Input-output device and storage controller handshake protocol using key exchange for data security

• US 8,165,301 B1
• Filed: 04/04/2006
• Issued: 04/24/2012
• Est. Priority Date: 04/04/2006
• Status: Active Grant

• Current Assignee: BiTMICRO, LLC (BiTMICRO Networks, Inc.)
• Original Assignee: BiTMICRO Networks, Inc.
• Inventors: David, Raquel Bautista, Fuentes, Marizonne Operio, Bruce, Rey
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US11/398,321
• Time in Patent Office: 2,212 Days
• Field of Search: None
• US Class Current: 380/277
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A protocol for providing secured IO device and storage controller handshake protocol; IO device controlled cipher settings, and secured data storage and access in memory. An IO device requesting data transfer with encryption and/or decryption, requests session keys from the processor. The processor generates a fresh public-private key pair for the session. The public key is sent to the requesting IO device; the private key is momentarily saved by the processor for the session. The requesting IO device generates a secret key and its desired cipher setting; furthermore, encrypts the secret key and cipher setting using the public key, and sends secret key and cipher setting to the processor. The processor uses the private key to decrypt the secret key and cipher setting. The cipher setting is used for configuring the data processing core. The secret key is used for encryption and/or decryption of the data being transferred. All keys are not permanently saved.

Claims

1. A data security method comprising the steps of:

generating one or more secret key and one or more cipher setting by one or more input-output device;

encrypting the one or more secret key and the one or more cipher setting into one or more set_cipher command by the one or more input-output device;

sending the one or more set_cipher command to one or more CPU via one or more IO controller;

recovering the one or more secret key and the one or more cipher setting according to the one or more set_cipher command by the one or more CPU;

setting up one or more data processing core according to the one or more cipher setting; and

accessing one or more memory data according to the one or more secret key via the one or more data processing core.

2. The data security method of claim 1 wherein the one or more set_cipher command is sent to the one or more CPU using one or more session key.

3. The data security method of claim 2 wherein the memory access is initiated by one or more IO command comprising one or more cipher tag, one or more last transfer tag, and one or more last use of cipher tag.

4. The data security method of claim 1, further comprising:

decrypting the one or more set_cipher command in order to recover the one or more secret key and the one or more cipher setting.

9. The data security method of claims 1, 2, 3, 5, 6, or 8 whereby one or more data is encrypted.

10. The data security method of claims 1, 2, 3, 5, 6, or 8 whereby one or more data is decrypted.

5. A data security method for secured data communication, processing and storage of one or more input-output device comprising the steps of:

requesting one or more public key from one or more storage controller by the one or more input-output device;

generating one or more pair of private key and public key by the one or more storage controller;

sending the one or more public key from the one or more storage controller to the one or more input-output device;

generating one or more secret key and one or more cipher setting according to the one or more public key;

sending one or more set_cipher command comprising the one or more secret key and the one or more cipher setting to the one or more storage controller;

sending one or more IO command from the one or more input-output device to the one or more storage controller;

processing one or more data from the one or more input-output device using the one or more secret key according to the one or more cipher setting;

transferring and storing the one or more data according to the one or more IO command; and

deleting the one or more pair of private key and public key, the one or more secret key and the one or more cipher setting.

6. The data security method of claim 5 wherein the one or more set_cipher command further comprises:

one or more data processing algorithm type;

one or more data processing mode;

one or more data processing key size;

one or more data processing secret key; and

one or more data processing tag whereby one or more data processing setting is identified.

7. The data security method of claim 6, further includes using the data processing mode to identify a mode of encryption.

8. The data security method of claim 5 wherein the one or more IO command comprises:

one or more subcommand for specifying a data transfer type;

one or more last transfer tag for indicating whether data being requested is the last data;

one or more cipher tag for identifying cipher setting; and

one or more last use of cipher tag for indicating that the one or more pair of private key and public key, the one or more secret key and the one or more cipher setting is used for the last time.

11. The data security method of claim 5, further comprising:

recovering the one or more secret key and the one or more cipher setting by use of the private key.

12. An apparatus for secured data processing and storage comprising:

means for requesting one or more public key from one or more storage controller by the one or more input-output device;

means for generating one or more pair of private key and public key by the one or more storage controller;

means for sending the one or more public key from the one or more storage controller to the one or more input-output device;

means for generating one or more secret key from the one or more public key and one or more cipher setting;

means for sending one or more set_cipher command comprising the one or more secret key and the one or more cipher setting to the one or more storage controller;

means for sending one or more IO command from the one or more input-output device to the one or more storage controller;

means for processing one or more data from the one or more input-output device using the one or more secret key according to the one or more cipher setting;

means for transferring and storing the one or more data according to the one or more command; and

means for deleting the one or more pair of private key and public key, the one or more secret key and the one or more cipher setting.

13. The apparatus of claim 12 wherein the one or more set_cipher command comprises:

one or more data processing algorithm type;

one or more data processing mode;

one or more data processing key size;

one or more data processing secret key; and

one or more data processing tag whereby one or more data processing setting is identified.

14. The apparatus of claim 13, wherein the data processing mode defines the mode of cipher encryption to be used during data processing.

15. The apparatus of claim 12 wherein the one or more IO command comprises:

one or more subcommand for specifying a data transfer type;

one or more last transfer tag for indicating whether data being requested is the last data;

one or more cipher tag for identifying the cipher setting;

one or more last use of cipher tag for indicating that the one or more pair of private key and public key, the one or more secret key and the one or more cipher setting is used for the last time.

16. The apparatus of claim 12, 13, or 15 wherein one or more data is encrypted.

17. The apparatus of claim 12, 13, or 15 wherein one or more data is decrypted.

18. The apparatus of claim 12, wherein the IO command includes any one of the following IO subcommands:

Write-Encrypt, Write-Decrypt, Read-Decrypt, and Read-Encrypt.

19. The apparatus of claim 18, wherein the Read-Encrypt command causes a read command to be performed and causes data that is read in response to the Read-Encrypt command to be encrypted prior to transmission to the one or more input-output device.

20. The apparatus of claim 18, wherein the Write-Decrypt command causes a write command to be performed and causes data that is written in response to the Write-Decrypt command to be decrypted prior to storage of the data.

21. The apparatus of claim 12:

further including a memory; and

wherein, if the IO command includes a Write-Decrypt IO subcommand;

the means for processing one or more data processes the data into decrypted data;

the decrypted data is written to the memory by the means for transferring and storing;

the decrypted data is read from the memory by the means for transferring and storing; and

the decrypted data is transmitted to the one or more input-output device by the means for sending one or more IO command.

22. The apparatus of claim 12:

further including a memory; and

wherein if the IO command is a Read-Encrypt IO subcommand;

the data is read from the memory by the means for transferring and storing;

the data is encrypted by the means for processing one or more data, which generates encrypted data; and

the encrypted data is returned to the one or more input-output device by the means for sending one or more IO command.

23. The apparatus of claim 22, wherein the data is in an unencrypted form prior to storage in the memory.

24. The apparatus of claim 12 wherein the one or more set_cipher command comprises:

an operation code;

a set_cipher sub-command;

an initiator ID; and

the one or more cipher setting.

25. The apparatus of claim 12, wherein the cipher setting includes:

a cipher algorithm;

a cipher mode;

a cipher key size; and

the secret key.

26. The apparatus of claim 25, the cipher setting further includes a cipher tag for identifying a particular combination of:

the cipher algorithm,

the cipher mode;

the cipher key size, and

the secret key.

27. The apparatus of claim 12, wherein the set_cipher command includes at least one or more cipher setting field.

28. The apparatus of claim 27, wherein the set_cipher command further includes:

an operation code field;

a sub-command field; and

an initiator ID field.

29. The apparatus of claim 28, wherein:

the operation code field is disposed to indicate an operation code;

the sub-command is disposed to indicate a sub-command; and

the initiator ID is disposed to indicate the identity of an input-output device from the one or more input-output device.

30. A data security method comprising:

generating a secret key and a cipher setting by an input-output device;

encrypting the secret key and the cipher setting into a set_cipher command by the input-output device;

sending the set_cipher command to a processor;

decrypting the secret key and the cipher setting in the set_cipher command by the processor;

setting up a data processing core according to the cipher setting; and

providing data security to the data based on the secret key.

31. The data security method of claim 30 wherein the set_cipher command is sent to the processor using a session key.

32. The data security method of claim 30 wherein access to the data is initiated by one or more IO command comprising one or more cipher tag, one or more last transfer tag, and one or more last use of cipher tag.

33. The data security method of claim 30 wherein the data is encrypted using the secret key.

34. The data security method of claim 30 wherein the data is decrypted using the secret key.

35. An apparatus for secured data processing, comprising:

a processor;

an input-output device configured to generate a secret key and a cipher setting, configured to encrypt the secret key and the cipher setting into a set_cipher command, and configured to send the set_cipher command to the processor; and

the processor configured to decrypt the secret key and the cipher setting in the set_cipher command and configured to set up a data processing core according to the cipher setting;

the data processing core configured to provide data security to the data based on the secret key.

36. The apparatus of claim 35 wherein the set_cipher command is sent to the processor using a session key.

37. The apparatus claim 35 wherein access to the data is initiated by one or more IO command comprising one or more cipher tag, one or more last transfer tag, and one or more last use of cipher tag.

38. The apparatus of claim 35 wherein the data is encrypted using the secret key.

39. The apparatus of claim 35 wherein the data is decrypted using the secret key.

40. An apparatus for secured data processing and storage, comprising:

an input-output device configured to request a public key;

a storage controller configured to generate a pair of private key and public key and send the public key to the input-output device;

the input-output device configured to generate a secret key from the public key and a cipher setting, configured to send a set_cipher command comprising the secret key and the cipher setting to the storage controller, and configured to send an IO command to the storage controller;

the storage controller configured to process data from the input-output device using the secret key according to the cipher setting; and

a memory configured to store the data according to the command.

41. The apparatus of claim 40 wherein the set_cipher command comprises:

one or more data processing algorithm type;

one or more data processing mode;

one or more data processing key size;

one or more data processing secret key; and

one or more data processing tag whereby one or more data processing setting is identified.

42. The apparatus of claim 41, wherein the data processing mode defines the mode of cipher encryption to be used during data processing.

43. The apparatus of claim 40 wherein the IO command comprises:

one or more subcommand for specifying a data transfer type;

one or more last transfer tag for indicating whether data being requested is the last data;

one or more cipher tag for identifying the cipher setting;

one or more last use of cipher tag for indicating that the one or more pair of private key and public key, the one or more secret key and the one or more cipher setting is used for the last time.

44. The apparatus of claim 40, 41, or 43 wherein the data is encrypted.

45. The apparatus of claim 40, 41, or 43 wherein the data is decrypted.

46. The apparatus of claim 40, wherein the IO command includes any one of the following IO subcommands:

Write-Encrypt, Write-Decrypt, Read-Decrypt, and Read-Encrypt.

47. The apparatus of claim 46, wherein the Read-Encrypt command causes a read command to be performed and causes data that is read in response to the Read-Encrypt command to be encrypted prior to transmission to the one or more input-output device.

48. The apparatus of claim 46, wherein the Write-Decrypt command causes a write command to be performed and causes data that is written in response to the Write-Decrypt command to be decrypted prior to storage of the data.

49. The apparatus of claim 40:

wherein, if the IO command includes a Write-Decrypt IO subcommand;

a data processing core is configured to process the data into decrypted data;

the decrypted data is written to the memory;

the decrypted data is read from the memory; and

the decrypted data is transmitted to the input-output device.

50. The apparatus of claim 40:

wherein if the IO command is a Read-Encrypt IO subcommand;

the data is read from the memory;

a data processing core is configure to encrypt the data; and

the encrypted data is returned to the input-output device.

51. The apparatus of claim 50, wherein the data is in an unencrypted form prior to storage in the memory.

52. The apparatus of claim 40 wherein the set_cipher command comprises:

an operation code;

a set_cipher sub-command;

an initiator ID; and

the one or more cipher setting.

53. The apparatus of claim 40, wherein the cipher setting includes:

a cipher algorithm;

a cipher mode;

a cipher key size; and

the secret key.

54. The apparatus of claim 53, the cipher setting further includes a cipher tag for identifying a particular combination of:

the cipher algorithm,

the cipher mode;

the cipher key size, and

the secret key.

55. The apparatus of claim 40, wherein the set_cipher command includes at least one or more cipher setting field.

56. The apparatus of claim 55, wherein the set_cipher command further includes:

an operation code field;

a sub-command field; and

an initiator ID field.

57. The apparatus of claim 56, wherein:

the operation code field is disposed to indicate an operation code;

the sub-command is disposed to indicate a sub-command; and

the initiator ID is disposed to indicate the identity of an input-output device from the one or more input-output device.