Method and apparatus for in-line serial data encryption

• US 7,650,510 B2
• Filed: 04/29/2003
• Issued: 01/19/2010
• Est. Priority Date: 04/30/2002
• Status: Active Grant

• Current Assignee: General Dynamics Mission Systems Inc. (General Dynamics Corporation)
• Original Assignee: General Dynamics Advanced Information Systems Incorporated (General Dynamics Corporation)
• Inventors: Sullivan, Patrick L.
• Primary Examiner(s): ZIA, SYED
• Application Number:
  US10/426,705
• Publication Number:
  US 20040054914A1
• Time in Patent Office: 2,457 Days
• Field of Search: None
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06

Abstract

A method and apparatus for real-time in-line encryption of data transmitted over a serial channel from a source device to a target device. An encryption unit includes logic configured to receive data packets including headers with control information and data on the channel, which may be a fiber channel bus, serial ATA, serial SCSI, USB or the like. The encryption unit encrypts the data and passes the control information to the target device along with the encrypted data. The encryption unit may filter, convert or reject predetermined commands or types of information in the header to prevent covert channel transmissions. There may be one or multiple source devices, e.g. host computers, and one or multiple target devices, e.g. storage systems, configured in a variety of network topologies. The encryption unit also decrypts data and remaps control information transmitted from the target device(s) to the source device(s).

Claims

1. An encryption system, including:

an input connection configured to receive, from a first device, serial, plain-text data and associated control information for a second device, said control information including at least one command directed to operation of the second device to store and retrieve data,

an output connection configured to connect to the second device;

an encrypt module configured;

(a) to encrypt the data, (b) to filter disallowed control information, and (c) to leave allowed control information unencrypted;

a transmit module configured to transmit the encrypted data and control information to the second device;

wherein the control information is disallowed or allowed based on at least some of the at least one command directed to operation of the second device to store and retrieve data.

2. The encryption system of claim 1, wherein:

the first device includes a processor-based system; and

the second device includes a storage system.

3. The encryption system of claim 1, wherein the encrypt module is configured to encrypt the data in multiple data subsets of a predetermined size.

4. The encryption system of claim 3, wherein the predetermined size is variable.

5. The encryption system of claim 4, wherein the transmit module is further configured to transmit size information identifying the predetermined size to the second device.

6. An encryption system, including:

an input connection configured to receive, from a first device, bits of serial, plain text data and associated control information for a second device, said control information including at least one command directed to operation of the second device to store and retrieve data;

an output connection configured to connect to the second device;

an encrypt module configured;

(a) to encrypt the data bits, (b) to filter disallowed control information, and (c) to leave allowed control information unencrypted;

a control translation module configured to remove at least one command from the received control information and to replace the removed command with an equivalent command; and

a transmit module configured to transmit the encrypted data bits and the control information including the equivalent command to the second device

wherein the control information is disallowed or allowed based on at least some of the at least one command directed to operation of the second device to store and retrieve data.

7. The encryption system of claim 6, wherein the control translation module is further configured to reject at least one command that does not correspond to a predetermined set of allowed commands.

8. The encryption system of claim 6, wherein the control translation module is further configured to reject at least one command that corresponds to a predetermined set of disallowed commands.

9. A method of encrypting data that is sent from a first device via a serial bus and directed to a second device, including the steps of:

receiving the data from the first device along with associated control information for the second device, said control information including a command directed to operation of the second device to store and retrieve data;

encrypting at least a portion of the data;

filtering disallowed control information, and

transmitting the encrypted data with allowed control information to the second device, where the allowed control information is transmitted in an unencrypted form

wherein the control information is disallowed or allowed based on at least some of the at least one command directed to operation of the second device to store and retrieve data.

10. The method of claim 9, wherein the portion of data that is encrypted in the encrypting step has a predetermined size.

11. The method of claim 10, wherein the predetermined size is variable.

12. The method of claim 10, wherein the transmitting step further includes the step of transmitting information relating to the predetermined size to the second device.

13. A method of encrypting data that is sent from a first device via a serial bus and directed to a second device, including the steps of:

receiving the data along with associated control information, said control information including a command directed to operation of the second device to store and retrieve data;

encrypting at least a portion of the data;

determining an equivalent command for at least one received command associated with the control information;

replacing the received command with the equivalent command;

transmitting the encrypted data with the associated control information including the equivalent command to the second device, where the associated control information is transmitted in an unencrypted form;

rejecting data associated with a command for which no equivalent is determined.

14. A method of encrypting data that is sent from a first device via a serial bus and directed to a second device, including the steps of:

receiving the data along with associated control information, said control information including a command directed to operation of the second device to store and retrieve data;

encrypting at least a portion of the data;

determining an equivalent command for at least one received command associated with the control information;

replacing the received command with the equivalent command;

transmitting the encrypted data with the associated control information including the equivalent command to the second device, where the associated control information is transmitted in an unencrypted form;

rejecting data associated with a command that is determined to be one of a predetermined set of disallowed commands.

15. A data transmission system, including:

a computer having a serial communications port;

a serial bus coupled to the serial communications port;

a recipient device coupled to the serial bus; and

an encryption unit connected in-line to the serial bus between the computer and the recipient device, the encryption unit including an encrypt module configured to receive data and associated control information transmitted from the computer via the serial bus and to encrypt the data, said control information including a command directed to operation of the recipient device to store and retrieve data; and

a transmit unit configured to read and transmit the control information with the encrypted data to the recipient device; and

the transmit unit is configured to block data associated with a command for which no predetermined equivalent command is located.

16. The system of claim 15, wherein the recipient device includes a decryption module configured to decrypt the transmitted data.

17. The system of claim 15, wherein:

the encrypt module includes a command replacement module configured to replace at least one command associated with the control information with a predetermined equivalent command.

18. The system of claim 15, wherein:

the encrypt module includes a command replacement module configured to replace at least one command associated with the control information with a predetermined equivalent command; and

the transmit unit is configured to transmit only data associated with commands for which predetermined equivalent commands are located.

19. The system of claim 15, including a filtering unit configured to filter transmitted data based upon at least one predetermined criterion.

20. The system of claim 19, wherein the criterion includes detection of a disallowed form of data associated with the control information.

21. The system of claim 20, wherein the disallowed form of a data includes an address pointer.

22. The system of claim 20, wherein the disallowed form of data includes at least one command associated with a predetermined type of attack.

23. The system of claim 15, wherein:

the encryption unit is further configured to receive recipient device data and associated control information transmitted from the recipient device via the serial bus and directed to the computer, and to encrypt the recipient device data; and

the transmit unit is further configured to transmit the encrypted recipient device data with its associated control information to the computer.

24. The system of claim 23, wherein the computer includes a decryption module configured to decrypt the encrypted recipient device data.