Anti-wikileaks USB/CD device
View Patent ↗A method for encrypting and storing data on a removable medium includes: obtaining a medium key uniquely associated with the removable medium; encrypting the data using the medium key to generate encrypted data; and writing the encrypted data onto the removable medium.
1. A method for encrypting and storing data on a removable medium when coupled to a computer, the method comprising:
storing a medium key uniquely associated with the removable medium in a memory remote from the computer and accessible by the computer via a network, wherein the memory is accessible only by computers in a particular enterprise;
providing an encrypting input/output system (EIOS) executing on the computer to obtain the medium key associated with the removable medium, wherein all the data input/output to/from the removable medium, when coupled to the computer, passes through the EIOS;
when the removable medium is coupled to the computer, detecting by the EIOS whether the data on the removable medium is encrypted;
when the data on the removable medium is unencrypted allowing access to the unencrypted data;
when the data on the removable medium is encrypted, authenticating the computer for access to the memory remote from the computer by determining that the computer is in the particular enterprise;
obtaining, by the computer, the medium key uniquely associated with the removable medium, when the computer is authenticated;
decrypting, by the computer, the encrypted data on the removable medium, using the medium key to generate decrypted data;
encrypting, by the computer, data to be written to the removable medium, using the medium key to generate encrypted data; and
writing, by the computer, the encrypted data onto the removable medium, wherein the medium key is not stored in the removable medium, wherein, when the removable medium is previously initialized, the obtaining the medium key associated with the removable medium comprises:
reading a medium identifier from the removable medium; and
querying memory remote from the computer using the medium identifier to authenticate the computer and retrieve the medium key associated with the removable medium, and wherein, when the removable medium is previously initialized, the obtaining the medium key associated with the removable medium comprises:
using an encryption key associated with a destination encrypting input/output system to decrypt an encrypted medium key, the encrypted medium key being stored on the memory remote from the computer.
2. The method of claim 1 , wherein, when the removable medium is being initialized, the obtaining the medium key associated with the removable medium comprises:
generating a medium identifier associated with the removable medium;
initializing the removable medium by writing the medium identifier onto the removable medium; and
generating the medium key.
3. The method of claim 2 , wherein the storing the medium key comprises:
associating the medium key with the medium identifier; and
storing the medium key with the associated medium identifier in memory remote from the computer.
4. The method of claim 2 , wherein the storing the medium key comprises:
encrypting the medium key to generate an encrypted medium key, the medium key being encrypted with an encryption key associated with a destination encrypting input/output system; and
writing the encrypted medium key onto the memory remote from the computer.
5. The method of claim 1 , further comprising separating unencrypted data read from the removable medium from encrypted data read from the removable medium.
6. A system for encrypting and storing data on a removable medium when coupled to a computer, the system comprising:
a hardware memory remote from the computer and accessible by the computer via a network for storing a medium key uniquely associated with the removable medium in, wherein the memory is accessible only by computers in a particular enterprise;
an encrypting input/output system (EIOS) executing on the computer to obtain the medium key associated with the removable medium, wherein all the data input/output to/from the removable medium, when coupled to the computer, passes through the EIOS, wherein the EIOS:
detects whether the data on the removable medium is encrypted, when the removable medium is coupled to the computer,
allows access to the unencrypted data, when the data on the removable medium is unencrypted, and
authenticate the computer for access to the memory remote by determining that the computer is in the particular enterprise, when the data on the removable medium is encrypted,
wherein the computer:
obtains the medium key associated with the removable medium, when the computer is authenticated;
decrypts the encrypted data on the removable medium, using the medium key to generate decrypted data;
encrypts the data to be written to the removable medium, using the medium key to generate encrypted data, and
writes the encrypted data onto the removable medium; and
a central database stored in the memory remote from the computer, wherein the EIOS obtains the medium key associated with the removable medium by:
reading a medium identifier from the removable medium, and querying the central database using the medium identifier to retrieve the medium key associated with the removable medium, when the removable medium is previously initialized, wherein the EIOS obtains the medium key associated with the removable medium by:
decrypting an encrypted medium key using an encryption key of the EIOS to obtain the medium key, the encrypted medium key being stored on the memory remote from the computer.
7. The system of claim 6 , wherein the EIOS obtains the medium key associated with the removable medium by:
generating a medium identifier associated with the removable medium;
initializing the removable medium by writing the medium identifier onto the memory remote from the computer; and
generating the medium key.
8. The system of claim 7 , further comprising a central database stored in the memory remote from the computer, wherein the storing the medium key comprises transmitting the medium key with the medium identifier over the network to be stored in the central database.
9. The system of claim 6 , wherein the EIOS obtains the medium key associated with the removable medium by:
receiving an encrypted medium key associated with the removable medium, the encrypted medium key being encrypted with an encryption key uniquely associated with the EIOS; and
decrypting the encrypted medium key using the encryption key uniquely associated with the EIOS.
10. The system of claim 9 , wherein the encryption key uniquely associated with the EIOS is a public/private key pair,
wherein the encrypted medium key is encrypted with the public key uniquely associated with the EIOS, and
wherein the EIOS is configured to decrypt the encrypted medium key using the private key uniquely associated with the EIOS.
11. The system of claim 6 , wherein the EIOS separates unencrypted data read from the removable medium from encrypted data read from the removable medium.