Security for storage devices
AssigneeLenovo (Singapore) Pte. Ltd.
InventorsDavid C. Challener, Steven D. Goodman, Randall S. Springfield, Jeffrey R. Hobbet
Life of this patent
Estimating the term…
Abstract
The invention broadly contemplates a security solution for storage devices that is inexpensive and robust. The invention allows a store of system specific data to be used to release the hard disk key of full-disk encryption (FDE) drives. This system specific data is passed to the FDE drives and used to calculate the actual encryption key. This allows for safe disposal of an FDE drive containing confidential data, as the lack of available system specific decryption data makes decryption virtually impossible.
Claims14
An apparatus comprising:
- at least one processor;
- and
- at least one tangible storage device configured in a RAID array;
- wherein the at least one tangible storage device comprises at least one unencrypted section and at least one encrypted section;
- and
- wherein the at least one unencrypted section tangibly embodies a program of instructions that when executed by the at least one processor enable the apparatus to:
- obtain apparatus specific data;
- generate a password based on the apparatus specific data;
- encrypt the password for storage on the at least one unencrypted section;
- and
- decrypt a disk encryption key stored within the at least one tangible storage device and permit access to the at least one encrypted section responsive to receiving the password;
- wherein the at least one tangible storage device comprises a full-disk encryption (FDE) drive;
- the apparatus further comprising:
- at least one RAID controller;
- wherein a plurality of FDE drives are operatively connected to the at least one processor via the RAID controller;
- and
- wherein the program of instructions further enables the apparatus to communicate the password to the plurality of FDE drives at boot-up.
A method comprising:
- obtaining apparatus specific data from a computing device having at least one processor and at least one tangible storage device configured in a RAID array, the at least one tangible storage device comprised of at least one unencrypted section and at least one encrypted section;
- generating a password based on the apparatus specific data;
- encrypting the password for storage on the at least one unencrypted section;
- and
- responsive to receiving the password, decrypting a disk encryption key stored within the at least one tangible storage device with the password and permitting access to the at least one encrypted section;
- wherein the at least one tangible storage device comprises a full-disk encryption (FDE) drive;
- wherein a plurality of full-disk encryption (FDE) drives are operatively connected to the at least one processor via a RAID controller;
- and
- wherein the password is communicated to the plurality of FDE drives at boot-up.
A program storage device readable by machine, tangibly embodying a program of instructions that when executed by at least one processor of the machine enables the machine to:
- obtain apparatus specific data from a computing device having at least one processor and at least one tangible storage device configured in a RAID array, the at least one tangible storage device comprised of at least one unencrypted section and at least one encrypted section;
- generate a password based on the apparatus specific data;
- encrypt the password for storage on the at least one unencrypted section;
- and
- responsive to receiving the password, decrypt a disk encryption key stored within the at least one tangible storage device with the password and permit access to the at least one encrypted section;
- wherein the at least one tangible storage device comprises a full-disk encryption (FDE) drive;
- wherein a plurality of full-disk encryption (FDE) drives are operatively connected to the at least one processor via a RAID controller;
- and
- wherein the password is communicated to the plurality of FDE drives at boot-up.
Dependencies are inferred from the claim text.