Key encryption and decryption

• US 9,747,223 B2
• Filed: 02/20/2015
• Issued: 08/29/2017
• Est. Priority Date: 04/10/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Greco, Paul M., Jaquette, Glen A., Schaffer, Scott J.
• Primary Examiner(s): Popham, Jeffrey D
• Application Number:
  US14/627,763
• Publication Number:
  US 20160357687A1
• Time in Patent Office: 921 Days
• Field of Search: 713156
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Provided is a data storage drive for encrypting data, comprising a microprocessor and circuitry coupled to the microprocessor and adapted to receive a session encrypted data key and to decrypt the session encrypted data key using a session key, wherein a result is a data key that is capable of being used to encrypt clear text and to decrypt cipher text written to a storage medium. Also provided is a system, comprising a microprocessor and circuitry coupled to the microprocessor and adapted to receive a session encrypted data key and to decrypt the session encrypted data key using a private key, wherein a result is a secret key that is capable of being used to encrypt clear text and to decrypt cipher text written to a storage medium.

Claims

1. A system, comprising:

a microprocessor;

a host attachment coupled to the microprocessor; and

circuitry coupled directly to the microprocessor and directly to the host attachment, the circuitry comprising an Application Specific Integrated Circuit (ASIC) for encryption and decryption that includes a first multiplexor, a second multiplexor, a third multiplexor, a fourth multiplexor, a public key decryption block, a decryption block, and an encryption block;

wherein the first multiplexor selects a session encrypted data key from inputs of a first session encrypted data key from the microprocessor and a second session encrypted data key from the host attachment, and wherein the session encrypted data key is input to the public key decryption block;

wherein the public key decryption block unwraps the session encrypted data key to obtain a secret key that is input to the second multiplexor;

wherein the second multiplexor selects a session key from inputs of a first session key, a backup data key, a standard data key, and the secret key, and wherein the session key is input to the decryption block and input to the encryption block;

wherein the third multiplexor selects clear text from inputs of first clear text from the microprocessor and second clear text from the host attachment, and wherein the clear text is input to the encryption block;

wherein the encryption block encrypts the clear text with the session key to generate encrypted text, and wherein the encrypted text is input to the fourth multiplexor;

wherein the fourth multiplexor selects a piece of encrypted data from inputs of the session encrypted data key and the encrypted text from the encryption block, and wherein the piece of encrypted data is input to the decryption block; and

wherein the decryption block decrypts the piece of encrypted data, wherein the decryption comprises decrypting the session encrypted data key with the session key comprising the first session key when the piece of encrypted data is the session encrypted data key, and wherein the decryption comprises decrypting the encrypted text with the session key comprising one of the backup data key, the standard data key, and the secret key when the piece of encrypted data is the encrypted text.

2. The system of claim 1, further comprising:

a data storage drive that includes the microprocessor, the host attachment, and the circuitry; and

a key manager coupled to the data storage drive, wherein the key manager obtains a public key that is part of a public-private key pair from the data storage drive and uses the public key to create the session encrypted data key.

3. The system of claim 2, further comprising:

the circuitry storing a private key that is part of the public-private key pair.

4. The system of claim 3, wherein the private key is stored in a register space inside the ASIC that is not accessible by external entities.

5. The system of claim 1, further comprising:

the circuitry using a root Certificate of Authority (CA) block to check a root Certificate of Authority (CA) signature and to unwrap the session encrypted data key.