Secure Data Recorder Masking and Erasure Method
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection methods, such as full disk encryption, are ineffective when a device is stolen or compromised while powered on, and do not protect against malicious software installed on the device, especially for data recorders that operate continuously.
Innovation Solution
A method where a data recorder generates masked data by combining record data with pseudo-random masking data stored in persistent memory, which is then erased, allowing secure storage of sensitive data inaccessible to unauthorized users, even if the recorder is captured or compromised, using deterministic pseudo-random generation and public-key encryption for secure decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full disk encryption is used to protect sensitive data, then data protection is improved when the device is powered off, but data becomes vulnerable when the device is powered on or stolen
Solution Approach 1:
The system pre-generates and stores pseudo-random masking data in persistent memory before actual data recording occurs. This preliminary action ensures that when sensitive data needs to be recorded, the masking data is already available in the memory, allowing immediate encryption without requiring the device to remain powered on with security credentials active.
Solution Approach 2:
The invention extracts the security credentials (masking data generation parameters) from the operational memory space and stores them securely in persistent memory in an encrypted form. This separation allows the system to protect data at rest without requiring the credentials to be present in volatile memory during operation, thus eliminating the vulnerability window.
2Reliability
If masking data is stored in persistent memory for later use, then data can be encrypted securely, but the persistent memory consumes additional storage space
Solution Approach 1:
The system changes the state of the masking data by storing it in an encrypted form in persistent memory rather than in plain text. This parameter change (from plaintext to encrypted form) maintains security while enabling the masking data to be stored efficiently in persistent memory without requiring additional security infrastructure.
3Productivity
If the data recorder operates continuously to capture data, then data recording capability is improved, but vulnerability to capture while powered on increases
Solution Approach 1:
The system performs preliminary encryption by combining data with masking data immediately upon data generation, rather than encrypting later. This ensures that sensitive data never exists in an unencrypted state in the system, allowing continuous operation without security gaps.
Solution Approach 2:
The invention converts the continuous operation requirement (which creates vulnerability) into a benefit by using the operational state to continuously generate and apply masking data through deterministic pseudo-random generation. The continuous power state, which was previously a security risk, becomes advantageous by enabling real-time data masking without requiring periodic power cycles.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and apparatus for securely encrypting data is disclosed. Conventional protections against the loss or theft of sensitive data such as full disk encryption are not effective if the device is, or has recently been, running when captured or found because the keys used for full disk encryption will still be in memory and can be used to decrypt the data stored on the disk. Some devices, such as devices which gather sensitive data in use, must run in environments in which they might be captured by a person seeking access to the sensitive data already recorded by the device. An encryption method is proposed in which files on a recorder's persistent memory are initialised with pseudo-random masking data whilst the recorder is in a relatively secure environment. One or more parameters which can be used to re-create the pseudo-random masking data are encrypted with a public key using a public-key encryption algorithm and stored on the recorder. The device's memory is then purged to remove the one or more parameters. Later, when miming in a relatively insecure environment, the sensitive data is encrypted (414) using a symmetric encryption algorithm, and combined (418) with the masking data previously stored in the storage file. When the encrypted files are transferred to a reader device with access to the corresponding private key, the masking data can be recreated, the symmetric encryption reversed and the sensitive data recovered. However, an adversary without the private key cannot recreate the masking data, and is thus unable to recover the sensitive data even with the symmetric encryption key which he might successfully extract from the recorder's volatile memory.