System and method for transparent disk encryption

• US 20080133939A1
• Filed: 12/27/2007
• Published: 06/05/2008
• Est. Priority Date: 08/07/2002
• Status: Active Grant

• Current Assignee: Radoslav Danilak
• Original Assignee: Radoslav Danilak
• Inventors: Danilak, Radoslav
• Granted Patent: US 8,347,115 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories

Abstract

A data storage system providing transparent encryption. The data storage system has a hardware encryption/decryption engine and a register coupled to the hardware encryption/decryption engine. The register is for securely storing a key for encrypting and decrypting data. The key may not be read from outside the data storage system. More specifically, the key may not be read by the operating system. The user does not have access to the encryption key, but may have a password that is passed to a controller coupled to the encryption/decryption engine. The controller verifies the password and causes data received from main memory to be encrypted by the hardware encryption/decryption engine using the key. The controller also transfers the encrypted data to the data storage device.

Claims

1. A computing device comprising:

a main memory for storing a basic input/output system (BIOS);

a processor, communicatively coupled to said main memory, for executing said basic input/output system (BIOS) and an operating system (OS); and

a data storage system, communicatively coupled to said processor and said main memory, for;

storing encrypted data including said operating system (OS);

receiving a request from said basic input/output system (BIOS) to load at least a portion of said operating system (OS) into said main memory;

unlocking a key;

decrypting at a hardware level a given portion of said encrypted data comprising at least said portion of the operating system (OS) using said key; and

transferring said given portion of said decrypted data to main memory.

2. The computing device of claim 1, wherein said data storage system comprises:

a data storage medium for storing said encrypted data;

a register for securely storing said key; and

a hardware encryption/decryption engine, communicatively coupled to said data storage medium and said register, for encrypting said data transferred to said data storage medium and decrypting said data transferred from said data storage medium using said key.

3. The computing device of claim 1, wherein unlocking said key comprises:

receiving a password associated with said request;

receiving an encrypted key from said register; and

decrypting said key using said password.

4. The computing device of claim 3, wherein said basic input/output system (BIOS) prompts a user for said password.

5. The computing device of claim 1, wherein said key is a random number generated by said data storage system.

6. The computing device of claim 1, wherein said key cannot be accessed outside of said data storage system.

7. A data storage system comprising:

a means for storing encrypted data including said operating system (OS);

a means for receiving a request from said basic input/output system (BIOS) to load at least a portion of said operating system (OS) into said main memory;

a means for unlocking a key;

a means for decrypting at a hardware level a given portion of said encrypted data comprising at least said portion of the operating system (OS) using said key; and

a means for transferring said given portion of said decrypted data to main memory.

8. The data storage system of claim 7, wherein said means for unlocking said key comprises:

a means for receiving a password associated with said request;

a means for receiving an encrypted key from said register; and

a means for decrypting said key using said password.

9. The data storage system of claim 7, further comprising:

a means for generating said key from a random number;

a means for encrypting said key to lock said key; and

means for storing said locked key so that said key cannot be accessed outside of said data storage system.