Centrally Managed Partition Encryption for Remote Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions fail to effectively protect data stored on remote computers from unauthorized access, especially when the computers are disconnected from the network or physically stolen, as they either require interactive sessions for encrypted data access or do not provide persistent security measures.
Innovation Solution
A method and apparatus for centrally managed partition encryption, where a cryptokey is generated on a main computer, stored on the main computer, and provided to a remote computer for mounting an encrypted operative partition, which is unmounted and erased if the remote computer is disconnected, ensuring data access only when authenticated by the main computer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is encrypted and keys are stored on the medium itself, then data can be accessed independently, but the attacker has access to both the key and data, making security ineffective
Solution Approach 1:
The patent extracts the encryption key from the storage medium and stores it separately on a remote server. The key is only provided to the local computer when an authenticated session is established, preventing attackers from obtaining both the encrypted data and decryption key simultaneously.
Solution Approach 2:
The patent introduces a remote server as an intermediary that holds and manages the encryption keys. The server acts as a mediator between the user and the encrypted data, providing keys only after authentication, thus enabling secure remote access while maintaining data protection.
2Productivity
If a Trojan Horse application collects data from ongoing usage, then the computer can function normally, but the collected data becomes available to the attacker when the computer is physically captured
Solution Approach 1:
The patent encrypts data before it is written to the storage medium during normal operations. This preliminary encryption ensures that even if a Trojan Horse collects data during usage, the stolen data remains encrypted and unusable without the decryption key that is stored separately on the remote server.
3Ease of operation
If the root partition is altered to disable remote host protection, then the computer can be accessed freely, but network security is compromised
Solution Approach 1:
The patent implements encryption and authentication mechanisms before the system is compromised. The encryption is applied to data at rest and in transit, and authentication is required before key provision, creating security barriers that prevent attackers from disabling protections by altering the root partition.
4Reliability
If encrypted data requires interactive session for access, then security is maintained, but the solution is not suitable for appliances or servers
Solution Approach 1:
The patent uses a remote server as an intermediary to provide encryption keys to local computers, appliances, or servers. This architecture allows automated key provision without requiring interactive user sessions, making the solution suitable for headless devices, appliances, and servers while maintaining security through centralized key management and authentication.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
A method and apparatus for protecting a remote computer connected through a network to a main computer, by creating a cryptokey on the main computer, supplying the cryptokey to the remote computer and mounting a partition on the remote computer using the cryptokey. The cryptokey is not persistently stored on the remote computer but rather saved in its memory, and the connection of the remote computer to the main computer is periodically tested. Once the remote computer is disconnected, the encrypted partition is unmounted and the cryptokey is erased form the memory, thus disabling access of an attacker to data stored in the encrypted partition. The method incorporates swap partition encryption using a cryptokey created each time during the boot of the remote computer.