Bus Encryption for Removable Storage Detachment Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data centers, especially those involved in cloud computing and remote locations, face vulnerabilities to physical attacks that can lead to data leakage and tampering, as existing encryption methods are ineffective in protecting data when storage devices are physically accessed or detached, and data in transit remains unprotected.
Innovation Solution
Implementing a session key negotiated between the CPU and removable storage disks to encrypt and authenticate data, using client, device, and mutual authentication to generate the session key, and storing disk at rest keys in secure memory separate from regular memory to prevent unauthorized access, thereby creating a secure communication channel and protecting data both at rest and in transit.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored on removable devices without encryption, then ease of operation and access is improved, but security against physical attacks deteriorates
Solution Approach 1:
The system performs preliminary authentication and session key establishment before any data access operations. The CPU authenticates with the removable device and establishes a encrypted session key in advance, ensuring that even if the device is physically accessed later, the data remains protected without affecting normal operational ease
2Object-affected harmful factors
If encryption is implemented for data protection, then security against physical attacks is improved, but device complexity increases
Solution Approach 1:
The patent introduces a session key as an intermediary between the CPU and removable device for data protection. Instead of implementing complex encryption directly in the storage device, the session key mediates the encryption/decryption process during data transfer, simplifying the overall system while maintaining security
Solution Approach 2:
The system dynamically changes encryption parameters by establishing session-specific encryption keys for each authentication session. This allows the same hardware to provide security without permanent complex encryption circuitry, as the encryption parameters are temporarily generated and discarded after each session
3Object-affected harmful factors
If data is encrypted at rest on removable devices, then security against unauthorized access is improved, but data access speed deteriorates
Solution Approach 1:
The encryption system transitions from static to dynamic operation. During the authentication phase, the session key is established and active, enabling fast encrypted data transfer. After authentication completes, the encrypted device can be detached without maintaining active encryption processing, thus achieving both security and speed
Data Source
AI summary
The present disclosure relates to devices and methods for protecting data from physical attacks. The devices and methods may establish an encryption protocol to encrypt data transmitted over a bus to one or more removable devices in communication with a computer device. The devices and methods may use the encryption protocol to communicate with the removal devices and perform storage requests at the removal devices. The devices and methods may also perform another layer of encryption on the data stored at the removal devices using a data at rest key stored on the removal devices.