Secure archive

• US 8,756,436 B2
• Filed: 01/16/2008
• Issued: 06/17/2014
• Est. Priority Date: 01/16/2007
• Status: Active Grant

• Current Assignee: Waterfall Security Solutions Ltd.
• Original Assignee: Waterfall Security Solutions Ltd.
• Inventors: Frenkel, Lior, Zilberstein, Amir
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US12/447,470
• Publication Number:
  US 20100275039A1
• Time in Patent Office: 2,344 Days
• Field of Search: 713/193, 380/277, 711/163
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up

Abstract

Storage apparatus (20) includes a memory (30) and an encryption processor (28), which is configured to receive and encrypt data transmitted from one or more computers (24) for storage in the memory. A one-way link (32) couples the encryption processor to the memory so as to enable the encryption processor to write the encrypted data to the memory but not to read from the memory.

Claims

1. Storage apparatus, comprising:

an archive memory centrally archiving data for a plurality of computers;

an encryption processor, which is configured to receive and encrypt data transmitted from one or more computers for storage in the archive memory; and

a one-way link, coupling the encryption processor to the archive memory so as to enable the encryption processor to write the encrypted data to the memory but not to read from the memory,

wherein the one-way link is physically configured so as to permit data transmission in only one direction, from the processor to the memory, and

wherein the memory and the encryption processor are connected in a manner allowing direct transmission only from the encryption processor to the memory, and not from the memory to the encryption processor.

2. The apparatus according to claim 1, wherein the encryption processor is configured to encrypt the data using an encryption key that is not available to the one or more computers.

3. The apparatus according to claim 2, wherein for each transmission of the data from the one or more computers, the encryption processor is configured to select the encryption key from among a plurality of possible encryption keys, and to convey an indication of the selected encryption key to the memory in addition to the encrypted data.

4. The apparatus according to claim 1, wherein the memory is configured to store the encrypted data without decryption prior to storage.

5. The apparatus according to claim 1, wherein the encryption processor is configured to receive the data from the one or more computers over a network.

6. The apparatus according to claim 1, wherein the encryption processor is configured to apply a time stamp to each of at least some items of the data that are written to the memory.

7. The apparatus according to claim 1, and comprising:

a monitoring processor, which is coupled to the memory so as to generate an indication of a status of the data stored in the memory; and

a further one-way link, coupling the monitoring processor to at least one of the computers so as to enable the monitoring processor to convey the indication of the status to the at least one of the computers but not to receive inputs from the one or more computers.

8. The apparatus according to claim 1, wherein the memory and the encryption processor are connected directly only by the one way link.

9. The apparatus according to claim 1, comprising an additional one way link included in a communication path allowing transmission from the memory to at least one of the computers, without the communication path passing through the encryption processor.

10. The apparatus according to claim 1, comprising a monitoring processor separate from the encryption processor, which monitors the status of the memory.

11. The apparatus according to claim 1, wherein the archive memory is configured to only receive data encrypted by the encryption processor.

12. The apparatus according to claim 1, wherein the archive memory is located within a private protected computer network such that data can be transmitted to the archive memory only from computers within the private protected network.

13. A method for data storage, comprising:

receiving data transmitted from one or more computers for storage in an archive memory centrally archiving data for a plurality of computers;

encrypting the received data using an encryption processor before passing the data to the archive memory;

conveying the encrypted data from the encryption processor to the archive memory over a one-way link, which permits the encryption processor to write the encrypted data to the memory but not to read from the memory,

wherein the one-way link is physically configured so as to permit data transmission in only one direction, from the processor to the memory, and wherein the memory and the encryption processor are connected in a manner allowing direct transmission only from the encryption processor to the memory, and not from the memory to the encryption processor; and

storing the encrypted data in the memory.

14. The method according to claim 13, wherein encrypting the received data comprises encrypting the data using an encryption key that is not available to the one or more computers.

15. The method according to claim 14, wherein encrypting the data comprises, for each transmission of the data from the one or more computers, selecting the encryption key from among a plurality of possible encryption keys, and conveying an indication of the selected encryption key to the memory in addition to the encrypted data.

16. The method according to claim 13, wherein storing the encrypted data comprises writing the encrypted data to the memory without decryption prior to storage.

17. The method according to claim 13, wherein receiving the data comprises receiving the data from the one or more computers over a network.

18. The method according to claim 13, and comprising applying a time stamp to each of at least some items of the data that are written to the memory.

19. The method according to claim 13, and comprising:

generating an indication of a status of the data stored in the memory using a monitoring processor coupled to the memory; and

conveying the indication from the monitoring processor to at least one of the computers via a further one-way link, which permits the monitoring processor so to convey the indication of the status to the at least one of the computers but not to receive inputs from the one or more computers.

20. The method according to claim 13, wherein the memory and the encryption processor are connected directly only by the one way link.