Data security for digital data storage

• US 7,861,094 B2
• Filed: 08/11/2006
• Issued: 12/28/2010
• Est. Priority Date: 03/26/1999
• Status: Expired due to Fees

• Current Assignee: Round Rock Research LLC
• Original Assignee: Round Rock Research LLC
• Inventors: Klein, Dean A.
• Primary Examiner(s): Pich; Ponnoreay
• Application Number:
  US11/503,101
• Publication Number:
  US 20070067647A1
• Time in Patent Office: 1,600 Days
• Field of Search: 713/189, 713/193
• US Class Current: 713/189
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

A computing system includes data encryption in the data path between a data source and data storage devices. The data encryption may utilize a key which is derived at least in part from an identification code stored in a non-volatile memory. The key may also be derived at least in part from user input to the computer.

Claims

1. In a personal computer having encryption hardware and a processor, a method of storing data on data storage media comprising:

retrieving information from a bus-to-bus bridge in the personal computer, the information identifying which data storage media are selected to receive encrypted data;

enabling the encryption of data to be routed to one of the data storage media in response to the retrieved information;

encrypting or decrypting data based on the enabling step, for storage on and retrieval from the data storage media; and

storing the data in the data storage media in encrypted form if the encryption of data is enabled by the enabling step.

2. The method of claim 1, wherein encrypting data for storage is performed on an encrypting device that is positioned in a data path between a central processing unit and the data storage media.

3. The method of claim 2, wherein the bus-to-bus bridge comprises the encryption device.

4. The method of claim 1, further comprising generating a cryptographic key for use in encrypting the data.

5. The method of claim 4, further comprising retrieving an identification code.

6. The method of claim 5, wherein the step of retrieving the identification code is performed without intervention by a host processor.

7. The method of claim 4, wherein the cryptographic key is based at least in part on an identification code stored in the personal computer.

8. The method of claim 7, where the cryptographic key is based at least in part on user input.

9. The method of claim 4, further comprising verifying the generated cryptographic key, wherein verifying comprises determining a checksum of the generated key.

10. The method of claim 9, wherein the verifying occurs without intervention by a host processor.

11. In a computing apparatus having encryption hardware and a processor, a method of storing data on data storage media comprising:

retrieving information from a bus-to-bus apparatus in the computing apparatus, the information identifying which data storage media are selected to store encrypted data;

enabling the encryption and/or decryption of data to be routed to one of the data storage media in response to the retrieved information;

encrypting and/or decrypting data based on the enabling step, for storage on and retrieval from, the data storage media; and

storing the data in the data storage media in an encrypted form.

12. The method of claim 11, wherein encrypting data for storage is performed on an encrypting device that is positioned in a data path between a central processing unit and the data storage media.

13. The method of claim 12, wherein the bus-to-bus apparatus comprises a bridge, said bridge comprising the encryption device.

14. The method of claim 11, further comprising generating a cryptographic key for use in encrypting the data.

15. The method of claim 14, further comprising retrieving an identification code.

16. The method of claim 15, wherein the step of retrieving the identification code is performed without intervention by a host processor.

17. The method of claim 14, wherein the cryptographic key is based at least in part on an identification code stored in the computing apparatus.

18. The method of claim 17, where the cryptographic key is based at least in part on user input.

19. The method of claim 14, further comprising verifying the generated cryptographic key, wherein said verifying comprises determining a checksum of the generated key.

20. The method of claim 19, wherein the verifying occurs without intervention by a host processor.

21. In a computing apparatus having encryption hardware and a host processor, a method of storing data on data storage media comprising:

retrieving information from an intermediary device in the computing apparatus, the information identifying which data storage media are selected to store encrypted data;

enabling the encryption and/or decryption of data to be routed to one of the data storage media in response to the retrieved information;

encrypting and/or decrypting data based on the enabling step, for storage on and retrieval from, the data storage media; and

storing the data in the data storage media in an encrypted form;

wherein the intermediary device is disposed in a signal path between the host processor and the data storage media.

22. The method of claim 21, wherein the retrieved information serves, at least in part, to configure the encryption/decryption logic.

23. The method of claim 22, wherein the retrieved information serves, at least in part, to generate a substantially device-specific encryption process.

24. The method of claim 22, wherein the step of encrypting and/or decrypting is substantially automatic and transparent to a user.

25. The method of claim 22, where the intermediary device comprises a bus-to-bus bridge coupled to a host bus and a data storage bus.