Incremental encryption of stored information

• US 8,732,482 B1
• Filed: 09/24/2012
• Issued: 05/20/2014
• Est. Priority Date: 04/12/2010
• Status: Active Grant

• Current Assignee: Stephen W. Melvin
• Original Assignee: Stephen W. Melvin
• Inventors: Melvin, Stephen W.
• Primary Examiner(s): Zee, Edward
• Application Number:
  US13/625,751
• Time in Patent Office: 603 Days
• Field of Search: 726/34, 726/26, 726/27, 713/189, 713/192, 713/193, 713/194
• US Class Current: 713/189
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen

Abstract

A method and apparatus are utilized to incrementally encrypt stored information, and can be applied to an existing medium storing unencrypted information. Information can be conditionally encrypted and/or decrypted as necessary and a separate storage area can be used to record whether a given block of information is stored encrypted or unencrypted. An embodiment of the present invention can be used as a retrofit device in a mechanism to encrypt information without causing undue interruption of normal operations. A variety of mechanisms and policies can also be used to manage, set and eliminate encryption keys.

Claims

1. A method of processing read commands comprising the steps of:

providing a memory device storing a block status table containing a plurality of entries, wherein at least one of said entries is in one of a first state, a second state and a third state, wherein said first state is indicative that respective data is encrypted, said second state is indicative that respective data is not encrypted and should remain unencrypted, and said third state is indicative that respective data is not encrypted and should be encrypted when it is read;

receiving a read command from a host interface wherein said read command comprises a data location;

retrieving an entry in said block status table associated with said data location;

if said entry is in said first state, performing the sub-steps of;

receiving data corresponding to said data location from a storage device interface;

decrypting said data to generate decrypted data;

providing said decrypted data to said host interface;

if said entry is in said second state, performing the sub-steps of;

receiving data corresponding to said data location from said storage device interface;

providing said data to said host interface;

if said entry is in said third state, performing the sub-steps of;

receiving data corresponding to said data location from said storage device interface;

providing said data to said host interface;

encrypting said data to create encrypted data;

providing said encrypted data to said storage device interface;

updating said entry in said block status table from said third state to said first state.

2. The method according to claim 1 wherein said first state represents an Encrypted (E) state.

3. The method according to claim 1 wherein said second state represents an Unencrypted—

Encrypt on Write (EOW) state.

4. The method according to claim 1 wherein said second state represents an Unencrypted—

Don'"'"'t Encrypt (DE) state.

5. The method according to claim 1 wherein said third state represents an Unencrypted—

Encrypt on Read or Write (EORW) state.

6. The method according to claim 1 wherein said block status table stores information indexed by the sector number corresponding to a data location.

7. The method according to claim 1 wherein said block status table stores information indexed by the cluster number corresponding to a data location.

8. A method of processing write commands comprising the steps of:

providing a memory device storing a block status table containing a plurality of entries, wherein at least one of said entries is in one of a first state, a second state and a third state, wherein said first state is indicative that respective data is encrypted and data being written should be encrypted before it is written, said second state is indicative that respective data is not encrypted and data being written should not be encrypted before it is written, and said third state is indicative that respective data is not encrypted and data being written should be encrypted before it is written;

receiving a write command from a host interface wherein said write command comprises write data and a data location;

retrieving an entry in said block status table associated with said data location;

if said entry is in said first state, performing the sub-steps of;

encrypting said write data to create encrypted data;

providing said encrypted data to a storage device interface;

if said entry is in said second state, performing the sub-steps of;

providing said write data to said storage device interface;

if said entry is in said third state, performing the sub-steps of;

encrypting said write data to create encrypted data;

providing said encrypted data to said storage device interface;

updating said entry from said third state to said first state.

9. The method according to claim 8 wherein if said entry is in said third state, further comprising performing the sub-steps of:

receiving data corresponding to said data location from said storage device interface;

encrypting said data received from said storage device interface to create encrypted block data;

providing at least a portion of said encrypted block data to said storage device interface.

10. The method according to claim 8 wherein said first state represents an Encrypted (E) state.

11. The method according to claim 8 wherein said second state represents an Unencrypted—

Don'"'"'t Encrypt (DE) state.

12. The method according to claim 8 wherein said third state represents an Unencrypted—

Encrypt on Write (EOW) state.

13. The method according to claim 8 wherein said third state represents an Unencrypted—

Encrypt on Read or Write (EORW) state.

14. The method according to claim 8 wherein said block status table stores information indexed by the sector number corresponding to a data location.

15. The method according to claim 8 wherein said block status table stores information indexed by the cluster number corresponding to a data location.