IP Library › Granted Patent US 8,930,713
Granted Patent B2
US 8,930,713 · App. 12/721,334 · Granted Jan 6, 2015

System and method for general purpose encryption of data

Inventors: Kenneth W. Stufflebeam, Jr. (Georgetown, TX); Michele Kopp (Georgetown, TX)
Assignee: Dell Products L.P.
G06F21/62G06F21/6209
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,930,713
App. No.
12/721,334
Filed
Mar 10, 2010
Granted
Jan 6, 2015
Kind
B2
Art Unit
2438
USPC
713/190
Abstract

Systems and methods for reducing problems and disadvantages associated with traditional approaches to encryption and decryption of data are provided. An information handling system may include a processor, a memory communicatively coupled to the processor, and an encryption accelerator communicatively coupled to the processor. The encryption accelerator may be configured to encrypt and decrypt information in accordance with a plurality of cryptographic functions, receive a command from the processor to perform an encryption or decryption task upon data associated with an input/output operation, and in response to receiving the command, encrypt or decrypt the data associated with the input/output operation based on a particular one of the plurality of cryptographic functions.

Claims (38)

1. An information handling system, comprising:

a processor;

a memory communicatively coupled to the processor;

a storage resource communicatively coupled to the processor, the storage resource having a sealed encryption key that is unique to the storage resource and associated only with the storage resource;

an encryption accelerator communicatively coupled to the processor, the encryption accelerator configured to:

encrypt and decrypt information in accordance with a plurality of cryptographic functions;

receive an authorized command from the processor to perform an encryption or decryption task upon data associated with an input/output operation from the storage resource, the authorized command is authenticated based on the unique sealed encryption key and includes a designation of a particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task, the unique sealed encryption key is read access disabled; and

in response to receiving the authorized command, load the unique sealed encryption key and encrypt or decrypt the data associated with the input/output operation based on the unique sealed encryption key and the particular one of the plurality of cryptographic functions;

a cryptoprocessor communicatively coupled to the processor and the encryption accelerator, the cryptoprocessor configured to unwrap the unique sealed encryption key for use in connection with the encryption or decryption task; and

an encryption status module stored in the memory and configured to:

determine an encryption status of a volume of the storage resource; and

store a variable indicating a portion of the volume that has been encrypted or decrypted and whether the volume is partially encrypted or decrypted.

2. The information handling system according to claim 1 , wherein the plurality of cryptographic functions includes at least one of an encryption algorithm, an algorithm mode, a cryptographic hash, and a sign function.

3. The information handling system according to claim 1 , wherein the designation of the particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task is based on at least one of: a user associated with the information handling system, a port to which the storage resource associated with the input/output operation is coupled, a type of the storage resource associated with the input/output operation, a manufacturer of the storage resource associated with the input/output operation, a model of the storage resource associated with the input/output operation, a serial number of the storage resource associated with the input/output operation, a logical path of the storage resource associated with the input/output operation, and any other characteristic of the storage resource associated with the input/output operation.

4. The information handling system according to claim 1 , wherein the cryptoprocessor comprises a Trusted Platform Module.

5. The information handling system according to claim 1 , wherein the unique sealed encryption key loaded is based on at least one of: a user associated with the information handling system, a port to which the storage resource associated with the input/output operation is coupled, a type of the storage resource associated with the input/output operation, a manufacturer of the storage resource associated with the input/output operation, a model of the storage resource associated with the input/output operation, a serial number of the storage resource associated with the input/output operation, a logical path of the storage resource associated with the input/output operation, and any other characteristic of the storage resource associated with the input/output operation.

6. A method for encryption and decryption of data, comprising:

receiving an authorized command by an encryption accelerator to perform an encryption or decryption task upon data associated with an input/output operation from a storage resource, the storage resource having a sealed encryption key that is unique to the storage resource and associated only with the storage resource;

unwrapping the unique sealed encryption key by a cryptoprocessor communicatively coupled to the encryption accelerator;

authenticating the authorized command based on the unique sealed encryption key, the unique sealed encryption key is read access disabled, the authorized command designating a particular one of a plurality of cryptographic functions stored on the encryption accelerator;

in response to receiving the authorized command, loading the unique sealed encryption key;

encrypting or decrypting the data associated with the input/output operation based on the unique sealed encryption key and the particular one of the plurality of cryptographic functions;

determining an encryption status of a volume of the storage resource; and

storing a variable indicating a portion of the volume that has been encrypted or decrypted and whether the volume is partially encrypted or decrypted.

7. The method according to claim 6 , wherein the plurality of cryptographic functions includes at least one of an encryption algorithm, an algorithm mode, a cryptographic hash, and a sign function.

8. The method according to claim 6 , wherein the designation of the particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task is based on at least one of: a user associated with an information handling system, a port to which the storage resource associated with the input/output operation is coupled, a type of the storage resource associated with the input/output operation, a manufacturer of the storage resource associated with the input/output operation, a model of the storage resource associated with the input/output operation, a serial number of the storage resource associated with the input/output operation, a logical path of the storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.

9. The method according to claim 6 , wherein the unique sealed encryption key loaded is based on at least one of: a user associated with the information handling system, a port to which the storage resource associated with the input/output operation is coupled, a type of the storage resource associated with the input/output operation, a manufacturer of the storage resource associated with the input/output operation, a model of the storage resource associated with the input/output operation, a serial number of the storage resource associated with the input/output operation, a logical path of the storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.

10. An encryption accelerator, comprising:

a non-transitory computer-readable medium; and

computer-executable instructions stored on the non-transitory computer-readable medium, the instructions readable by the encryption accelerator, the instructions, when read and executed, for causing the encryption accelerator to:

encrypt and decrypt information in accordance with a plurality of cryptographic functions;

receive an authorized command from a processor to perform an encryption or decryption task upon data associated with an input/output operation from a storage resource, the storage resource having a sealed encryption key that is unique to the storage resource and associated only with the storage resource, the authorized command authenticated based on the unique sealed encryption key, the unique sealed encryption key is read access disabled;

receive a designation of a particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task; and

in response to receiving the authorized command, load the unique sealed encryption key and encrypt or decrypt the data associated with the input/output operation based on the unique sealed encryption key and a particular one of the plurality of cryptographic functions; and

determine an encryption status of a volume of the storage resource and store a variable indicating a portion of the volume that has been encrypted or decrypted and whether the volume is partially encrypted or decrypted.

11. The encryption accelerator according to claim 10 , wherein the instructions for causing the encryption accelerator to encrypt and decrypt information in accordance with the plurality of cryptographic functions includes at least one of an encryption algorithm, an algorithm mode, a cryptographic hash, and a sign function.

12. The encryption accelerator according to claim 10 , wherein the designation of the particular one of the plurality of cryptographic functions to be used in connection with the encryption or decryption task is based on at least one of: a user associated with an information handling system, a port to which the storage resource associated with the input/output operation is coupled, a type of the storage resource associated with the input/output operation, a manufacturer of the storage resource associated with the input/output operation, a model of the storage resource associated with the input/output operation, a serial number of the storage resource associated with the input/output operation, a logical path of the storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.

13. The encryption accelerator according to claim 10 , wherein the unique sealed encryption key loaded is based on at least one of: a user associated with an information handling system, a port to which the storage resource associated with the input/output operation is coupled, a type of the storage resource associated with the input/output operation, a manufacturer of the storage resource associated with the input/output operation, a model of the storage resource associated with the input/output operation, a serial number of the storage resource associated with the input/output operation, a logical path of the storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.

Assignments (15)
RELEASE OF SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (053546/0001) Recorded Jun 23, 2022
From: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT
To: DELL MARKETING L.P. (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO CREDANT TECHNOLOGIES, INC.); DELL INTERNATIONAL L.L.C.; DELL PRODUCTS L.P.; DELL USA L.P.; EMC CORPORATION; DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO FORCE10 NETWORKS, INC. AND WYSE TECHNOLOGY L.L.C.); EMC IP HOLDING COMPANY LLC
Reel/Frame 071642/0001 →
RELEASE OF SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (045455/0001) Recorded May 20, 2022
From: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT
To: DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO ASAP SOFTWARE EXPRESS, INC.); DELL MARKETING L.P. (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO CREDANT TECHNOLOGIES, INC.); DELL USA L.P.; DELL INTERNATIONAL L.L.C.; DELL PRODUCTS L.P.; DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO FORCE10 NETWORKS, INC. AND WYSE TECHNOLOGY L.L.C.); EMC CORPORATION (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO MAGINATICS LLC); EMC IP HOLDING COMPANY LLC (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO MOZY, INC.); SCALEIO LLC
Reel/Frame 061753/0001 →
RELEASE OF SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (040136/0001) Recorded Apr 26, 2022
From: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT
To: DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO ASAP SOFTWARE EXPRESS, INC.); DELL MARKETING L.P. (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO CREDANT TECHNOLOGIES, INC.); DELL USA L.P.; DELL INTERNATIONAL L.L.C.; DELL PRODUCTS L.P.; DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO FORCE10 NETWORKS, INC. AND WYSE TECHNOLOGY L.L.C.); EMC CORPORATION (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO MAGINATICS LLC); EMC IP HOLDING COMPANY LLC (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO MOZY, INC.); SCALEIO LLC
Reel/Frame 061324/0001 →
RELEASE OF SECURITY INTEREST Recorded Nov 3, 2021
From: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH
To: ASAP SOFTWARE EXPRESS, INC.; AVENTAIL LLC; CREDANT TECHNOLOGIES, INC.; DELL USA L.P.; DELL INTERNATIONAL, L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL SYSTEMS CORPORATION; EMC CORPORATION; EMC IP HOLDING COMPANY LLC; FORCE10 NETWORKS, INC.; MAGINATICS LLC; MOZY, INC.; SCALEIO LLC; WYSE TECHNOLOGY L.L.C.
Reel/Frame 058216/0001 →
SECURITY AGREEMENT Recorded Apr 22, 2020
From: CREDANT TECHNOLOGIES INC.; DELL INTERNATIONAL L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL USA L.P.; EMC CORPORATION; FORCE10 NETWORKS, INC.; WYSE TECHNOLOGY L.L.C.; EMC IP HOLDING COMPANY LLC
To: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A.
Reel/Frame 053546/0001 →
SECURITY AGREEMENT Recorded Mar 21, 2019
From: CREDANT TECHNOLOGIES, INC.; DELL INTERNATIONAL L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL USA L.P.; EMC CORPORATION; FORCE10 NETWORKS, INC.; WYSE TECHNOLOGY L.L.C.; EMC IP HOLDING COMPANY LLC
To: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A.
Reel/Frame 049452/0223 →
SECURITY AGREEMENT Recorded Sep 21, 2016
From: ASAP SOFTWARE EXPRESS, INC.; AVENTAIL LLC; CREDANT TECHNOLOGIES, INC.; DELL USA L.P.; DELL INTERNATIONAL L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL SYSTEMS CORPORATION; EMC CORPORATION; EMC IP HOLDING COMPANY LLC; FORCE10 NETWORKS, INC.; MAGINATICS LLC; MOZY, INC.; SCALEIO LLC; SPANNING CLOUD APPS LLC; WYSE TECHNOLOGY L.L.C.
To: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT
Reel/Frame 040136/0001 →
SECURITY AGREEMENT Recorded Sep 21, 2016
From: ASAP SOFTWARE EXPRESS, INC.; AVENTAIL LLC; CREDANT TECHNOLOGIES, INC.; DELL USA L.P.; DELL INTERNATIONAL L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL SYSTEMS CORPORATION; EMC CORPORATION; EMC IP HOLDING COMPANY LLC; FORCE10 NETWORKS, INC.; MAGINATICS LLC; MOZY, INC.; SCALEIO LLC; SPANNING CLOUD APPS LLC; WYSE TECHNOLOGY L.L.C.
To: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT
Reel/Frame 040134/0001 →
RELEASE OF SECURITY INTEREST Recorded Sep 14, 2016
From: BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS COLLATERAL AGENT
To: DELL MARKETING L.P.; ASAP SOFTWARE EXPRESS, INC.; APPASSURE SOFTWARE, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL INC.; DELL PRODUCTS L.P.; DELL USA L.P.; DELL SOFTWARE INC.; FORCE10 NETWORKS, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
Reel/Frame 040065/0618 →
RELEASE OF SECURITY INTEREST Recorded Sep 14, 2016
From: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
To: DELL MARKETING L.P.; ASAP SOFTWARE EXPRESS, INC.; APPASSURE SOFTWARE, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL INC.; DELL PRODUCTS L.P.; DELL USA L.P.; DELL SOFTWARE INC.; FORCE10 NETWORKS, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
Reel/Frame 040040/0001 →
RELEASE OF SECURITY INTEREST Recorded Sep 13, 2016
From: BANK OF AMERICA, N.A., AS ADMINISTRATIVE AGENT
To: DELL MARKETING L.P.; ASAP SOFTWARE EXPRESS, INC.; APPASSURE SOFTWARE, INC.; COMPELLANT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL INC.; DELL PRODUCTS L.P.; DELL USA L.P.; DELL SOFTWARE INC.; FORCE10 NETWORKS, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
Reel/Frame 040065/0216 →
PATENT SECURITY AGREEMENT (ABL) Recorded Jan 2, 2014
From: DELL INC.; APPASSURE SOFTWARE, INC.; ASAP SOFTWARE EXPRESS, INC.; BOOMI, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL USA L.P.; FORCE10 NETWORKS, INC.; GALE TECHNOLOGIES, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
To: BANK OF AMERICA, N.A., AS ADMINISTRATIVE AGENT
Reel/Frame 031898/0001 →
PATENT SECURITY AGREEMENT (TERM LOAN) Recorded Jan 2, 2014
From: DELL INC.; APPASSURE SOFTWARE, INC.; ASAP SOFTWARE EXPRESS, INC.; BOOMI, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL USA L.P.; FORCE10 NETWORKS, INC.; GALE TECHNOLOGIES, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 031899/0261 →
PATENT SECURITY AGREEMENT (NOTES) Recorded Jan 2, 2014
From: APPASSURE SOFTWARE, INC.; ASAP SOFTWARE EXPRESS, INC.; BOOMI, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL INC.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL USA L.P.; FORCE10 NETWORKS, INC.; GALE TECHNOLOGIES, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
To: BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS FIRST LIEN COLLATERAL AGENT
Reel/Frame 031897/0348 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 10, 2010
From: STUFFLEBEAM, KENNETH W., JR.; KOPP, MICHELE
To: DELL PRODUCTS L.P.
Reel/Frame 024060/0766 →
Continuity (1)
Related Publication 20110225431A1 · Sep 15, 2011