the particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task.

18. An encryption accelerator according to claim 17, wherein the designation of the particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task is based on at least one of:

a user associated with the information handling system, a port to which a storage resource associated with the input/output operation is coupled, a type of storage resource associated with the input/output operation, a manufacturer of a storage resource associated with the input/output operation, a model of a storage resource associated with the input/output operation, a serial number of a storage resource associated with the input/output operation, a logical path of a storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.

19. An encryption accelerator according to claim 15, further comprising:

logic for loading an encryption key in response to receiving the command; and

logic for encrypting or decrypting the data associated with the input/output operation based on the encryption key.

20. An encryption accelerator according to claim 19, wherein the encryption key loaded is based on at least one of:

a user associated with the information handling system, a port to which a storage resource associated with the input/output operation is coupled, a type of storage resource associated with the input/output operation, a manufacturer of a storage resource associated with the input/output operation, a model of a storage resource associated with the input/output operation, a serial number of a storage resource associated with the input/output operation, a logical path of a storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.