Method of Accessing a Data Storage Device

• US 20120008771A1
• Filed: 01/23/2009
• Published: 01/12/2012
• Est. Priority Date: 01/23/2009
• Status: Active Grant

• Current Assignee: Agency For Science Technology and Research (Government of Singapore)
• Original Assignee: Agency For Science Technology and Research (Government of Singapore)
• Inventors: Law, Sie Yong, Lu, Hai Xin, Khin, Mi Mi Aung
• Granted Patent: US 9,147,087 B2
• Time in Patent Office: Days
• US Class Current: 380/46
• CPC Class Codes: G06F 21/805 using a security table for the storage sub-system
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method of accessing a data storage device, the method including: transforming a first key to obtain a second key; assigning the second key to a logical unit of data of the data storage device; and using the second key to read data from the data storage device or to write data to the data storage device.

Claims

1. A method of accessing a data storage device, the method comprising:

transforming a first key to obtain a second key;

assigning the second key to a logical unit of data of the data storage device; and

using the second key to read data from the data storage device or to write data to the data storage device.

2. The method of claim 1, wherein the first key is a time-based key so that replacement of the first key is carried out after a predefined time interval.

3. The method of claim 1, wherein before transformation of the first key, the first key is generated using a true random number generator.

4. The method of claim 1, further comprising:

transforming a third key to obtain a fourth key;

assigning the fourth key to the logical unit of data of the data storage device, wherein the fourth key is used to encrypt and decrypt the data from the data storage device and wherein the third key is a cryptographic key.

5. The method of claim 4, wherein the data encryption and the data decryption occur outside the data storage device.

7. The method of claim 4, wherein the data encryption and the data decryption occur inside the data storage device, and wherein the data read from the data storage device is unencrypted and the data written to the data storage device is unencrypted.

8. The method of claim 1, wherein a single directional transformation is used to transform the first key to obtain the second key.

9. The method of claim 4, wherein a single directional transformation is used to transform the third key to obtain the fourth key.

10. The method of claim 1, wherein hashing is used to transform the first key to obtain the second key.

11. The method of claim 2, wherein hashing is used to transform the time-based first key to obtain a hashed time-based key.

12. The method of claim 4, wherein hashing is used to transform the third key to obtain the fourth key so that the fourth key is a hashed cryptographic key.

6. (canceled)

13-14. -14. (canceled)

15. A system for accessing stored data, the system comprising:

a data storage module;

a transformation module that transforms a first key to obtain a second key;

an assignment module that assigns the second key to a logical unit of data of the data storage module; and

a data access module that uses the second key to read data from the data storage module or to write data to the data storage module.

16. The system of claim 15, wherein the assignment module is adapted to replace the first key after a predefined time interval.

17. The system of claim 15, further comprising a key generator module to generate the first key.

18. The system of claim 15, further comprising:

an encryption module; and

a decryption module, wherein the transformation module is further adapted to transform a third key to obtain a fourth key;

and the assignment module is further adapted to assign the fourth key to the logical unit of data of the data storage module, wherein the fourth key is used by both the encryption module and the decryption module to encrypt and decrypt the data from the data storage module and wherein the third key is a cryptographic key.

22. The system of claim 15, wherein the transformation module uses a single directional transformation to transform the first key to obtain the second key.

23. The system of claim 18, wherein the transformation module uses a single directional transformation to transform the third key to obtain the fourth key.

24. The system of claim 15, wherein the transformation module uses hashing to transform the first key to obtain the second key and wherein the transformation module uses hashing to transform the third key to obtain the fourth key so that the fourth key is a hashed cryptographic key.

25. The system of claim 16, wherein the transformation module uses hashing to transform the time-based first key to obtain a hashed time-based first key.

28. The system of claim 18, further comprising a storage module for storing the second key and the fourth key.

19-21. -21. (canceled)

26-27. -27. (canceled)

29. (canceled)