US 11,775,657 B2Granted

Systems and methods for enhancing security of device-internal encryption with externally generated entropy

AssigneeMicrosoft Technology Licensing, LLC

InventorKirill Motil

Life of this patent

Estimating the term…

Loading patent…

Abstract

Enhancing security achieved via encryption that is performed within an encryption device by combining entropy that is generated within the encryption device with additional entropy, that is generated external to the encryption device, into the generation of an encryption key. Prior to an encryption device utilizing a deterministic algorithm to generate the encryption key, multiple random numbers may be obtained from different entropy sources—at least one of which is internal to the encryption device and at least one of which is external to the encryption device. The encryption device combines the multiple random numbers into a combined entropy input that cannot be determined from either one of the random numbers alone. This combined entropy input is then utilized to generate the encryption key that is ultimately used to perform the device-internal encryption.

Claims13

Dependent claims

A system for enhancing security of device-internal encryption with externally generated entropy, the system comprising:

a host operating system (OS) that is communicatively coupled to a Self-Encrypting Drive and that is communication with a remote network entropy source, the host OS configured to:
transmit data that is generated by an application to the Self-Encrypting Drive;
receive, from the remote network entropy source, a public key that is generated as part of an asymmetric key pair by the remote network entropy source;
provide the public key for storage in the Self-Encrypting Drive;
receive, from the remote network entropy source, a communication including a first random number and a signature generated using a private key, the private key generated as part of the asymmetric key pair by the remote network entropy source;
authenticate the communication using the public key stored in the Self-Encrypting Drive;
and
provide the first random number to an encryption controller that is embedded within the Self-Encrypting Drive;
and
the encryption controller configured to:
receive a second random number from a drive entropy source that is embedded within the Self-Encrypting Drive;
receive the first random number from the host OS;
generate an encryption key based on a combination of the first random number and the second random number;
encrypt the data, that is generated by the application, into encrypted data in accordance with the encryption key;
and
write the encrypted data to a storage medium that is embedded within the Self-Encrypting Drive.

13 more elements

A computer-implemented method, comprising:

transmitting, by a host operating system (OS) of a host device and to an encryption device of the host device, data that is generated by an application;
receiving, by the host OS and from a remote network entropy source, a public key that is generated as part of an asymmetric key pair by the remote network entropy source;
providing, by the host OS, the public key for storage in the encryption device;
receiving, by the host OS and from the remote network entropy source, a communication including a first random number generated using a first random generator and a signature generated using a private key, the private key generated as part of the asymmetric key pair by the remote network entropy source;
authenticating, by the host OS, the communication using the public key stored in the encryption device;
providing, by the host OS, the first random number to the encryption device;
generating, locally within the encryption device, a second random number using a second random number generator that is embedded within the encryption device;
receiving, at the encryption device and from the host OS, the first random number;
generating a combined entropy input by combining the first random number and the second random number via a first algorithm;
generating an encryption key by applying a second algorithm to the combined entropy input;
and
encrypting the data in accordance with the encryption key.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/071,993Filed 15 Oct 2020
Published: US 2022/0121755 A121 Apr 2022
Granted: 3 Oct 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/602
Protecting data: providing cryptographic facilities or services
G06F 9/54
Multiprogramming arrangements: interprogram communication
G06F 21/72
To assure secure computing or processing of information: in cryptographic circuits
G06F 21/79
To assure secure storage of data: in semiconductor storage media, e.g. directly-addressable memories