External encryption and recovery management with hardware encrypted storage devices

• US 8,341,430 B2
• Filed: 10/03/2008
• Issued: 12/25/2012
• Est. Priority Date: 10/03/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ureche, Octavian T., Brender, Scott A., Mehra, Karan, Wooten, David Rudolph
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): Traore, Fatoumata
• Application Number:
  US12/245,064
• Publication Number:
  US 20100088525A1
• Time in Patent Office: 1,544 Days
• Field of Search: None
• US Class Current: 713/193
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00

Abstract

Hardware encrypting storage devices can provide for hardware encryption of data being written to the storage media of such storage devices, and hardware decryption of data being read from that storage media. To utilize existing key management resources, which can be more flexible and accommodating, mechanisms for storing keys protected by the existing resources, but not the hardware encryption of the storage device, can be developed. Dedicated partitions that do not have corresponding encryption bands can be utilized to store keys in a non-hardware-encrypted manner. Likewise, partitions can be defined larger than their associated encryption bands, leaving room near the beginning and end for non-hardware encrypted storage. Or a separate bit can be used to individually specify which data should be hardware encrypted. Additionally automated processes can maintain synchronization between a partition table of the computing device and a band table of the hardware encrypting storage device.

Claims

1. One or more computer-readable storage media comprising computer-executable instructions for storing and retrieving keys from a hardware encrypting storage device, the computer-executable instructions directed to steps comprising:

creating at least a first partition and a second partition on the hardware encrypting storage device;

instructing the hardware encrypting storage device to implement at least a first encryption band corresponding to the second partition, the first encryption band covering all storage units associated with the second partition, the first encryption band being associated with a first key;

storing an encrypted key associated with the first key within a first set of one or more storage units associated with the first partition, the first partition corresponding to at least a global band, the global band being associated with no key;

monitoring a partition table comprising information regarding the at least the first partition and the second partition to detect a change of the second partition; and

instructing the hardware encrypting storage device to change the first encryption band if the second partition is changed, the instructed change of the first encryption band corresponding to the change of the second partition.

2. The computer-readable media of claim 1, wherein the computer-executable instructions directed to the creating the at least the first partition and the second partition are executed in response to a user request to create only one partition.

3. The computer-readable storage media of claim 1, comprising further computer-executable instructions directed to installing, on the hardware encrypting storage device, an operating system, the computer-executable instructions directed to installing the operating system comprising:

the computer-executable instructions directed to the creating the at least the first partition and the second partition to the hardware encrypting storage device; and

computer-executable instructions directed to reserving the first partition for use by the operating system.

4. The computer-readable storage media of claim 1, comprising further computer-executable instructions directed to instructing the hardware encrypting storage device to implement at least a second encryption band corresponding to the first partition, the second encryption band covering all storage units associated with the first partition, the second encryption band being associated with no key.

5. The computer-readable storage media of claim 1, comprising further computer-executable instructions directed to storing a redundant encrypted key associated with the first key within a second set of one or more storage units associated with the first partition, the second set of one or more storage units being disparate from the first set of one or more storage units.

6. The computer-readable storage media of claim 1, wherein the computer-executable instructions directed to the creating at least the first partition and the second partition comprise further computer-executable instructions directed to creating at least a third partition, the computer-readable media further comprising computer-executable instructions directed to:

instructing the hardware encrypting storage device to implement at least a second encryption band corresponding to the third partition, the second encryption band covering all storage units associated with the third partition, the second encryption band being associated with a second key; and

storing a second encrypted key associated with the second key within a second set of one or more storage units associated with the first partition.

7. The computer-readable storage media of claim 1, wherein the encrypted key was encrypted by a trusted platform module associated with a computing device to which the hardware encrypting storage device is communicationally coupled.

8. The computer-readable storage media of claim 1, comprising further computer-executable instructions directed to:

receiving a request to change the second partition on the hardware encrypting storage device; and

changing the second partitions on the hardware encrypting storage device in accordance with the request;

wherein the instructing the hardware encrypting storage device to change the first encryption band is performed in response to the receiving the request and the changing the second partition.

9. One or more computer-readable storage media comprising computer-executable instructions for storing and retrieving keys from a hardware encrypting storage device, the computer-executable instructions directed to steps comprising:

creating at least one partition on the hardware encrypting storage device, the at least one partition encompassing all storage units from a first storage unit to a second storage unit;

instructing the hardware encrypting storage device to implement at least one encryption band associated with a key and corresponding to the at least one partition, the at least one encryption band encompassing all storage units from a third storage unit to a fourth storage unit, wherein the third and fourth storage units are between the first and second storage units such that storage units between the first and third storage units are part of the at least one partition, but are not part of the at least one encryption band corresponding to the at least one partition and such that storage units between the fourth and second storage units are also part of the at least one partition, but are also not part of the at least one encryption band corresponding to the at least one partition;

providing, to other computer-executable instructions, access to only a portion of the at least one partition, the portion encompassing all storage units from the third storage unit to the fourth storage unit; and

storing an encrypted key associated with the key either in a first key storage area between the first storage unit and the third storage unit or in a second key storage area between the fourth storage unit and the second storage unit, wherein both the first key storage area and the second key storage area correspond to at least a global band, the global band being associated with no key.

10. The computer-readable storage media of claim 9, comprising further computer-executable instructions directed to storing a redundant encrypted key associated with the key in an other of the first key storage area or the second key storage area.

11. The computer-readable storage media of claim 9, comprising further computer-executable instructions directed to intercepting a read or write command;

and offsetting the intercepted read or write command by an amount of storage units equivalent to a difference between the first storage unit and the third storage unit.

12. The computer-readable storage media of claim 9, comprising further computer-executable instructions directed to:

detecting changes in a partition table comprising information regarding the at least one partition; and

instructing the hardware encrypting storage device to correspondingly change information in a band table comprising information regarding the at least one encryption band.

13. The computer-readable storage media of claim 9, wherein the encrypted key was encrypted by a trusted platform module associated with a computing device to which the hardware encrypting storage device is communicationally coupled.

14. A hardware encrypting storage device comprising:

one or more storage media comprising storage units; and

one or more cryptographic processors for performing steps comprising;

receiving provided information to be stored in one or more storage units of the one or more storage media, together with a first encryption flag indicating whether the provided information is to be stored in an encrypted or unencrypted manner;

storing the provided information, unencrypted in the one or more storage units if the first encryption flag received with the provided information indicated that the provided information was to be stored in the unencrypted manner, even if at least some of the one or more storage units are pan of a first encryption band specifying that information stored in storage units encompassed by the first encryption band is to be encrypted by the one or more cryptographic processors prior to storage on the storage media;

receiving a request for specified information to be read from one or more storage units of the one or more storage media, together with a second encryption flag indicating whether the spec information, as read from the one or more storage units, is to be decrypted or not decrypted; and

providing the specified information, as read from the one or more storage units, and not decrypt if the second encryption flag received with the request indicated that the specified information was to be provided not decrypted, even if at least some of the one or more storage units are part of a second encryption band specifying that information read from storage units encompassed by the second encryption band is to be decrypted one or more cryptographic processors prior to provision.

15. The hardware encrypting storage device of claim 14, wherein the provided information comprises an encrypted version of at least one key that is associated with the first encryption band.

16. The hardware encrypting storage device of claim 14, further comprising a band table, the band table identifying the first encryption band and at least one key associated with the first encryption band.

17. The hardware encrypting storage device of claim 16, wherein the one or more storage media is partitioned into at least one partition, and wherein further the first encryption band corresponds to the at least one partition and encompasses all of the storage units of the one or more storage media that are encompassed by the at least one partition.

18. The hardware encrypting storage device of claim 16, wherein the band table is maintained in parity to a partition table maintained by a computing device to which the hardware encrypting storage device is communicationally coupled.

19. The hardware encrypting storage device of claim 14, wherein the first encryption band is the second encryption band.