ATM Hard Disk Key Segmentation for Offline Boot Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for securing automated teller machines (ATMs) with encrypted hard drives face issues such as network connectivity problems, time-consuming re-encryption processes, and potential security breaches due to stored encryption keys being accessible to unauthorized actors.
Innovation Solution
A dynamic pre-boot hard disk encryption key management system that stores encryption keys locally on the ATM, splitting and encrypting the key into parts, storing them in a hidden partition, and using a key encryption key (KEK) with obfuscation methods, which can be updated randomly at each boot, either locally or remotely, to enhance security and reduce network bandwidth requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the encryption key is stored on a remote server, then security is improved, but network connectivity issues prevent the ATM from booting
Solution Approach 1:
The encryption key is divided into multiple parts and stored in different locations (remote server, local secure storage, and unencrypted portion of the encrypted drive). This segmentation allows the system to boot using locally stored key parts even when network connectivity to the remote server is unavailable, while still maintaining security through the distributed key architecture.
2Ease of operation
If the encryption key is stored in a designated unencrypted area of the hard drive, then boot capability is maintained, but security is compromised if the key is identified
Solution Approach 1:
The encryption key is segmented into multiple parts distributed across different storage locations. Only a threshold number of parts are needed to reconstruct the full key, and these parts are stored in both encrypted and unencrypted areas. This allows boot capability to be maintained while reducing the risk that compromising a single location exposes the entire key.
Solution Approach 2:
The key management system uses a nested structure where encrypted portions of the drive contain encrypted key parts, while unencrypted portions contain unencrypted key parts. This nested arrangement allows the system to maintain boot capability through multiple layers of protection, where each layer provides different security characteristics.
3Reliability
If the encryption key is stored using a TPM, then security is improved, but hardware monitoring can identify the key
Solution Approach 1:
The encryption key is divided and stored in multiple locations including secure hardware (TPM), local secure storage, and unencrypted drive portions. This segmentation prevents a single point of failure and reduces the effectiveness of hardware monitoring attacks, as attackers would need to compromise multiple distributed storage locations simultaneously.
Solution Approach 2:
The system introduces intermediate storage layers between the TPM and the encrypted data. Instead of directly relying on TPM alone, the key is distributed through multiple intermediaries (local secure storage, unencrypted drive portions), which dilutes the impact of any single intermediary being compromised through hardware monitoring.
4Reliability
If the entire hard drive is re-encrypted with a new key, then security is improved, but the process is time consuming
Solution Approach 1:
The encryption key is segmented into multiple parts stored in different locations. When security updates are needed, only specific key parts need to be updated rather than re-encrypting the entire drive. This segmented approach allows for faster key rotation and security updates without the time-consuming full drive re-encryption process.
Data Source
AI summary
A system and method for operating a terminal such as an automated teller machine or other type of self-service terminal having a primary partition of a hard disk encrypted with a disk encryption key (DEK). At the initial installation and after every boot, a pre-boot manager encrypts the DEK with a new key encryption key (KEK) and then splits the encrypted DEK into a plurality of encrypted DEK parts. The pre-boot manager next stores the plurality of encrypted DEK parts in randomized storage locations on an unallocated portion of a hard disk and encrypts a list of the randomized storage locations of the plurality of encrypted DEK parts with the KEK and storing the encrypted list in a location on the unallocated portion of the hard disk. Finally, the pre-boot manager stores the KEK, optionally in an obfuscated format, in a location on the unallocated portion of the hard disk.