System and method for transparent disk encryption

• US 8,347,115 B2
• Filed: 12/27/2007
• Issued: 01/01/2013
• Est. Priority Date: 08/07/2002
• Status: Active Grant

• Current Assignee: NVIDIA Corporation
• Original Assignee: NVIDIA Corporation
• Inventors: Danilak, Radoslav
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): WILLIAMS, JEFFERY L
• Application Number:
  US12/005,913
• Publication Number:
  US 20080133939A1
• Time in Patent Office: 1,832 Days
• Field of Search: None
• US Class Current: 713/193
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories

Abstract

A data storage system providing transparent encryption. The data storage system has a hardware encryption/decryption engine and a register coupled to the hardware encryption/decryption engine. The register is for securely storing a key for encrypting and decrypting data. The key may not be read from outside the data storage system. More specifically, the key may not be read by the operating system. The user does not have access to the encryption key, but may have a password that is passed to a controller coupled to the encryption/decryption engine. The controller verifies the password and causes data received from main memory to be encrypted by the hardware encryption/decryption engine using the key. The controller also transfers the encrypted data to the data storage device.

Claims

1. A computing device comprising:

a main memory for storing a basic input/output system (BIOS);

a processor, communicatively coupled to said main memory, for executing said basic input/output system (BIOS) and an operating system (OS); and

a data storage system, communicatively coupled to said processor and said main memory, including;

a data storage medium storing encrypted data including said operating system (OS);

a controller for receiving a request from said basic input/output system (BIOS) to load at least a portion of said operating system (OS) into said main memory;

said controller for unlocking a key;

a counter mode (CTR) advanced encryption standard (AES) encryption/decryption engine for decrypting at a hardware level a given portion of said encrypted data using said key and counter mode (CTR) of advanced encryption standard (AES) based on a block number and a byte aligned block address of said given portion of said encrypted data passed through a transform function; and

said controller for transferring said given portion of said decrypted data to main memory.

2. The computing device of claim 1, wherein said data storage system comprises:

a register for securely storing said key; and

said encryption/decryption engine, communicatively coupled to said data storage medium and said register, for encrypting said data transferred to said data storage medium and decrypting said data transferred from said data storage medium using said key.

3. The computing device of claim 1, wherein said controller for unlocking said key comprises:

said controller for receiving a password associated with said request;

said controller for receiving an encrypted key from said register; and

said controller for causing the encryption/decryption engine to decrypting said key using said password.

4. The computing device of claim 3, wherein said basic input/output system (BIOS) executed by said processor prompts a user for said password.

5. The computing device of claim 1, wherein said key is a random number generated by said data storage system.

6. The computing device of claim 1, wherein said key cannot be accessed outside of said data storage system.

7. A data storage system comprising:

a means for storing encrypted data including said operating system (OS);

a means for receiving a request from said basic input/output system (BIOS) to load at least a portion of said operating system (OS) into said main memory;

a means for unlocking a key;

a means for advanced encryption standard (AES) counter mode (CTR) decrypting, at a hardware level, a given portion of said encrypted data using said key, and a block number and a byte aligned address of said given portion of said encrypted data in said means for storing passed through a transform function; and

a means for transferring said given portion of said decrypted data to main memory.

8. The data storage system of claim 7, wherein said means for unlocking said key comprises:

a means for receiving a password associated with said request;

a means for receiving an encrypted key from said register; and

a means for decrypting said key using said password.

9. The data storage system of claim 7, further comprising:

a means for generating said key from a random number;

a means for encrypting said key to lock said key; and

a means for storing said locked key so that said key cannot be accessed outside of said data storage system.