Merging external NVRAM with full disk encryption
View Patent ↗Methods and arrangements for managing a flash drive, hard disk, or connection between the two, in a manner to ensure that sensitive data is not decrypted at any time when it would be vulnerable. Accordingly, in a first implementation, the data may preferably be encrypted as it first goes into a flash drive and decrypted when it comes out of the flash drive. In another implementation, the flash drive may be logically bound to the hard disk, so that they would both use the same encryption key. In yet another implementation, if a hard disk is moved to another system, then the flash drive may also preferably be simultaneously moved.
1. A system comprising:
a main memory;
a full disk encryption hard drive;
a non-volatile cache memory for said full disk encryption hard drive which stores data cached for said full disk encryption hard drive;
an encryption module which encrypts data prior to storage in said non-volatile cache memory.
2. The system according to claim 1 , wherein said encryption module acts to:
encrypt data which enters the non-volatile cache memory; and
decrypt data which leaves the non-volatile cache memory.
3. The system according to claim 1 , wherein said encryption module comprises a common encryption key employed both by said hard drive and by said non-volatile cache memory.
4. The system according to claim 3 , wherein said encryption module acts to encrypt data which enters the non-volatile cache memory.
5. The system according to claim 4 , wherein said encryption module acts to pass already-encrypted data from said non-volatile cache memory to said hard drive.
6. The system according to claim 3 , wherein:
said common encryption key comprises a first encryption key; and
said encryption module acts to establish a second common encryption key upon a change involving said first encryption key.
7. The system according to claim 3 , wherein:
said common encryption key comprises a first encryption key; and
said encryption module acts to establish a second common encryption key upon a severance of communication between said non-volatile cache memory and said hard drive.
8. The system according to claim 3 , wherein:
said common encryption key comprises a first encryption key; and
said encryption module acts to establish a second common encryption key upon removal of said hard drive and upon an establishment of communication between said non-volatile cache memory and a different hard drive.
9. The system according to claim 1 , wherein said non-volatile cache memory comprises a flash drive.
10. A method comprising:
providing full disk encryption of hard drive contents;
storing in a non-volatile cache memory for a full disk encryption hard drive data which is cached for the full disk encryption hard drive; and
encrypting data prior to storage in the non-volatile cache memory.
11. The method according to claim 10 , wherein:
said encrypting comprises encrypting data which enters the non-volatile cache memory; and
said method further comprises decrypting data which leaves the non-volatile cache memory.
12. The method according to claim 10 , wherein said encrypting comprises providing a common encryption key which is employed both by the hard drive and by the non-volatile cache memory.
13. The method according to claim 12 , wherein said encrypting comprises encrypting data which enters the non-volatile cache memory.
14. The method according to claim 13 , further comprising passing already-encrypted data from the non-volatile cache memory to the hard drive.
15. The method according to claim 12 , wherein:
the common encryption key comprises a first encryption key; and
said encrypting further comprises establishing a second common encryption key upon a change involving the first encryption key.
16. The method according to claim 12 , wherein:
the common encryption key comprises a first encryption key; and
said encrypting further comprises establishing a second common encryption key upon a severance of communication between the non-volatile cache memory and the hard drive.
17. The method according to claim 12 , further comprising:
removing the hard drive;
establishing communication between the non-volatile cache memory and a different hard drive;
the common encryption key comprising a first encryption key; and
said encrypting further comprising establishing a second common encryption key which is employed both by the different hard drive and by the non-volatile cache memory.
18. The method according to claim 10 , further comprising: moving the hard drive; and
maintaining communication between the non-volatile cache memory and the hard drive during moving of the hard drive.
19. The method according to claim 10 , wherein the non-volatile cache memory comprises a flash drive.
20. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform steps comprising:
providing full disk encryption of hard drive contents;
storing in a non-volatile cache memory for a full disk encryption hard drive data which is cached for the full disk encryption hard drive; and
encrypting data prior to storage in the non-volatile cache memory.