Storage Device Key Wrapping for Brute Force Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing ATA security mechanism for data storage devices can be circumvented through brute force media scans or swapping of electronics cards, failing to provide adequate protection against unauthorized access.
Innovation Solution
Implementing bulk encryption using a key derivation function to generate and manage encryption keys, where intermediate and bulk encryption keys are wrapped and stored securely in non-volatile memory, ensuring only authorized access can decrypt the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ATA security mechanism is used for data protection, then access control is provided, but security can be circumvented through brute force media scans or swapping electronics cards
Solution Approach 1:
The patent introduces an intermediate encryption key as a mediator between the initial encryption key (derived from ATA passwords) and the bulk encryption key. This intermediate key is wrapped with the initial encryption key and stored in non-volatile memory, creating an additional security layer that prevents direct access to the bulk encryption key and mitigates brute force attacks and electronics card swapping vulnerabilities
Solution Approach 2:
The encryption key management is segmented into multiple hierarchical levels: initial encryption key, intermediate encryption key, and bulk encryption key. This segmentation distributes security functions across multiple keys stored in different locations (some in volatile memory, others wrapped and stored in non-volatile memory), making it harder for attackers to compromise the entire security system through a single point of failure
2Reliability
If bulk encryption is implemented with multiple wrapped keys, then data security is enhanced, but device complexity increases
Solution Approach 1:
The intermediate encryption key is pre-wrapped with the initial encryption key and stored in non-volatile memory before actual data encryption operations. This preliminary wrapping action establishes a secure key hierarchy in advance, so that during normal operation, the system only needs to perform straightforward key unwrapping and data encryption/decryption, reducing real-time computational complexity while maintaining strong security
Data Source
AI summary
A data storage device encrypts data stored in non-volatile memory using a bulk encryption key. The data storage device uses a key derivation function to generate an initial encryption key. The data storage device then wraps an intermediate encryption key with the initial encryption key and stores the wrapped intermediate key in the non-volatile memory. The data storage device wraps the bulk encryption key with the intermediate encryption key and stores the wrapped bulk encryption key in the non-volatile memory. The data storage device can unwrap the wrapped intermediate key to generate the intermediate encryption key using the initial encryption key. The data storage device can unwrap the wrapped bulk encryption key to generate the bulk encryption key using the intermediate encryption key. The data storage device decrypts data stored in the non-volatile memory using the bulk encryption key.