System and method to generate encryption keys based on information of peripheral devices
A digital computing device controlling the access to encrypted digital information includes a control unit, peripheral devices connected to the control unit, a hard disk connected to the control unit storing the digital data, and a data encryption key configured for encrypting the digital data. The control unit is configured to detect the peripheral devices, read identification information from the peripheral devices that denotes the respective peripheral device, generate for the peripheral devices a respective key encryption key on the basis of the read identification information, initially store at least one encrypted data encryption key that is generated by encrypting the data encryption key using the respective key encrypt ion key, in a memory area of the nerd disk, and after the initial storage determine the data encryption key by decrypting the encrypted data encryption key using the respective key encryption key derived from the respective identification information.
1. A digital computing device controlling the access to encrypted digital data, comprising:
a control unit;
one or more peripheral devices connected to the control unit;
a hard disk connected to the control unit, storing the digital data; and
a data encryption key configured for encrypting the digital data stored on the hard disk;
wherein the control unit is configured to:
detect the peripheral devices,
read from each of the peripheral devices a respective identification information that denotes the respective peripheral device,
generate for the peripheral devices a respective key encryption key on the basis of the read identification information,
store at least one encrypted data encryption key that is generated by encrypting the data encryption key using the respective key encryption key, in a memory area of the hard disk, and
after storing the at least one encrypted data encryption key, determine the data encryption key by decrypting the encrypted data encryption key using the respective key encryption key derived from the respective identification information, and
encrypt digital data to be stored on the hard disk in encrypted form using the data encryption key and
decrypt digital data that are stored on the hard disk in encrypted form using the data encryption key,
wherein the control unit is further configured to:
receive a USB descriptor of a connected USB peripheral device, and to read a specific descriptor field to determine parts of the identification information of the USB peripheral device, which has not been used by the USB standard to store identification information and which does not conflict with information need in the USB descriptor, and
exclude peripheral devices based on a Vendor ID and/or Product ID received from the peripheral device for the key encryption key generation, and
determine specifically one or more data fields of each received USB descriptor based on the Vendor ID and the Product ID in the USB descriptor for the key encryption key generation, and
add additional unique information to determine the key encryption key if the data fields of the USB descriptors used to generate the key encryption key are identical for several peripheral devices, if the Vendor ID and/or Product ID are identical and no other unique information can be determined in the USB descriptor, and
wherein the hard disk comprises a first partition for pre boot authentication in which based on the identification information of peripheral devices the key encryption key is determined, which is used to decrypt a second partition in which the operating system for the digital computing device is stored, wherein a first system on the first partition is booted before the operating system of the second partition is booted.
2. The digital computing device according to claim 1 , wherein the excluded devices are stored in a list, as blacklist.
3. The digital computing device according to claim 1 wherein the additional unique information are one or more of the following:
counters, the number of the USB port the peripheral device is connected to.
4. The digital computing device according to claim 1 , wherein of the DMI or SMBIOS or UEFI one or more of the following information is used:
PC type identification, Motherboard, MB, identification, MB serial number, GUID of the MB.
5. The digital computing device according to claim 1 , wherein the automatic check of the number of working peripheral devices is done by a regular check of USB data sets and storing the USB data sets in protocols list, which are preferably encrypted.
6. The digital computing device according claim 1 , configured to generate a first protocol list during the execution of the first system on the first partition and a second protocol list is generated during the execution of the operation of the second partition, and the threshold is determined by comparing information of the first and second protocol list.
7. The digital computing device according to claim 1 , wherein the specific descriptor field at address 0x80 of the USB descriptor.
8. The digital computing device according to claim 1 wherein the control unit is further configured to
reset the encrypted data encryption key based on remote controllable access rules and automatically re-generate a new data encryption key,
automatically check the number of working peripheral devices providing the identification information to generate a respective key encryption key, if the number falls below a predefined threshold, starting to re-generate data encryption key using also newly connected peripheral devices.
9. The digital computing device according to claim 1 wherein the control unit is further configured to
use parts of the Desktop Management Information, DMI, of the Basic Input Out System, BIOS, or Unified Extensible Firmware Interface, UEFI, System Management BIOS, SMBIOS, of the control unit to calculate the key encryption key.
10. A method for a computing device for controlling the access to encrypted digital data, the computing device including:
a control unit;
one or more of peripheral devices connected to the control unit;
a hard disk connected to the control unit, storing the digital data; comprising a data encryption key configured for encrypting the digital data stored on the hard disk;
the method comprising the following steps and
wherein the control unit performs the following steps:
detecting the peripheral devices,
reading from each of the peripheral devices a respective identification information that denotes the respective peripheral device,
generating for the peripheral devices a respective key encryption key on the basis of the read identification information,
storing at least one encrypted data encryption key that is generated by encrypting the data encryption key using the respective key encryption key, in a memory area of the hard disk, and
after storing of the at least one encrypted data encryption key, determining the data encryption key by decrypting the encrypted data encryption keys using the respective key encryption key derived from the respective identification information, and
encrypting digital data to be stored on the hard disk in encrypted form using the data encryption key
decrypting digital data that are stored on the hard disk in encrypted form using the data encryption key,
wherein the control unit is further performing the following steps:
receiving a USB descriptor of a connected USB peripheral device, and reading 0x80 USB descriptor field to determine parts of the identification information of the USB peripheral device, and
excluding peripheral devices based on a Vendor ID and/or Product ID received from the peripheral device for the key encryption key generation, and
determining specifically one or more data fields of each received USB descriptor based to the Vendor ID and the Product ID in the USB descriptor for the key encryption key generation,
and adding additional unique information to determine the key encryption key if the data fields of the USB descriptors used to generate the key encryption key are identical for several peripheral devices, if the Vendor ID and/or Product ID are identical and no other unique information can be determined in the USB descriptor, and
wherein the hard disk comprises a first partition for pre boot authentication in which based on the identification information of peripheral devices the key encryption key is determined, which is used to decrypt a second partition in which the operating system for the digital computing device is stored, wherein a first system on the first partition is booted before the operating system of the second partition is booted.
11. The method according to claim, 10 storing the excluded devices in a list, as blacklist.
12. The method according to claim 10 , wherein the additional unique information are one or more of the following:
counters, the number of the USB port the peripheral device is connected to.
13. The method according to claim 10 , wherein of the DMI or SMBIOS UEFI one or more of the following information is used:
PC type identification, Motherboard, MB, identification, MB serial number, GUID of the MB.
14. The method according to claim 10 , wherein the automatic checking of the number of working peripheral devices is done by regularly checking the USB data sets and storing the USB data sets in protocols list, which are encrypted.
15. The method according to claim 10 , wherein a first protocol list is generated during the execution of the first system on the first partition and a second protocol list is generated during the execution of the operation of the second partition, and the threshold is determined by comparing information of the first and second protocol list.
16. The method according to claim 10 , wherein the specific descriptor field at address 0x80 of the USB descriptor.
17. The method according to claim 10 wherein the control unit is further performing the following steps:
resetting the encrypted data encryption key based on remote controllable access rules and automatically re-generate a new data encryption key,
automatically checking the number of working peripheral devices providing the identification information to generate a respective key encryption key, if the number falls below a predefined threshold, starting to re-generate data encryption key using also newly connected peripheral devices.
18. The method according to claim 10 wherein the control unit is further performing the following step:
using parts of the Desktop Management Information, DMI, of the Basic Input Out System, BIOS, or Unified Extensible Firmware Interface, UEFI, or System Management BIOS, SMBIOS, of the control unit to calculate the key encryption key.