System and method for general purpose encryption of data

• US 9,298,938 B2
• Filed: 12/18/2014
• Issued: 03/29/2016
• Est. Priority Date: 03/10/2010
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Stufflebeam, Kenneth W. Jr., Kopp, Michele
• Primary Examiner(s): CHANG, KENNETH W
• Application Number:
  US14/575,755
• Publication Number:
  US 20150106633A1
• Time in Patent Office: 467 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Systems and methods for reducing problems and disadvantages associated with traditional approaches to encryption and decryption of data are provided. An information handling system may include a processor, a memory communicatively coupled to the processor, and an encryption accelerator communicatively coupled to the processor. The encryption accelerator may be configured to encrypt and decrypt information in accordance with a plurality of cryptographic functions, receive a command from the processor to perform an encryption or decryption task upon data associated with an input/output operation, and in response to receiving the command, encrypt or decrypt the data associated with the input/output operation based on a particular one of the plurality of cryptographic functions.

Claims

1. An information handling system, comprising:

a processor;

a memory communicatively coupled to the processor;

a storage resource communicatively coupled to the processor; and

an encryption status module stored in the memory and configured to;

determine an encryption status of a volume of the storage resource;

track the encryption status of the volume by periodically storing, during an encryption or decryption task, a variable indicating a portion of the volume that has been encrypted or decrypted and whether the volume is at least partially encrypted or decrypted;

determine whether the volume is in a partially encrypted or decrypted state in response to an interruption to the encryption or decryption of the data stored on the volume; and

boot from the volume in the partially encrypted or decrypted state based on the determination that the volume is in the partially encrypted or decrypted state.

2. The information handling system of claim 1, wherein the encryption status module is further configured to determine the variable by combining a first variable indicating the portion of the volume that has been encrypted or decrypted and a second variable indicating whether the volume is at least partially encrypted or decrypted.

3. The information handling system of claim 1, wherein the variable indicates an address of a last encrypted or decrypted sector of the volume.

4. The information handling system of claim 1, wherein the storage resource includes a sealed encryption key that is unique to the storage resource.

5. The information handling system of claim 4, further comprising a cryptoprocessor communicatively coupled to the processor, the cryptoprocessor configured to unwrap the unique sealed encryption key for use in connection with an encryption or decryption task to be performed on data from the storage resource.

6. The information handling system of claim 5, wherein the cryptoprocessor is further configured to authenticate that a user associated with the data is authorized to provide the unique sealed encryption key.

7. A method for encryption and decryption of data, comprising:

determining, by an encryption status module, an encryption status of a volume of a storage resource;

tracking, by the encryption status module, the encryption status of the volume by periodically storing, during an encryption or decryption task, a variable indicating a portion of the volume that has been encrypted or decrypted and whether the volume is at least partially encrypted or decrypted;

determining whether the volume is in a partially encrypted or decrypted state in response to an interruption to the encryption or decryption of the data stored on the volume; and

booting from the volume in the partially encrypted or decrypted state based on the determination that the volume is in the partially encrypted or decrypted state.

8. The method of claim 7, further comprising determining, by the encryption status module, the variable by combining a first variable indicating the portion of the volume that has been encrypted or decrypted and a second variable indicating whether the volume is at least partially encrypted or decrypted.

9. The method of claim 7, wherein the variable indicates an address of a last encrypted or decrypted sector of the volume.

10. The method of claim 7, wherein the storage resource includes a sealed encryption key that is unique to the storage resource.

11. The method of claim 10, further comprising unwrapping, by a cryptoprocessor communicatively coupled to the encryption status module, the unique sealed encryption key for use in connection with an encryption or decryption task to be performed on data from the storage resource.

12. The method of claim 11, further comprising authenticating, by the cryptoprocessor, that a user associated with the data is authorized to provide the unique sealed encryption key.

13. A non-transitory computer-readable medium comprising instructions stored therein, the instructions readable by a processor and, when read and executed, configured to cause the processor to:

determine an encryption status of a volume of a storage resource;

track the encryption status of the volume by periodically storing, during an encryption or decryption task, a variable indicating a portion of the volume that has been encrypted or decrypted and whether the volume is at least partially encrypted or decrypted;

determine whether the volume is in a partially encrypted or decrypted state in response to an interruption to the encryption or decryption of the data stored on the volume; and

boot from the volume in the partially encrypted or decrypted state based on the determination that the volume is in the partially encrypted or decrypted state.

14. The computer-readable medium of claim 13, wherein the instructions are further configured to cause the processor to determine the variable by combining a first variable indicating the portion of the volume that has been encrypted or decrypted and a second variable indicating whether the volume is at least partially encrypted or decrypted.

15. The computer-readable medium of claim 13, wherein the variable indicates an address of a last encrypted or decrypted sector of the volume.

16. The computer-readable medium of claim 13, wherein the storage resource includes a sealed encryption key that is unique to the storage resource.

17. The computer-readable medium of claim 16, wherein the instructions are further configured to cause the processor to unwrap the unique sealed encryption key for use in connection with an encryption or decryption task to be performed on data from the storage resource.