System and method for transparent disk encryption

• US 8,392,727 B2
• Filed: 12/27/2007
• Issued: 03/05/2013
• Est. Priority Date: 08/07/2002
• Status: Active Grant

• Current Assignee: NVIDIA Corporation
• Original Assignee: NVIDIA Corporation
• Inventors: Danilak, Radoslav
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): WILLIAMS, JEFFERY L
• Application Number:
  US12/005,857
• Publication Number:
  US 20080130901A1
• Time in Patent Office: 1,895 Days
• Field of Search: None
• US Class Current: 713/193
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories

Abstract

A data storage system providing transparent encryption. The data storage system has a hardware encryption/decryption engine and a register coupled to the hardware encryption/decryption engine. The register is for securely storing a key for encrypting and decrypting data. The key may not be read from outside the data storage system. More specifically, the key may not be read by the operating system. The user does not have access to the encryption key, but may have a password that is passed to a controller coupled to the encryption/decryption engine. The controller verifies the password and causes data received from main memory to be encrypted by the hardware encryption/decryption engine using the key. The controller also transfers the encrypted data to the data storage device.

Claims

1. A graphics card comprising:

a plurality of registers, wherein each register stores a respective one of a plurality of keys that are not available unencrypted outside a controller and an encryption/decryption engine;

said controller for receiving a request to make available at least a portion of an operating system (OS), receiving a given one of said plurality of keys, transferring at least said portion of said operating system (OS) in an encrypted format from a data storage medium to said encryption/decryption engine, transferring said given one of said plurality of keys to said encryption/decryption engine, and making available said operating system (OS) in a decrypted format; and

said encryption/decryption engine for decrypting at a hardware level at least said portion of said operating system (OS) in said encrypted format using said given one of said plurality of keys and counter mode (CTR) of advanced encryption standard (AES) based on a block number and a byte aligned block address of said portion of said operating system in said encrypted format in said data storage medium passed through a transform function.

2. The graphics card of claim 1, wherein each of said registers stores said respective one of said plurality of keys in an encrypted format.

3. The graphics card of claim 2, wherein one of said plurality of keys is encrypted using a password of an administrator.

4. The graphics card of claim 1, wherein said controller is further for verifying a password received with said request.

5. The graphics card of claim 4, wherein said encryption/decryption engine uses said password to decrypt a corresponding one of said plurality of keys.

6. The graphics card of claim 1, wherein said encryption/decryption engine is implemented at a hardware level.

7. A graphics card comprising:

a means for storing a plurality of keys so that said key cannot be accessed outside of said graphics card;

a means for receiving a request to make available at least a portion of an operating system (OS);

a means for accessing a given one of said plurality of keys;

a means for receiving at least said portion of said operating system (OS) in an encrypted format from a storage device;

a means for decrypting at a hardware level at least said portion of said operating system (OS) using said given one of said plurality of keys and counter mode (CTR) of advanced encryption standard (AES) based on a block number and a byte-aligned block address of said portion of said operating system (OS) in said encrypted format in said storage device passed through a transform function; and

a means for outputting said operating system (OS) in a decrypted format.

8. The graphics card of claim 7 wherein said means for storing said keys comprises a means for storing said plurality of keys in an encrypted format.

9. The graphics card of claim 8, further comprising a means for verifying a password received with said request.

10. The graphics card of claim 9, wherein said means for decrypting at least said portion of said operating system (OS) uses said password to decrypt a corresponding one of said plurality of keys.

11. The graphics card of claim 7, wherein one of said plurality of keys is encrypted using a password of an administrator.