Self-Encrypting Drive Key Generation with External Entropy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Self-Encrypting Drives (SEDs) face security vulnerabilities due to deterministic encryption key generation, where compromised internal entropy sources can be easily reproduced by malicious entities, leading to inadequate protection of encrypted data.
Innovation Solution
Incorporating a combination of internal and external entropy sources to generate encryption keys, using a deterministic algorithm, where internal and external entropy inputs are combined via an additive cipher like XOR to create a combined entropy input that cannot be discerned from either source alone, thereby enhancing key security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are generated using only device-internal entropy sources, then the key generation process is simple and self-contained, but the security is compromised because internal entropy sources can be reproduced by malicious entities
Solution Approach 1:
The patent combines multiple entropy sources (device-internal RNG and device-external entropy sources) to generate the encryption key. The key generation process integrates both internal and external entropy inputs, creating a hybrid key that leverages the strengths of both sources while mitigating their individual weaknesses. This merging approach ensures that even if one source is compromised, the other maintains security.
Solution Approach 2:
The patent introduces a key generation module as an intermediary that processes and combines entropy from multiple sources. This mediator component securely manages the integration of internal and external entropy, ensuring that the final encryption key cannot be reproduced by accessing only one source. The intermediary architecture provides a controlled interface for combining entropy sources while maintaining security boundaries.
2Reliability
If deterministic algorithms are used for encryption key generation, then the key generation is reproducible and consistent, but the security is weakened because the input entropy can be guessed or reproduced
Solution Approach 1:
The patent changes the parameters of the key generation process by incorporating multiple entropy sources with different characteristics. Instead of relying on a single entropy parameter, the system uses a combination of internal RNG outputs and external entropy inputs, each contributing different unpredictability characteristics. This parameter diversification makes the overall key generation process more resistant to guessing attacks while maintaining deterministic processing of the combined inputs.
Data Source
AI summary
Enhancing security achieved via encryption that is performed within an encryption device by combining entropy that is generated within the encryption device with additional entropy, that is generated external to the encryption device, into the generation of an encryption key. Prior to an encryption device utilizing a deterministic algorithm to generate the encryption key, multiple random numbers may be obtained from different entropy sources—at least one of which is internal to the encryption device and at least one of which is external to the encryption device. The encryption device combines the multiple random numbers into a combined entropy input that cannot be determined from either one of the random numbers alone. This combined entropy input is then utilized to generate the encryption key that is ultimately used to perform the device-internal encryption.