WO2003012606A2 - Security apparatus - Google Patents

Abstract

There is described a security apparatus for protecting data held on storage media against unauthorised access. The apparatus is in the form of a storage medium, for example a hard disc drive which is located in a single casing together with a data encryption device. The data encryption device is encapsulated in resin within the casing.

Description

SECURITY APPARATUS

This invention relates to security apparatus, and in particular, but not exclusively, to apparatus for protecting computer data and other digital data against unauthorised access.

Known methods for protecting the confidentiality of data stored on desktop and laptop PCs employ cryptographic methods. Cryptographic methods utilise software encryption solutions to prevent unauthorised access to data, however such methods are not infallible as keys (passwords) can often be deciphered by unauthorised users.

More robust methods are available which allow non- recoverable emergency destruction of data held on storage media in the event that unauthorised access is attempted. Alternatively, the use of an inline hardware encryption device can render the data useless by the use of full disk encryption.

However, previously proposed devices remain vulnerable since the encryption hardware can nevertheless be physically accessed by an unauthorised user. Accordingly, a determined intruder may force access to the device and physically disable its data protection capabilities. Once physically disabled, conventional methods could be employed to obtain the keys and illicitly retrieve the confidential data from the storage medium.

Another disadvantage of previously proposed devices is that they rely on conventional techniques to dissipate heat generated by their electrical components. Ventilation openings must therefore be provided in the casing to enable heated air to escape by convection to the ambient air. The necessity for ventilation openings is therefore a flaw in the design of such devices from a tamperproofing perspective.

A particular disadvantage of previously proposed devices is the increased space requirements of the additional hardware required to enable data encryption. As the trend is for PCs to become smaller, space within a PC is at a premium. Moreover, it is inevitable that installation costs will rise accordingly. According to the present invention there is provided security apparatus for protecting data held on storage media against unauthorised access, said apparatus comprising a storage medium and an encryption device located within a single casing.

Preferably, the encryption device is encapsulated in resin.

Preferably, the storage medium is a hard disk drive (HDD) .

Preferably, the form factor of the casing is chosen so that it accommodates both the hard disk drive (HDD) and the encryption device.

Preferably, the encryption device is mounted on a printed circuit board (PCB) .

Preferably, the encryption device contains a VLSI device .

Preferably, the VLSI device provides a program to a host to facilitate a keying process thereby allowing access to the storage medium.

Preferably, the casing has one or more internally mounted heat conducting surfaces arranged to be in physical contact with heat producing components of the apparatus, thereby defining a heat path to the exterior surface of the casing. Preferably, the internally mounted heat conducting surfaces are made of a resilient and/or flexible material .

Preferably, the casing is tamper evident to provide evidence of tampering.

Also, in the event of the tampering the keying process is irrevocably disabled, thereby denying access to the storage medium.

Preferably, the hard disk drive (HDD) is open to the ambient air.

Preferably, the resin is made of a thermally conductive material which acts as an internally mounted heat conducting surface.

Embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings in which: -

Fig. 1 shows a cross-sectional view of security apparatus made in accordance with a first embodiment of the present invention;

Fig. 2 is an exploded perspective view of the security apparatus shown in Fig. 1; and

Fig. 3 is an exploded perspective of security apparatus made in accordance with a second embodiment of the present invention. As shown in Fig. 1, there is provided security apparatus comprising a hard disk drive (HDD) 10 and a printed circuit board (PCB) 12 located within a casing 14 defined by an upper enclosure 16 located above the PCB 12 and a lower enclosure 18 located below the PCB 12.

A VLSI (Very Large Scale Integration) device 22 is mounted on the underside of PCB 12 and projects into the lower enclosure 18. The lower enclosure 18 is filled with resin 24 thereby encapsulating the VLSI 22 and contacting the underside of the PCB 12.

The length, width and height of the upper and lower enclosures 16, 18 determine the overall dimensions of the assembled casing 14. In the art, the dimensions of the casing 14 define its "form factor" .

The form factor of the casing 14 is chosen so that it accommodates both the HDD 10 and the VLSI 22.

A heat transfer pad 20 is in physical contact with both the HDD 10 and the inner surface of the upper enclosure 16 of the casing 14.

A channel 26 within the upper enclosure 16 is open to ambient air pressure.

In use, the security apparatus represents a straightforward replacement for existing HDD casings since it conforms to standard form factors already used in PCs .

When booting the PC, all data read from the security apparatus prior to keying is supplied from the VLSI 22. When the host requests the Master Boot Record, the security apparatus supplies its own program from the VLSI 22. Once executed on the host, this facilitates the keying process.

Prior to keying, all data is read only from the VLSI 22 and any writes are ignored. The HDD 10 and the data it holds are therefore inaccessible before keying .

Following keying, all data is read from and written to the HDD 10. The Master Boot Record within a solid state drive (SSD) of the VLSI 22 is therefore inaccessible after keying.

The security apparatus facilitates a technique for BIOS cascading whereby several such security devices are placed in a single computer and the BIOS is configured to boot each security device in turn. Only the last security device is bootable, thus when the user powers up the system, each security device can be keyed in turn and once the last security device has been keyed the system will boot.

The security apparatus provides high level encryption using the widely recognised AES algorithm or other algorithm and is both tamper resistant and tamper evident . For added protection the tamper respondent sensor, when activated, can function to disable the keying process, thereby denying access to the storage medium.

The HDD 10 and VLSI 22 become heated in use. Normally, in the absence of conventional ventilation openings to aid heat dissipation, the temperature within the casing 14 would rise and ultimately result in premature failure of the security apparatus. The present security apparatus obviates the need for ventilation openings by providing a heat conducting path from both the hard disk drive 10 and the VLSI 22 to the exterior surface of the casing 14.

Referring once more to Fig. 1, a first heat path is provided by a heat transfer pad 20 which contacts the HDD 10 and the inner surface of the upper enclosure 16 of the casing 14.

A second heat path is provided between the VLSI 22 and the inner surface of the lower enclosure 18 of the casing 14. However, in this case, the resin 24 is made of heat conducting material and acts in a similar fashion to the heat transfer pad 20.

The channel 26 in the casing is open to the ambient air in order that the HDD can compensate for pressure changes. However, the casing may be hermetically sealed when the data storage media device, such as a HDD, is not affected by pressure changes .

Fig. 2 shows an exploded perspective view of the security apparatus of Fig. 1 and indicates how the casing is defined by the upper and lower enclosures 16 and 18 respectively. It further shows how the HDD 10 is of a smaller form factor than its casing in order that the additional VLSI 22 and other optional hardware extensions can be co-located therewith.

Fig. 3 shows a second embodiment of the present invention. The arrangement is similar to that of Fig. 2, however, a ribbon cable is provided on the PCB 12 to ease assembly of the security apparatus by eliminating problems arising due to manufacturing tolerances.

It will be appreciated that since the security apparatus fits within a casing of standard form factor means that it can act as a straightforward and cost effective "fit and forget" replacement for conventional HDD form factors.

Moreover, the security apparatus is both tamper resistant and, by its very nature, tamper-evident. Additionally, the security apparatus may be arranged to be tamper respondent .

Further advantages of the security apparatus are as follows. It requires no previous knowledge of encryption on the part of the user, it is platform and operating system independent and users are not required to save data onto designated areas on the PC or concern themselves with key management.

Modifications and improvements may be made to the above without departing from the scope of the present invention.

Claims

1. Security apparatus for protecting data held on storage media against unauthorised access, said apparatus comprising a storage medium and an encryption device located within a single casing.

2. Security apparatus according to claim 1, wherein the encryption device is encapsulated in resin.

3. Security apparatus according to claim 1 or 2 , wherein the storage medium is a hard disk drive

(HDD) .

4. Security apparatus according to claim 3, wherein the dimensions of the casing are chosen so that it accommodates both the hard disk drive (HDD) and the encryption device.

5. Security apparatus according to any of claims 1 to 4, wherein the encryption device is mounted on a printed circuit board (PCB) .

6. Security apparatus according to any of claims 1 to 5, wherein the encryption device contains a VLSI device.

7. Security apparatus according to claim 6, wherein the VLSI device provides a program to a host to facilitate a keying process thereby allowing access to the storage medium.

8. Security apparatus according to any of claims 1 to 7, wherein the casing has one or more internally mounted heat conducting surfaces arranged to be in physical contact with heat producing components of the apparatus, thereby defining a heat path to the exterior surface of the casing.

9. Security apparatus according to claim 8, wherein the internally mounted heat conducting surfaces are made of a resilient and/or flexible material.

10. Security apparatus according to any of claims 1 to 9, wherein the casing is tamper evident to provide evidence of tampering.

11. Security apparatus according to claim 10, wherein in the event of the tampering the keying process is irrevocably disabled, thereby denying access to the storage medium.

12. Security apparatus according to any of claims 3 to 11, wherein the hard disk drive (HDD) is open to the ambient air.

13. Security apparatus according to any of claims 2 to 12, wherein the resin is made of a thermally conductive material which acts as an internally mounted heat conducting surface.