System and method for encrypted disk drive sanitizing

Abstract

A system and method for first changing the encryption key on a self-encrypting disk drive followed by a complete disk wipe. Either process can be separately performed, and they can be performed in any order. In fact, one embodiment of the invention, resets the symmetric key, wipes the disk a predetermined number of times with different predetermined data patterns, and then resets the key a second time. This assures that there is absolutely no way to recover the original key or to read the original plain text data, even if some of it's encrypted values remain on unallocated tracks after wiping. A user can be assured that in milliseconds after starting the wiping process, the entire disk is rendered unreadable and unrecoverable.

Claims

1. A method of sanitizing a self-encrypting disk drive containing an internal cryptographic key comprising: receiving a set of options from a user relating to sanitizing the disk drive; issuing a command to the disk drive causing the internal cryptographic key to change value; writing a predetermined data pattern to each address of the disk drive; reporting to the user that the disk drive has been sanitized according to the options.

2. The method of claim 1 further comprising issuing a second command to the disk drive that causes the internal cryptographic key to change value a second time.

3. The method of claim 2 further comprising providing a user interface configured to communicate the said disk interface over a network.

4. The method of claim 3 wherein the user interface is permits a user to choose options related to sanitizing the disk drive.

5. The method of claim 1 further comprising formatting the disk drive after said predetermined data patterns are written.

6. The method of claim 1 further comprising formatting the disk drive after said cryptographic key changes value a second time.

Description

DESCRIPTION OF THE FIGURES

(1) Attention is now directed to several drawings that illustrate features of the present invention.

(2) FIG. 1 shows details of a prior art self-encrypting hard disk system.

(3) FIG. 2 shows a block diagram of an embodiment of the present invention.

(4) FIG. 3 is a flow chart of a control program applicable to embodiments of the present invention.

(5) Several drawings and illustrations are presented to aid in understanding the present invention. The scope of the present invention is not limited to what is shown in the figures.

DESCRIPTION OF PREFERRED EMBODIMENTS

(6) The present invention is a system and method for first resetting (changing) the encryption key on a self-encrypting disk drive followed by a complete disk wipe.

(7) The encryption key used in a self-encrypting hard disk drive is usually a long key used with a high-security encryption method like AES. This key is typically called the Media Encryption Key (MEK). This is a strong key generated automatically as a random or pseudo-random number by the disk hardware/firmware that is typically 128 or 256 bits. Some disk drives may use more than one MEK for different tracks or sectors.

(8) Unlocking the drive for use may require another key typically called a Key Encryption Key (KEK) supplied by the user, BIOS, an operating system or a network. The MEK is encrypted by the KEK, and only the encrypted version of the MEK is stored when the drive is powered off. Also, in most systems, the KEK is never stored in plain text inside the drive. Some drives allow a mode where there is no KEK, or the KEK is not set. In this mode, the drive is always unlocked and appears not to be encrypting even though it is (using the MEK). If a KEK is set, the drive powers up locked (with the MEK only in encrypted form) until the correct KEK is given to the drive by the user.

(9) When a locked self-encrypting drive is powered up, the BIOS typically first sees a shadow disk that is much smaller than the real disk. The shadow disk is usually around 100 megabytes and contains executable software. The software in the shadow disk is read-only and typically requests the KEK from the user to unlock the real disk for use and to decrypt the MEK so the real disk can be read and written to.

(10) Usually, the shadow disk software stores a hash of the KEK so it can recognize if the user provides the correct KEK. When the user enters the correct pass code (either the KEK itself, or a password or other authentication) the shadow disk hashes that pass code or KEK and compares the hash with the stored hash of the KEK. If the two match, the MEK is decrypted using the KEK in what can be a symmetric or asymmetric encryption method, and puts the decrypted MEK into the symmetric encryption-decryption circuit inside the drive (without ever writing it to the magnetic or semiconductor medium). Usually, the BIOS is called from the disk to start again, but it now has the much larger real disk with a capacity in gigabytes rather than megabytes, and the operating system boots normally.

(11) Every hard disk drive (magnetic or semiconductor) has an electrical interface to the computer or controller it is connected to. Most computers connect hard drives through various I/O channels. Every hard disk drive also has a set of commands that are generally executed by loading registers in the disk drive controller. In order to access the disk drive in order to sanitize it, the wipe hardware interface must electrically connect to the drive and be able to issue commands to the drive.

(12) FIG. 1 shows details of a prior art self-encrypting disk drive. The electrical interface 1 connects to an external computer or to a special wipe system. The data path 2 passes through a symmetric encrypt/decrypt chip (or circuit) 3. This chip performs the AES or other symmetric encryption algorithm. The plain text MEK is usually stored in a hardware register 4 during disk use. An authentication interface 5 typically executes firmware (or is hardware) that creates and maintains the shadow disk, keeps a hash of the KEK on the shadow disk, and requests and receives the KEK or other correct authentication upon power-up. This interface 5 also keeps an encrypted version of the MEK available for decrypting and use.

(13) The interface 5 also controls authentication for issuing special commands such as a reset-key (cryptographic erase) command. Since, execution of this command generally renders all the data on the disk permanently unreadable, most systems require special, higher authentication in order to execute this command and other similar commands as opposed to simple read or write commands. In some systems, this command cannot be issued over the regular electrical interface. However, in most systems, commands of this sort can be issued by a higher authority than the user (in some systems called a crypto officer or the like). This is usually simply a user with a different password or a different KEK that must be entered. Authenticating under a lower authority user password only allows disk reads and writes and operational commands, while authenticating under the higher level password allows any operation including a key reset command. With almost all systems, there is no level of authority that can read out the plain text MEK or even the encrypted MEK.

(14) Upon receipt of a reset-key command with the proper authentication, the interface 5 executes a special algorithm that generates a new, strong MEK of the required 128 or 256 bits. This is typically done with a pseudo-random number generator or the like. This new key is first encrypted with the KEK using the secondary encryption technique (which may be identical to the first), and the encrypted version of the MEK is stored on the shadow disk. The generated plain text MEK is than placed in the MEK hardware register 4. At this point, both the old MEK and its encrypted copy are permanently gone on most systems. The disk is still functional for reading or writing; however, any old data will not be readable. Any new written data is encrypted with the new MEK and can be read back with it. The process is almost transparent with the exception that all the old data is now just random bits.

(15) A wipe operation can now begin. However, with self-encrypting disks, there is no way to force the medium write to a particular wipe pattern since all writes are encrypted by the MEK, and all MEKs are internally generated, strong keys. Thus, the actual patterns being written into the medium will be different from any pre-specified patterns. Also, each successive write of the same pattern (say 0x55 at a byte level) will become a different value as the encryption algorithm proceeds. Thus, each sector written with the same pattern will be totally different from every other sector written with that pattern.

(16) FIG. 2 shows a block diagram of an embodiment of the present invention. A user interface 6 allows the user to choose a particular operation such as reset key, wipe, reset key followed by wipe, wipe followed by reset key, or reset key followed by wipe followed by a second reset key. The user interface 6 may be remote from the actual disk drive being wiped 7 and may communicate over a network 8 such as the Internet. It may be a smartphone or other wireless handheld device executing stored instructions from a wirelessly downloaded application. Alternatively, it may be a remote terminal or personal computer (PC). Thus, any remote computer with proper access can control the process. The wipe controller 9, which can be a PC, server, other computer, microcontroller, or special hardware is attached directly to the disk drive electrical interface 10. The wipe controller 9 sends the actual commands and write data to the disk or storage device interface 1, and reads data back from the disk or storage device. Upon connecting to the drive, the first task this controller 9 must accomplish is to authenticate itself to the drive controller interface 5. The authentication must be at a level where a reset key command (cryptographic erase or cryptographic reset) can be issued.

(17) Once authenticated, the wipe controller 9 sends either the reset key command to the drive, or begins to wipe it as the user wishes. If the particular wipe standard requires read back to verify that the original data has been wiped, that can also be performed. In this mode, a sector or other address is typically written followed by a read back. Some standards do not require read back in order to run faster. Also, some standards require that the entire wipe process be performed more than once (in some cases, up to three times). This can also be done.

(18) The wipe controller 9 can also verify that a key reset has indeed taken place before beginning the wipe operation. This can be easily done by writing a known pattern to a predetermined sector (using the old MEK); issuing a key reset; and then reading back that sector (at that point under the new MEK). The result should be a collection of almost random bits and not the data that was written. This test also verifies that the encryption hardware is functioning, and that data is indeed being encrypted before being written.

(19) The remote terminal or user interface 6 (which may be a cellular telephone) typically runs a graphical user interface (GUI) with menus and command selections known in the art. The remote terminal generally includes key data entry, a display screen which may be a touch screen and possible audio such as voice recognition and a speaker or earphones.

(20) FIG. 3 shows a flow chart of an embodiment of the invention. First 11, the user selects a mode of operation. The system next either resets the key 12 or begins a wipe operation 13. If no key reset is desired by the user, the wipe operation begins immediately. If a key reset takes place, the wipe can begin next (if so-selected by the user). The wipe can repeat n times where n is an integer. After that, an optional verification phase 15 can be executed that ascertains to some required probability that the disk is clean, safe and ready to use. Finally, a second key reset 14 can take place if desired. As a final step, optional formatting 16 can be put onto the disk. The user, rather than specifying each step, can alternatively select a particular standard or a particular canned or predetermined routine.

(21) The present invention provides a way to conveniently secure and wipe multiple disks using a local or remote interface. In particular, the system can be controlled from a remote location over a network. The symmetric key (MEK) on a self-encrypting disk, magnetic or semiconductor storage device can be optionally reset before performing wipe operations. It can optionally be reset a second time after wipe operations for additional security. This renders even the wipe data inaccessible. The final result is one or more disks that can be optionally formatted and are ready and safe for use.

(22) Several descriptions and illustrations have been provided to aid in understanding the present invention. One with skill in the art will realize that numerous changes and variations can be made without departing from the spirit of the invention. Each of these changes and variations is within the scope of the present invention.