Data Security Including Real-Time Key Generation
Methods for providing data security are described. A security device ( 10 ) and a plug-in device ( 30 ) work in conjunction to enable encryption and decryption of data. A secret is stored by one of the security device ( 10 ) or the plug-in device ( 30 ). While the secret is required for constructing a key, the key cannot be constructed from the secret alone. Unauthorized devices or users are thereby prevented from accessing the key.
1 . A method of providing data security in a security device, comprising:
coupling a plug-in device to a security device, the security device controlling an encryption or decryption of data to or from an associated storage device;
when a data encryption or decryption operation is required, retrieving a secret from a plug-in device;
recovering a host seed from the secret; and
generating a key from the host seed to be used in the encryption or decryption of data.
2 . The method of claim 1 , further comprising encrypting or decrypting data with the key.
3 . The method of claim 1 , where recovering a host seed from the secret comprises descrambling a mixed seed with a random number.
4 . The method of claim 3 , further comprising receiving the random number from the plug-in device.
5 . The method of claim 1 , where generating a key from the host seed comprises generating the key from the host seed and a device seed.
6 . The method of claim 1 , where the method further comprises authenticating the security device prior to retrieval of the secret.
7 . The method of claim 6 , where authenticating comprises encrypting a random number to create an encrypted random number, sending the encrypted random number to the plug-in device and receiving a success message from the plug-in device.
8 . The method of claim 6 , where successfully authenticating the plug-in device is required to perform the step of creating a key from the host seed.
9 . The method of claim 1 , further comprising:
detecting that the plug-in device has been disconnected from a security device; and
in response to detecting the disconnection, removing the key from memory or disabling any encrypting or decrypting functions.
10 . A method of providing data security, comprising:
receiving a request to facilitate secure encryption or decryption operations;
providing a randomly generated number;
receiving a secret created from the randomly generated number and a host seed; and
storing the secret until run-time.
11 . The method of claim 10 , further comprising:
authenticating a requestor of the mixed seed; and
providing the mixed seed to the requestor after successfully authenticating the requester.
12 . The method of claim 11 , where authenticating the requestor comprises:
encrypting a randomly generated number to create a locally encrypted randomly generated number;
comparing the locally encrypted randomly generated number with an encrypted randomly generated number received from the requestor; and
determining if there is a match, and if so, providing the secret to the requester.
13 . The method of claim 11 , further comprising performing a validation step, including determining whether a sequence of data received from the requester matches a stored sequence of data.
14 . The method of claim 11 , wherein the randomly generated number provided in the providing step is the randomly generated number encrypted to create a locally encrypted randomly generated number.
15 . A plug-in device for providing data security, comprising:
a random number generator to generate a random number;
an encryption engine to encrypt the random number;
a matching engine to compare the encrypted random number to a received encrypted random number; and
a memory for storing a secret to be shared with a security device if the matching engine determines a match has been made.
16 . The plug-in device of claim 15 , where the matching engine is configured to determine whether a number encrypted by the encryption engine matches a received encrypted number.
17 . The plug-in device of claim 15 , where the memory is configured to store a mixed seed that has been combined with a random number generated by the random number generator.
18 . The plug-in device of claim 15 , wherein:
the memory is configured to store an authentication key used by the encryption engine to encrypt a random number generated by the random number generator; and
the matching engine determines whether the random number encrypted with the encryption key matches a received encrypted random number.
19 . The plug-in device of claim 15 , where the plug-in device is a smart card.
20 . A security device, comprising:
a means for connecting to a host computer for receiving a host seed;
a memory configured to store at least one of a device seed or a random number; and
a processor configured to hide the host key in a secret, extract the host seed from the secret and create a key from the host seed but only when coupled to an authenticated device that stores the secret.
21 . The security device of claim 20 , further comprising a means for connecting to a plug-in device to enable communication of the secret between the security device and the authenticated device.
22 . The security device of claim 20 , further comprising a means for connecting to a data storage device, the data storage device storing data encrypted using the key.
23 . A system for securing data, comprising:
a host computer;
a security device comprising:
a means for connecting to the host computer for receiving a host seed;
a memory for storing at least one of a device seed or a random number; and
a processor configured to hide the host key in a secret, extract the host seed from the secret and create a key from the host seed but only when coupled to an authenticatable device that stores the secret;
an authenticatable device configured to generate the random number and to store the secret; and
data storage for storing encrypted data.
24 . The system of claim 23 , where the security device further comprises means for connecting to the data storage.
25 . The system of claim 23 , where the processor creates the key from the host seed and the device seed.
26 . A computer-readable medium including instructions, which when executed by a processor, causes the processor to perform the operations of:
coupling a plug-in device to a security device, the security device controlling an encryption or decryption of data to or from an associated storage device;
when a data encryption or decryption operation is required, retrieving a secret from a plug-in device;
recovering a host seed from the secret; and
generating a key from the host seed to be used in the encryption or decryption of data.
27 . The computer-readable medium of claim 26 , further comprising instructions to cause the processor to perform the operations of encrypting or decrypting data with the key.
28 . The computer-readable medium of claim 26 , where recovering a host seed from the secret comprises descrambling a mixed seed with a random number.
29 . The computer-readable medium of claim 26 , further comprising instructions to cause the processor to perform the operations of receiving the random number from the plug-in device.
30 . The computer-readable medium of claim 26 , where generating a key from the host seed comprises generating the key from the host seed and a device seed.
31 . The computer-readable medium of claim 26 , where the method further comprises authenticating the security device prior to retrieval of the secret.
32 . The computer-readable medium of claim 31 , where authenticating comprises encrypting a random number to create an encrypted random number, sending the encrypted random number to the plug-in device and receiving a success message from the plug-in device.
33 . The computer-readable medium of claim 31 , where successfully authenticating the plug-in device is required to perform the step of creating a key from the host seed.
34 . The computer-readable medium of claim 26 , further comprising instructions to cause the processor to perform the operations of:
detecting that the plug-in device has been disconnected from a security device; and
in response to detecting the disconnection, removing the key from memory or disabling any encrypting or decrypting functions.
35 . A computer-readable medium including instructions, which when executed by a processor, causes the processor to perform the operations of:
receiving a request to facilitate secure encryption or decryption operations;
providing a randomly generated number;
receiving a secret created from the randomly generated number and a host seed; and
storing the secret until run-time.
36 . The computer-readable medium of claim 35 , further comprising instructions to cause the processor to perform the operations of:
authenticating a requestor of the mixed seed; and
providing the mixed seed to the requestor after successfully authenticating the requestor.
37 . The computer-readable medium of claim 36 , where authenticating the requestor comprises:
encrypting the randomly generated number to create a locally encrypted randomly generated number;
comparing the locally encrypted randomly generated number with an encrypted randomly generated number received from the requester; and
determining if there is a match, and if so, providing the secret to the requester.
38 . The computer-readable medium of claim 36 , instructions to cause the processor to perform the operations of performing a validation step, including determining whether a sequence of data received from the requestor matches a stored sequence of data.