Computing device for encryption and decryption of data

Abstract

A computing device is disclosed. The computing device includes a central processing unit (CPU) and a mass storage bus. The CPU includes an application processing unit and an immutable encryption key for encrypting and decrypting data. The application processing unit includes an instruction set to perform data encryption and decryption on data stored via the mass storage bus. The immutable encryption key is stored in the CPU and is not accessible from outside the instruction set.

Description

Background Technology

[0001] A computing device is a machine that can be instructed to automatically execute algorithms or logical operations via computer programming and can follow a set of generalized operations (called a program). These programs enable computing devices to perform an extremely wide range of tasks. A computer system may include hardware, an operating system, and peripheral devices for operation. Computing devices can take many forms and are used as control systems for a variety of industrial and consumer applications. This includes simple dedicated computing devices, such as printing devices; industrial robots; general-purpose devices, including workstations, servers, personal computers, laptops, and mobile devices such as tablets and smartphones; and consumer devices, such as video game consoles. Computing devices can be standalone devices or configured as part of a computer network.

[0002] Computing devices can be equipped with mass storage devices (equipped to receive mass storage devices) or can access mass storage devices capable of storing data in a persistent and machine-readable form as removable or non-removable devices. Mass storage devices can be devices or systems, including tape libraries, RAID systems, and computer drives such as disk drives, solid-state drives, optical disc drives, memory cards, and memory sticks (such as USB drives), and can include combinations of such devices. For example, a computing device can access a mass storage device with a storage tier that includes solid-state drives and hard disk drives. Attached Figure Description

[0003] Figure 1 This is a block diagram of an example computing device.

[0004] Figure 2 The diagram is based on Figure 1 Another example of a computing device is a block diagram of a computing device.

[0005] Figure 3 It is a diagram construction Figure 2 A block diagram of an example method for a computing device.

[0006] Figure 4 It is a diagram. Figure 2 A block diagram of an example method for a computing device. Detailed Implementation

[0007] Computing devices may include mass storage devices or provide access to mass storage devices (such as via a bus) to store machine-readable data. The theft or loss of a computing device can be problematic if the data includes sensitive or confidential information. Many portable computing devices, such as laptops and mobile computing devices, are particularly vulnerable to theft and loss, and similarly, they may be used in insecure locations to access, process, and store sensitive or confidential data.

[0008] To mitigate the consequences of lost or stolen computing devices, some manufacturers offer security solutions such as installing self-encrypting mass storage devices within the devices. Self-encrypting mass storage devices apply an encryption key to write data as encrypted data to the storage device and use the same key to decrypt the encrypted data to retrieve it from the storage device. In such examples, the mass storage device protects the confidentiality and security of both the data and the encryption key. One problem with this common security solution is that the encrypted data is not bound to the computing device. For example, the secure drive can be removed and installed in another system, or the encryption key can be accessed to steal data from the secure drive.

[0009] Security solutions developed to mitigate data accessibility on mass storage devices are generally categorized into software-based and hardware-based data encryption. Software-based data encryption involves an environment where a device driver or software element can connect to the mass storage device and act as a medium for writing encrypted data and reading decrypted data via a key. The key is stored in a location accessible to the software and is applied from boot cycle to boot cycle. Hardware-based data encryption combines encryption with the underlying storage solution. Examples can include self-encrypting mass storage devices such as SEDs (Self-Encrypting Drives), encrypted NVMe (Non-Volatile Memory Express), or other solutions combining storage firmware and encryption solutions. Hardware-based data encryption can store the key on the device or elsewhere and allows the solution to encrypt entire data areas.

[0010] In one example, this disclosure relates to an application processing unit that can be included as part of a central processing unit in a computing device, which intercepts and processes input / output commands to a mass storage device of the computing device, wherein the application processing unit supports encryption, such as symmetric encryption of block data. The encryption keys used for encryption and decryption are securely generated during the manufacturing process of the central processing unit and securely stored within the central processing unit. In this example, access to the encryption keys comes from the application programming unit, not from the input / output processing that can serialize the data buffer into a command stream based on encryption or decryption. In one example of detecting a response to a read-based storage command, the application processing unit applies the encryption key to decrypt the content from the mass storage device and passes the decrypted command buffer to the calling application code. In one example of detecting a response to a write-based storage command, the application processing unit applies the encryption key to encrypt the content from the calling application before sending a write operation to the mass storage device.

[0011] By using an application processing unit (APU), the operating system and software of the computing device are unaware of and cannot know about the encryption and decryption of data blocks, thus avoiding the use of dedicated storage system components. Furthermore, the use of an APU can reduce costs and provide faster performance than dedicated storage system components. Additionally, the APU can be used to perform encryption and decryption on data from multiple mass storage devices coupled to the computing device. Even if the mass storage devices are removed from the computing device, the encrypted data remains securely bound to the central processing unit.

[0012] Figure 1 An example computing device including a central processing unit 102 and a mass storage bus 104 is illustrated. The central processing unit 102 includes an application processing unit 106 having an instruction set 108 to perform encryption and decryption on block data of input / output operations on the mass storage bus 104. An immutable encryption key 110 used for encrypting and decrypting the block data is stored in the central processing unit 102 and is not accessible from outside the instruction set 108.

[0013] In the example, the central processing unit 102 includes a main processing core that can be configured to run an operating system and perform conventional or general-purpose tasks. In one example, the central processing unit 102 may include multiple main processing cores that typically run an operating system and perform general-purpose tasks together on the same integrated circuit. The central processing unit 102 also includes built-in logic or programmable function units, which are typically also located on the same integrated circuit as the application processing unit 106 having a heterogeneous instruction set architecture 108. In addition to the multiple general-purpose main processing cores and application processing unit 106, the central processing unit 102 may include function units that are connected to other devices, graphics processing units, and audio or video decoders / encoders, which may include instruction set architectures that are heterogeneous or homogeneous with the main processing cores.

[0014] Instruction set 108 and encryption key 110 may be immutable and inaccessible outside of application processing unit 106. In one example, instruction set 108 is immutable and permanently encoded into an integrated circuit and is inaccessible from outside of application processing unit 106, such as in a non-volatile memory location of central processing unit 102. Similarly, encryption key 110 may be immutable and permanently encoded into an integrated circuit and inaccessible from outside of instruction set 108. For example, encryption key 110 may be stored in a non-volatile memory location within central processing unit 102, accessible by instruction set 108. In one example, encryption key 110 is a symmetric key.

[0015] Mass storage bus 104 is operatively coupled to central processing unit 102 and includes a communication system for transferring block data between central processing unit 102 and mass storage devices, wherein bus 104 may include hardware and communication protocols. In one example, mass storage bus 104 may include multiple protocols such as USB (Universal Serial Bus) or SATA (Serial ATA, or Serial AT Accessory). In one example, instruction set 108 is bus-agnostic because encryption and decryption can be performed for the operatively coupled mass storage devices.

[0016] Figure 2 An example computing device 200 is illustrated, which can be based on computing device 100. Computing device 200 can take many forms, such as tablet computer, personal computer, laptop computer, workstation, server, handheld device, or consumer electronic device, and can be a standalone device or configured as part of a computer network.

[0017] In one hardware configuration, computing device 200 typically includes a processor system with processing units, namely processing device 202 and memory 204. For example, processing device 202 may include multiple processing cores on a chip or multiple processor chips. Example processing device 202 includes a central processing unit 206, which may include a main processing core 208 and an application processing unit 210. In one configuration, the central processing unit includes multiple main processing cores, application processing units, and additional functional units. In some examples, processing device 202 may also include additional processors or dedicated processors, such as a graphics processor for general-purpose computing on integrated processing circuitry or a graphics processing unit, to perform processing functions transferred from central processing unit 206. Memory 204 may be arranged in a hierarchical structure and may include one or more levels of cache. Depending on the configuration and type of computing device, memory 204 may be volatile (such as random access memory (RAM)), non-volatile (such as read-only memory (ROM), flash memory, etc.), or a combination of both. In some examples, memory 204 may be integrated into processing device 202, and a portion of memory 204 may be integrated into central processing unit 206 to store features as instruction set 212 for application processing unit 210 and to store encryption key 214 used with instruction set 212.

[0018] The computing device 200 may also have additional features or functions. For example, the computing device 200 may also include a mass storage device 220 for storing block data. This mass storage device 220 may include removable storage 222 and non-removable storage 224. In one example, the removable storage 222 may include a memory card, a USB drive, and an optical disc. In this example, the removable storage can be easily ejected from the computing device 200. In one example, the non-removable storage 224 may include a solid-state drive, a hard disk drive, and a hybrid drive. In this example, the non-removable storage 224 is intended to remain within the computing system 200. In some examples, the computing device 200 may include removable storage 222 and non-removable storage 224, and may include multiple removable storage devices 222 or multiple non-removable storage devices 224.

[0019] Computer storage media include volatile and non-volatile, removable and non-removable media implemented in a suitable manner or technology for storing information such as computer-readable instructions, data structures, program modules or other data. Memory 204 and mass storage device 220 are examples of computer storage media. Computer storage media include RAM, ROM, EEPROM, flash memory or other storage technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic cassette tape, magnetic tape, disk storage or other magnetic storage devices, USB flash drives, flash memory cards or other flash memory storage devices, or other storage media that can be used to store desired information and can be accessed by computing device 200. Therefore, the propagation of signals itself does not meet the requirements of a storage medium. Any such computer storage medium may be part of computing device 200 and implemented as memory 204 or mass storage device 220.

[0020] Computing device 200 includes a mass storage bus 230 to operatively couple processing device 202 to mass storage device 220. For example, mass storage bus 230 is operatively coupled to application processing unit 210 via central processing unit 206. Mass storage bus 230 is also operatively coupled to mass storage device 220, such as removable storage 222 and non-removable storage 224. Mass storage bus 230 is configured to move block data between processing device 202 and mass storage device 230, and between mass storage device 230 and processing device 202. In one example, mass storage bus 230 may include hardware and communication protocols for moving block data.

[0021] Computing device 200 typically includes input connections, output connections, or input / output connections, such as USB connections, display ports, and proprietary connections, to connect to various devices to provide input and output to the computing device. Input devices may include devices such as keyboards, pointing devices (such as mice and touchpads), styluses, voice input devices, and touch input devices (such as touchscreens). Output devices may include devices such as displays, speakers, and printing devices. An example computing device may include input devices 232 such as keyboards, touchpads, and microphones, and output devices 234 such as displays and speakers. In one example, mass storage bus 230 may use input / output connections to access mass storage devices.

[0022] Computing device 200 typically includes one or more communication connections 236 that allow it to communicate with other computers or applications. Example communication connections may include Ethernet interfaces, wireless interfaces, bus interfaces, storage area network interfaces, and proprietary interfaces. Communication connections can be used to couple computing device 200 to a computer network, which can be categorized based on various characteristics such as topology, connection method, and scale. A network is a collection of computing devices and possibly other devices interconnected through communication channels that facilitate communication and allow the sharing of resources and information among the interconnected devices. Examples of computer networks include local area networks (LANs), wide area networks (WANs), and the Internet. In one example, mass storage bus 230 may use a network to access mass storage devices, such as network drives or cloud drives.

[0023] Figure 3The illustration shows method 300, which can be used, for example, in the production of a central processing unit 206 of computing device 200 or processing device 202. At 302, an application processing unit 210 is allocated within the central processing unit 206. In the example of computing device 200, the application processing unit 210 can be allocated within the central processing unit 206 from a programmable functional unit separate from the main processing core 208. The application processing unit 210 is configured to perform encryption and decryption of data from mass storage devices (such as mass storage device 220 operatively coupled to the central processing unit 206, or mass storage device operatively coupled to the central processing unit via mass storage bus 230). At 304, an immutable encryption key 214 is stored in the central processing unit 206 for use by the application processing unit 210 to perform encryption and decryption of data. The immutable encryption key is inaccessible from outside the application processing unit 210. In the example, application processing unit 210 may be configured to execute instruction set 212 to apply encryption key 214. In one example, instruction set 212 may be included in a computer or processor-readable medium, such as a non-transitory computer-readable medium, to store computer-readable instructions to control the application processing unit allocated in the central processing unit. In one example, instruction set 212 is immutable and inaccessible from outside the central processing unit 206 and is configured during the allocation of the application processing unit at 302. The encryption key may be persistently stored in the central processing unit 206, such as in read-only memory and remain the same for each boot cycle, and may be accessed by instruction set 212.

[0024] Figure 4 An example method 400, executable by instruction set 212, is illustrated. In one example, method 400 may be implemented in a non-transitory computer- or processor-readable medium, such as a memory device, to store computer- or processor-executable instructions for controlling a function programming unit, such as application processing unit 210 in central processing unit 206 or application processing unit 210 in processing device 202. In one example, at 402, the application processing unit intercepts a storage command. For example, the storage command may include input / output commands to mass storage device 220, such as read or write commands. At 404, an immutable encryption key, such as key 214, is accessed in a processor, such as central processing unit 206 or processing device 202. Encryption key 214 is not accessible from outside the application processing unit. At 406, encryption and decryption of data stored on the mass storage device are performed using the encryption key.

[0025] In one example, method 400 can be implemented for a write command, such as when an application executing on processing device 202 writes block data to mass storage device 220. The application creates a data payload or buffer to be written to mass storage device 220 via processing device 202. The application passes the buffer to the operating system storage driver corresponding to the mass storage device. The operating system storage driver generates a request in the mass storage bus format. For example, if the mass storage bus is a SATA bus, the operating system storage driver creates the request in SATA format. The generated request includes a translation from file system semantics to the physical address of the mass storage device. For example, a filename such as C:\README.TXT is translated into a physical address (e.g., 0x1111) mapped to a location on the mass storage device. The operating system storage driver sends the storage request to the mass storage bus. The application processing unit intercepts the storage request via an instruction set that recognizes the storage command, such as at 402. At 404, the instruction set accesses the encryption key, and at 406, the buffer is modified to encrypt the content. In this example, the buffer remains the same size after encryption as before encryption. The instruction set passes storage commands to the mass storage device, and the mass storage device writes the buffered contents to the storage device within the mass storage device.

[0026] In one example, method 400 can be implemented for a read command, such as when a calling application executed on processing device 202 reads block data from mass storage device 220. The calling application requests the address and size of the data to be read via the processing device. The calling application also allocates an empty buffer to the operating system storage driver. The operating system storage driver generates a request in mass storage bus format. For example, if the mass storage bus is a SATA bus, the operating system storage driver makes the request in SATA format. The generated request includes a translation from file system semantics to the physical address of the mass storage device. For example, a filename such as C:\README.TXT is translated into a physical address (e.g., 0x1111) mapped to a location on the mass storage device. The operating system storage driver sends the storage request to the mass storage bus. The application processing unit intercepts the storage request via an instruction set that recognizes the storage command, such as at 402, and passes the read command to the mass storage device. The mass storage device writes the encrypted contents of the buffer. At 404, the application processing unit accesses the encryption key, and at 406, modifies the buffer retrieved from the storage device to decrypt the retrieved contents via the encryption key. In this example, the buffer size remains the same. The application processing unit passes the buffer containing the decrypted content to the operating system driver via the instruction set. The operating system driver then passes the buffer containing the decrypted content to the application, which can then read the data via processing device 202, such as the main processing core.

[0027] While specific examples have been illustrated and described herein, various alternatives and / or equivalent implementations may be used in place of the specific examples shown and described without departing from the scope of this disclosure. This application is intended to cover any modifications or variations of the specific examples discussed herein. Therefore, this disclosure is intended to be limited only by the claims and their equivalents.

Claims

1. A central processing unit for a computing device, the computing device comprising a mass storage bus, the central processing unit comprising: an application processing unit having an instruction set comprising instructions that, when executed by the central processing unit, cause the application processing unit to perform encryption of data and decryption of data stored via the mass storage bus; and an immutable encryption key for the encryption of data and the decryption of data, the immutable encryption key stored in the central processing unit and not accessible from outside the instruction set, wherein the instruction set is immutable and stored in a non-volatile memory location in the central processing unit, the instruction set accessible only from the application processing unit and not accessible from outside the application processing unit, wherein the immutable encryption key is generated prior to installation of an operating system, further comprising a main processing core on an integrated circuit having the application processing unit, wherein the application processing unit is separate from the main processing core.

2. The central processing unit of claim 1, wherein, the central processing unit is configured in the computing device, the central processing unit operably coupled to the mass storage bus, and the mass storage bus operably coupled to a mass storage device.

3. The central processing unit of claim 2, wherein, the mass storage device is one of a removable storage and a non-removable storage.

4. The central processing unit of claim 1, wherein, the immutable encryption key is a symmetric key.

5. The central processing unit of claim 1, wherein, the immutable encryption key is stored in a non-volatile memory location.

6. A method comprising: allocating, within a central processing unit of a computing device, an application processing unit to perform encryption of data to and decryption of data from a mass storage unit operably coupled to the central processing unit; storing, within the central processing unit, an instruction set for the application processing unit to perform the encryption of data to and the decryption of data from a mass storage unit; and storing, in the central processing unit for the application processing unit, an immutable encryption key not accessible from outside the application processing unit, the immutable encryption key for the encryption of data and the decryption of data, wherein the immutable encryption key is generated prior to installation of an operating system, further comprising a main processing core on an integrated circuit having the application processing unit, wherein the application processing unit is separate from the main processing core.

7. The method of claim 6, wherein, storing the immutable encryption key comprises storing the immutable encryption key in a non-volatile memory location in the central processing unit.

8. The method of claim 6, wherein, the instruction set is stored in a non-volatile memory location in the central processing unit and not accessible from outside the central processing unit.

9. A non-transitory computer readable medium for storing computer executable instructions to control an application processing unit allocated in a processor to: access an immutable encryption key stored in the processor, the encryption key not accessible from outside the application processing unit; accessing a set of instructions stored in the processor, the set of instructions being inaccessible from outside the application processing unit; and using the set of instructions, performing encryption of data and decryption of data on data stored via a mass storage bus using the immutable encryption key, the immutable encryption key being stored in the processor and inaccessible from outside the set of instructions, wherein the immutable encryption key is generated prior to installation of an operating system, further comprising a main processing core on an integrated circuit with the application processing unit, wherein the application processing unit is separate from the main processing core.

10. The non-transitory computer readable medium of claim 9, comprising intercepting a store command.

11. The non-transitory computer-readable medium of claim 9, wherein, The non-transitory computer readable medium is located within the processor.

12. A computer program product comprising program instructions which, when executed by a processor, carry out the steps of the method according to any one of claims 6 to 8.

Images