KR20050016232A - Real time data encryption/decryption system and method for ide/ata data transfer - Google Patents

Abstract

PURPOSE: A system and a method for real-time data encryption/decryption of the IDE(Integrated Drive Electronics)/ATA(AT(Advanced Technology) Attachment) data transfer including an encryption interface are provided to offer the encryption interface adapted to perform the real-time data encryption/decryption between a host device and a data storage device during the IDE/ATA data transfer. CONSTITUTION: The system includes at least one host device(16) and data storage device(18), and the encryption interface(10). The encryption interface is effectively combined between the host device and the data storage device. The encryption interface is adapted to delay transfer of an IDE/ATA data flow control signal between the host device and the data storage device, when the data is not streamed during the IDE/ATA data transfer between the host device and the data storage device.

Description

 REAL TIME DATA ENCRYPTION / DECRYPTION SYSTEM AND METHOD FOR IDE / ATA DATA TRANSFER}

This application is entitled “Encryption / Decryption Device for Data Storage” and is partly identical to US Patent Application Serial No. 09 / 704,769, filed on November 3, 2000, pending.

The present invention relates generally to data encryption / decryption, and more particularly to a real-time data encryption / decryption system for IDE / ATA data transmission.

Integrated Drive Electronics (IDE) is a standard electronic interface used between computer motherboard buses and disk storage devices. The IDE was adopted as a standard by the American National Standards Institute (ANSI), whereby ANSI named the Advanced Technology Attachment (ATA) for the IDE. IDE / ATA is also referred to as an electronic protocol used by computers or host devices to send and receive data to and from data storage devices. There are two data transfer methods used in the IDE: programmed input / output (PIO) and direct memory access (DMA). In the PIO mode, data transfer is initiated and performed by the host device. In DMA mode, data transfer is controlled by signals for handshaking between the host device and the data storage device.

When maintaining proprietary information in a storage medium where physical access control is not guaranteed, data encryption and decryption provide a mechanism to protect data from unauthorized access. The data is cryptographically protected by encrypting the data as it is sent from the host device to the data storage device and decrypting the stored data when the host device retrieves the data from the data storage device.

In the conventional data relay method, data is transmitted through an IDE bridge or an interface provided in series between the host device and the data storage device. In this type of data transfer, the IDE controller must run an IDE controller that supports the full ATA protocol on both sides of the IDE interface for data buffering / dataflow control. The IDE interface acts as a virtual host device along with the data storage device during IDE / ATA data transfers and simultaneously acts as a virtual data storage device with the host device. The problem with the data relay method is that the IDE interface must run a large data buffer to maintain data flow control. These large data buffers are often run on integrated circuits (ASICs) inherent in IDE applications, using expensive static random-access memory (SRAM) and so on, resulting in expensive chip manufacturing costs.

The present invention is generally effectively coupled between at least one host device and at least one data storage device and wherein said at least one host device and said at least one data during IDE / ATA data transfer without affecting overall data transfer efficiency. And at least one cryptographic interface adapted to perform real-time data encryption and decryption between storage devices.

In one embodiment of the present invention, the encryption interface for coordinating IDE / ATA data transfer includes a first IDE controller supporting some ATA protocols, and a second IDE controller supporting some ATA protocols. It is effectively coupled to the first IDE controller. The first and second IDE controllers include at least one host IDE controller of the at least one host device when the data is being streamed during the IDE / ATA data transfer between the at least one host device and the at least one data storage device. It is adapted to transmit IDE / ATA dataflow control signals between data storage IDE controllers of at least one data storage device. The at least one host IDE controller and the at least one data storage IDE controller support full ATA protocol.

In another embodiment of the present invention, the encryption interface for coordinating IDE / ATA data transfers includes a first IDE controller supporting some ATA protocols, and a second IDE controller supporting some ATA protocols. It is effectively coupled to the first IDE controller. The first and second IDE controllers may include at least one host IDE controller of the at least one host device when data is not being streamed during IDE / ATA data transfer between at least one host device and at least one data storage device. And adapted to delay transmission of the IDE / ATA dataflow control signal between the data storage IDE controllers of the at least one data storage device. The at least one host IDE controller and the at least one data storage IDE controller support full ATA protocol.

In another embodiment of the invention, a method of encrypting data during IDE / ATA data transfer between a host device and a data storage device,

Blocking at least one IDE / ATA data transfer between the host device and the data storage device; when data is streaming between the host device and the data storage device, an IDE between the host device and the data storage device. Transmitting an ATA / ATA dataflow control signal, delaying transmission of an IDE / ATA dataflow control signal between the host device and the data storage device when data is not streaming between the host device and the data storage device. And transparently performing real-time encryption of data.

These and other features of the present invention will become apparent from a review of the accompanying drawings and the following detailed description of the invention.

The present invention is best understood from the following detailed description when read in conjunction with the accompanying drawings. In accordance with common practice, it is emphasized that various features of the figures are not drawn to scale. In contrast, the dimensions of the various features are optionally enlarged or reduced for simplicity. Like reference numerals in the drawings denote like elements.

One embodiment of the present invention is described in detail with reference to FIGS. Other embodiments, features and / or advantages of the invention will be apparent from the following detailed description, or may be learned by practice of the invention.

1 is a schematic block diagram of a real-time data encryption / decryption system 8 for IDE / ATA data transmission. The real-time data encryption / decryption system 8 uses an encryption interface 10 that is effectively connected between the IDE controller 12 of the host device 16 and the IDE controller 14 of the data storage device 18. Include. The encryption interface 10 is configured to perform real time data encryption / decryption during IDE / ATA data transfer between the host device 16 and the data storage device 18 without adversely affecting the overall data transfer efficiency. have.

The IDE controller 12 is fully compliant with the ATA protocol specification and includes a general large data buffer 20 for data flow control. In addition, the IDE controller 14 also fully complies with the ATA protocol specification and includes a general large data buffer 22 for data flow control. In general, host device 16 may be a desktop, notebook computer, microprocessor, router, interface card, or other device capable of generating data, and data storage device 18 may be a disk drive, tape drive, profil. Diskette, compact disc drive, magneto-optical drive, digital video recorder, flash memory card, PCMCIA card, or other device capable of storing data for extraction.

In one embodiment of the invention, as shown in FIG. 1, the cryptographic interface 10 intercepts IDE / ATA data transfer between the host device 16 and the data storage device 18, and provides a small input data buffer. It is programmed to reliably perform encryption / decryption by a cipher engine 24 effectively connected between the 26 and the small output data buffer 28.

The cipher engine 24 of the cryptographic interface 10 may be configured to perform Data Encryption Standard (DES), Triple DES (TDES), or AES during IDE / ATA data transfer between the host device 16 and the data storage device 18. Several known cryptographic algorithms, such as the Advanced Encryption Standard, are used to encrypt / decrypt data at multiple standard pipeline stages. Other forms of cipher engines and / or cryptographic algorithms may also be used in the practice of the present invention.

In another embodiment of the invention, the cryptographic interface 10 includes a host device side IDE controller 30 and a data storage device side IDE controller while data flows between the host device 16 and the data storage device 18. 32 is programmed to directly pass / pass IDE / ATA data flow control signals from host device 16 to data storage 18 or vice versa. Each of the IDE controllers 30 and 32 is designed to partially support the ATA protocol, as shown in FIG. As shown in FIG. 1, the cryptographic interface 10 intercepts the host IDE / ATA data flow control signal by the host device side IDE controller 30, and by the data storage device side IDE controller 32. By generating a control signal for the data storage device 18, the host device 16 transmits an IDE / ATA data flow control signal to the data storage device 18.

Similarly, the cryptographic interface 10 intercepts the host IDE / ATA data flow control signal by the data storage device-side IDE controller 32 and sends it to the host device 18 by the host device-side IDE controller 30. By generating a control signal for the device, the IDE / ATA data flow control signal is transmitted from the data storage device 18 to the host device 18. The implementation of the partial ATA protocol in the IDE controllers 30 and 32 in combination with the cipher engine 24 indicates that the cryptographic interface 10 transfers IDE / ATA data between the host device 16 and the data storage device 918. Ensures that data is encrypted / decrypted in real time. The cryptographic interface 10 is configured to process data at least as fast as at least the host device 16 and the data storage device 18 so as not to impair the overall data transfer efficiency.

In another embodiment of the invention, the cryptographic interface 10 does not flow data between the host device 16 and the data storage device 18, as described below with reference to steps 148 and 152 of FIG. If not, it is programmed to delay the transfer of IDE / ATA data flow control signals from host device 16 to data storage 18 and vice versa.

In terms of the functional aspects of the IDE controllers 12 and 14, IDE / ATA data transfer is directly performed between the host device 916 and the data storage device 918 without interference by the cryptographic interface 10. Thus, the cryptographic interface 10 need not include existing data buffering / data flow control capabilities, such as support for large data buffers and the full ATA protocol, as has been done in the art. In addition, the IDE / ATA data transfer between the host device and the data storage device does not need to be separated into two separate data transfers, such as between the host device 16 and the cryptographic interface 10. IDE controllers 12 and 14 are each responsible for handling data buffering / data flow control during IDE / ATA data transfer. The cryptographic interface 10 generally functions as a "forwarder", or as an IDE / ATA compliant data flow control signal passing bridge between the host device 16 and the data storage device 18 during IDE / ATA data transfer. do. The IDE controllers 30 and 32 of the cryptographic creation interface 10 only need to interpret the ATA commands required to perform the site data processing.

As also shown in FIG. 1, the host device 16 encrypts data that is securely encrypted in real time through the small input data buffer 26, the cipher engine 24, and the small output data buffer 28 in real time. The creation interface 10 can store data in the data storage device 18. The host device 16 is provided with a data storage device by a cryptographic interface 10 which reliably decrypts data in real time through the small input data buffer 26, the cipher engine 24, and the small output data buffer 28. 18) encrypted data can be extracted.

In another embodiment of the present invention, the cryptographic interface 10 may be implemented as an ASIC. The small input data buffer 26 and write output data buffer 28 used to hold data in the pipeline stage of the cipher engin 24 can be implemented using latches or registers. This implementation can avoid the use of such expensive SRAM macros. Other implementations that fall within the intended spirit and scope of the present invention enable other implementations of the cryptographic interface 10.

2 is a schematic diagram of a UDMA / Multi-world DMA dataout transmission. UDMA is a protocol for transferring data from a hard disk drive to a computer's RAM via a computer bus. The UDAM protocol transmits data in burst mode and uses Cylindrical Redundancy Checking (CRC) for data protection during ATA data transmission. The data burst mode has a data burst initialization, data burst pausing, and data burst termination procedures. As one example, a UDMA / Multi-word DMA dataout transfer may be defined as a UDMA / Multi-word DMA data transfer from the host device 16 to the data storage device 18. As another example, UDMA / Multi-wod DMA dataout transfer may be defined as UDMA / Multi-word DMA data transfer from data storage device 18 to host device 16.

Prior to initiation of the data burst initialization procedure, the cryptographic interface 10 intercepts important IDE / ATA data storage parameters such as data transfer mode, data transfer size, and the like, as outlined in step 50 of FIG. According to these parameters, the UDMA / Multi-word DMA data transfer between the host device 16 and the data storage device 18 is prepared.

In the beginning of a UDMA / Multi-word DMA dataout transfer consisting of multiple data bursts, the cryptographic interface 10 initiates the data transfer and passes the cipher engine through a small input buffer 26 (shown in FIG. 1). To send incoming data to 24 (shown in FIG. 1), a burst initialization procedure is performed with the host device 16. After the incoming data is encrypted and sent to the small output data buffer 28 (shown in FIG. 1), the encryption interface 10 stores the data, as schematically shown in step 52 of FIG. 2. Perform a burst initialization procedure with device 918 and send the encrypted data to data storage device 918;

During the transmission of the data burst, if the host device 16 or the data storage device 18 requests a pause in the data transfer due to a data flow control problem, the cryptographic interface 10 may proceed to step 58 of FIG. As schematically shown, the corresponding data transfer pause command / response signal is immediately transmitted between the host device 16 and the data storage device 18 for temporary suspension of data transfer. Thus, the cryptographic interface 10 does not participate in data flow control at all during the UDMA / Multi-word DMA dataout transmission. Instead, the cryptographic interface 10 reliably interferes to pass the data flow control signal, Data encryption is performed via IDE controller 30 (shown in FIG. 1) and cipher engine 24 (shown in FIG. 1), respectively.

As schematically shown in step 54 of FIG. 2, if the host device 16 or the data storage device 18 needs to terminate the data burst during transmission, the encryption interface 10 transmits the data. A corresponding data transfer end command / response signal is communicated between the host device 16 and the data storage device 18 for termination of the.

During the burst termination procedure, the IDE controller 12 (shown in FIG. 1) may retrieve the CRC value calculated from the plain text data for error checking at the end of each data burst (see FIG. 1). (Shown in). The IDE controller 32 (shown in FIG. 1) of the cryptographic interface 10 stores the CRC value calculated from cipher text data for error checking at the end of each data burst. To send). If the transmitted cipher statement CRC value is an error, the data storage device 18 returns to the host device 16 by the CRC error status bit as soon as the data transfer ends without any further action taken by the cryptographic interface 10. Report the difference.

If the transmitted plain text CRC value is an error, the cryptographic interface 10 sends a predefined error CRC value to the data storage device 18 during the last data burst termination procedure to inform the data storage device 18 of this. By transmitting, a CRC error is communicated to the data storage device 18. The final data burst termination procedure is schematically illustrated in step 60 of FIG.

As shown schematically in step 62 of FIG. 2, once the data transfer is complete, the data storage device 18 sends the corresponding ATA information to the host device 16 to inform the host device 16 of this. To pass.

3 is a diagram schematically illustrating a transmission that is UDMA / Multi-word DMA data. As an example, a transfer that is UDMA / Multi-word DMA data may be defined as a UDMA / Multi-word DMA data transfer from the data storage device 18 to the host device 16. As another example, a transfer that is UDMA / Multi-word DMA data may be defined as a UDMA / Multi-word DMA data transfer from the host device 16 to the data storage device 18.

As schematically shown in step 70, the cryptographic interface 10 intercepts important IDE / ATA data transfer parameters, such as data transfer mode, data transfer size, and the like, according to the data storage device 18 in accordance with these parameters. And UDMA / Multi-word DMA data transfer between the host device 16 is prepared. The cryptographic interface 10 sends encrypted data to the cipher engine 24 (shown in FIG. 1) for initiating data transfer and decrypting through the small input buffer 26 (shown in FIG. 1). In addition, the burst initialization procedure is performed together with the data storage device 18. After the incoming data has been decrypted and sent to the small output data buffer 28 (shown in FIG. 1), as shown schematically in step 72 of FIG. 16, the burst initialization procedure is performed, and the decrypted data is transmitted to the host device 16.

During the transmission of the data burst, if the data storage device 18 or the host device 16 requests the suspension of the data transmission due to a data flow control problem, as shown schematically in step 78 of FIG. The creation interface immediately conveys a corresponding data transfer pause command / response signal between the data storage device 18 and the host device 16 for temporary suspension of data transfer. The cryptographic interface 10 is therefore not involved in data flow control during transmission, which is UDMA / Multi-word DMA data. Instead, the cryptographic interface 10 reliably interferes with passing the data flow control signal during transmission, which is UDMA / Multi-word DMA data, and the IDE controller 32 (shown in FIG. 1) and the cipher engine Data decoding is performed through 24, respectively.

When data storage 18 or host device 16 needs to complete a data burst in a transmission, cryptographic interface 10 sends a corresponding data transfer complete command / response signal to data storage 18 and host. Immediately sent between the devices, as shown schematically in step 74 of FIG. 3, enabling the completion of the data transfer.

In step 80, the cryptographic interface 10 executes a final burst completion procedure with the data storage 18. The cipher engine 24 decrypts the last remaining data and sends it to the small output data buffer 28. The cryptographic interface 10 executes a burst completion procedure with the host device 16. If a CRC error occurs on the data storage side of the data transfer, the cryptographic interface 10 identifies the error as the data storage 18 reports the error to the host device 16 by the CRC error status bit upon completion of the data transfer. Take no action.

If a CRC error occurs on the host device side of the data transfer, the cryptographic interface 10 does not send the error to the data store 18 because the data transfer on the data storage side has already been completed. As outlined in step 82, in order to resolve the discrepancy, the cryptographic interface 10 sets the CRC error status bit to "true" to inform the host device 16 that a CRC error was detected by the data storage device 18. "in By manipulating the ATA information, the host device 16 can take corrective actions such as retransmission of data.

4 is a diagram schematically illustrating PIO data-out transfer from the host device 16 to the data storage device 18. In PIO mode, data transfer is initiated and executed by the host device, such as a microprocessor. Dataflow control includes read and write data strobes sent to a data storage device by a host central processing unit (CPU) or a host ATA adapter. In one embodiment, PIO data-out transfer may be defined as PIO data transfer from host device 16 to data storage 18. In yet another embodiment, PIO data-out transfer may be defined as PIO data transfer from data storage 18 to host device 16.

Initially, the cryptographic interface 10 intercepts important IDE / ATA data transfer variables, such as data transfer mode, data transfer size, and the like, as shown approximately in step 100 of FIG. And PIO data-out transfer between the data storage device 18 and the data storage device 18. The host device 16 generates a write strobe to send data to the encryption device 10. The encryption interface 10 directs input data via a small input data buffer 26 (shown in FIG. 1) to an encryption engine 24 (shown in FIG. 1) for encryption. The IDE control path 30 (shown in FIG. 1) of the encryption device 10 until the input data is encrypted and ready to be sent to the data storage device 18 as shown in step 102 shown in FIG. 4. It is programmed to delay sending this write strobe via IDE controller 32 (shown in FIG. 1) to IDE controller 14 (shown in FIG. 1) of data storage device 18.

As roughly shown at step 104 of FIG. 4, when encrypted data is ready for transmission to the data storage device 18, the IDE controller 30 (shown in FIG. 1) of the encryption interface 10 transmits the data. The write strobe is sent directly to the IDE controller 14 (shown in FIG. 1) of the data storage device 18 for the remaining period of time. Upon completion of the host side data transfer, the cryptographic interface 10 immediately generates a write strobe as shown in step 106 of FIG. 4 and attaches it to the storage side data transfer.

5 is a schematic representation of a PIO data-in transfer from data storage device 18 to host device 16. In one example, PIO data-in transfer may be defined as PIO data transfer from data storage device 18 to host device 16. In another example, PIO data-in transfer may be defined as PIO data transfer from host device 16 to data storage 18.

Initially, the cryptographic interface 10 intercepts important IDE / ATA data transfer variables, such as data transfer mode, data transfer size, and the like, as outlined in step 110 of FIG. And prepare for PIO data-in transfer between data storage 18. The cryptographic interface 10 generates a read strobe for the IDE controller 32 (shown in FIG. 1) to begin retrieving data from the data storage device 18. The data storage device 18 responds by sending encrypted data via a small input data buffer 26 (shown in FIG. 1) to the encryption engine 24 of the encryption interface 10 for decryption. Encryption interface 10 reads strobes as shown approximately in FIG. 5 until the decrypted data is ready to be sent to host device 16 via small output data buffer 28 (shown in FIG. 1). Continue to generate

As shown roughly at step 114 of FIG. 5, the host device 16 generates a read strobe to retrieve the decrypted data from the cryptographic interface 10. The read strobe generated at the host device is stored by the IDE controller 30 (shown in FIG. 1), the IDE controller 32 and the IDE controller 14 (shown in FIG. 1) for the remainder of the data transfer. Directly sent to (18).

As shown in step 116 of FIG. 5, upon completion of data storage-side data transfer, the IDE controller 30 of the encryption interface 10 causes the host device 16 to decrypt the remaining input decrypted data from the encryption interface 10. It stops sending read strobes generated by the host device in order to continue reading.

PIO data-in and data-out transmissions produce the same data output rate on both sides of the cryptographic interface 10, resulting in data flow by the cryptographic interface 10 due to differences in strobe periods on each side of the cryptographic interface 10. Avoid the need in the prior art for control support.

The initial and final parts of the PIO data transmission do not encounter data flow control issues even if no data strobe is sent in this relatively short part of the data transmission. One reason is that this portion of data transmission is relatively short. Another reason is that the data transfer between the host device 16 and the encryption interface 10 alone does not require data flow control. The data transfer itself between the encryption interface 10 and the data storage device 18 alone also does not require control of the data flow. In general, data flow control may be required by the cryptographic interface 10 when there is a difference in the amount of data transmitted on both sides of the cryptographic interface 10, but this relatively short initial / final data transmission portion may be the host device side or Since it only occurs on the data storage side, data flow control is not usually required by the encryption interface 10.

FIG. 6 illustrates generally one embodiment of the encryption engine 24 of the encryption interface 10 of FIG. 1. Specifically, the encryption engine 24 of the encryption interface 10 immediately encrypts / encrypts data upon detecting that the small output data buffer 28 is full, as shown by the output buffer full message of FIG. 6. It is programmed to stop decryption. Specifically, all pipeline encryption stages stop data processing immediately and no more data is received from the small input data buffer 26. Any data present in the encryption pipeline no longer advances to the next stage. The overall encryption operation is “frozen” until the encryption engine 24 detects that the small output data buffer 28 is no longer full. At that point, encryption engine 24 resumes data processing, and each encryption pipeline stage continues operation from where it was previously stopped. Those skilled in the art will appreciate that this encryption scheme simplifies the circuitry, thus data processing, and also reduces manufacturing costs.

7 is a flowchart generally showing a real-time data encryption / decryption method during IDE / ATA data transmission. In step 140 of FIG. 7, the ATA information is exchanged between the host device 16 and the data storage device 18 via the interface 10 (shown in FIG. 1). The cryptographic interface 10 intercepts the critical ATA parameters, receives the input data, processes the data, and transmits the processed data to the data storage device 18 or the host device 16, respectively. In one embodiment, data processing may mean data encryption. In another embodiment, data processing may mean data decryption.

In step 142, the cryptographic interface 10 receives dataflow control signals from the host device 16 or the data storage device 18, respectively. In step 144, the cryptographic interface 10 is programmed to determine whether all data has been processed. When all the data has been processed, the host device 16, as shown generally in step 146 of FIG. 7, includes an IDE controller 12 (shown in FIG. 1) and an IDE controller 30 (shown in FIG. 1). And the state of the data storage device 18 via the IDE controller 32 (shown in FIG. 1), and the data transfer is stopped. If all the data has not been processed, as shown generally in step 148 of FIG. 7, the cryptographic interface 10 may program to determine whether data is flowing between the host device 16 and the data storage device 18. FIG. It is.

In step 150, if data is flowing, the cryptographic interface 10 is programmed to immediately send the received data flow control signal from the host device 16 to the data storage device 18, or vice versa. In step 152, if no data is flowing, the cryptographic interface 10 is programmed to delay delivery and playback of the received dataflow control signal. The real time data encryption / decryption cycle continues as indicated generally by arrow 154.

8 is a flowchart generally showing a real-time data encryption / decryption method during UDMA / Multi-word DMA data transmission. In step 160, ATA information is exchanged between the host device 16 and the data storage device 18 via the cryptographic interface 10. The cryptographic interface 10 intercepts critical ATA parameters, initializes data bursts with the host device 16 (shown in FIG. 1) and the data storage device 18 (shown in FIG. 1), and stores the incoming data. The data received and processed by the data is transferred to the data storage device 18 or the host device 16, respectively. In one embodiment, data processing may mean encryption. In another embodiment, data processing may mean data decryption.

In step 162, the cryptographic interface 10 receives data flow control signals from the host device 16 or the data storage device 18, respectively. In step 164, the cryptographic interface 10 is programmed to determine whether a complete control signal has been received from the host device 16 or the data storage device 18, respectively. If an end control signal has been received, the cryptographic interface 10 is programmed to determine whether the data transfer has ended, as generally indicated in step 168. If the data transfer has ended, the cryptographic interface 10 executes a data burst completion procedure to the host device 16 or the data storage device 18, respectively, as generally indicated in step 170. FIG.

In step 172, in the case of UDMA / Multi-word DMA data-out transfer, the cryptographic interface 10 is programmed to send ATA information from the data storage device 18 to the host device 16, and the data transfer is stopped. . In the case of UDMA / Multi-word DMA data-in transfer, the cryptographic interface 10 is programmed to transfer the manipulated ATA information from the data storage device 18 to the host device 16, and the data transfer is stopped.

If no complete control signal is received, the cryptographic interface 10 sends the received dataflow control signals from the host device 16 to the data storage device 18, respectively, as generally indicated in step 168 of FIG. Alternatively, the data storage device 18 is programmed to immediately send the data to the host device 16. Similarly, if data transfer has not ended, the cryptographic interface 10 sends the received dataflow control signals from the host device 16 to the data storage device 18, respectively, as generally indicated in step 168 of FIG. Or is sent to the host device 16 from the data storage device 18 immediately. The real time encryption / decryption cycle continues, as indicated generally by arrow 174.

9 is a flowchart generally showing a real-time data encryption / decryption method during PIO data transmission. In step 180, ATA information is exchanged between the host device 16 (shown in FIG. 1) and the data storage device 18 (shown in FIG. 1) via the cryptographic interface 10 (shown in FIG. 1). do. The cryptographic interface 10 intercepts critical ATA parameters.

In step 182, the cryptographic interface 10 receives the incoming initial data and processes the initial data. In the case of PIO data-out transmission, the cryptographic interface 10 is programmed to delay delivery of the host device generated write strobe. In the case of PIO data-in transfer, cryptographic interface 10 is programmed to generate a read strobe.

In step 184, the cryptographic interface 10 receives the input data and processes the input data. In addition, in the case of PIO data-out transmission, the cryptographic interface 10 is programmed to send the host device generation write strobe from the host device 16 to the data storage device 18. In the case of PIO data-in transfer, the cryptographic interface 10 is programmed to send the host device generation write strobe from the host device 16 to the data storage device 18.

In step 186, the cryptographic interface 10 is programmed to determine if the data transfer has ended. If the data transfer has not ended, the real time data encryption / decryption cycle continues, as generally indicated by arrow 190. When the data transfer is terminated, as shown generally at step 188, the cryptographic interface 10 generates a write strobe in the case of PIO data-out transfer, and as previously described with reference to step 106 of FIG. The recording strobe is programmed to add to the storage device side data transfer, and the data transfer process is stopped. As further shown in step 188 of FIG. 9, for PIO data-in transmission, the cryptographic interface 10 is programmed not to send a host device generated read strobe, and the data transfer process is stopped.

While the present invention has been described above through various specific embodiments, those skilled in the art will recognize that the present invention may be modified and practiced within the spirit and scope of the present invention. In addition, features illustrated or described as part of either implementation can be used in other implementations to provide yet another implementation such that such features are not limited to the specific implementations described above. Thus, it is intended that the present invention cover all such embodiments as long as such embodiments and modifications come within the scope of the appended claims and their equivalents.

According to the present invention, the chip manufacturing cost can be reduced.

1 is a schematic block diagram of a real-time data encryption / decryption system for IDE / ATA data transmission.

2 is a schematic block diagram of an ultra direct memory access (UDMA) / multiword DMA data-out transfer.

3 is a schematic block diagram of a UDMIA / multiword DMA data-in transfer.

4 is a schematic block diagram of a programmed input / output (PIO) data-out transfer.

5 is a schematic block diagram of a PIO data-in transfer.

6 is a schematic diagram of one embodiment of a real-time data encryption / decryption system of FIG.

7 is a flow chart schematically illustrating a real time data encryption / decryption method during IDE / ATA data transfer.

8 is a flow diagram schematically illustrating a method of real time data encryption / decryption during UDMA / multiword DMA data transfer.

9 is a flow chart schematically illustrating a method of real time data encryption / decryption during PIO data transmission.

Claims (26)

Effectively coupled between at least one host device and at least one data storage device, real time between the at least one host device and the at least one data storage device during IDE / ATA data transfer without affecting overall data transfer efficiency At least one cryptographic interface adapted to perform data encryption and decryption. Effectively coupled between at least one host device and at least one data storage device, real time between the at least one host device and the at least one data storage device during IDE / ATA data transfer without affecting overall data transfer efficiency At least one cryptographic interface adapted to perform data encryption. Effectively coupled between at least one host device and at least one data storage device, real time between the at least one host device and the at least one data storage device during IDE / ATA data transfer without affecting overall data transfer efficiency At least one cryptographic interface adapted to perform data decryption. Effectively coupled between at least one host device and at least one data storage device, blocking at least one IDE / ATA data transfer between the at least one host device and the at least one data storage device, wherein the at least one At least one cryptographic interface adapted to transparently perform real-time cryptographic processing for blocked IDE / ATA data transmissions. In a data encryption system, At least one host device; At least one data storage device; And Effectively coupled between at least one host device and at least one data storage device, the data being streamed during IDE / ATA data transfer between the at least one host device and the at least one data storage device. At least one cryptographic interface adapted to transmit IDE / ATA dataflow control signals between a host device and the at least one data storage device Data encryption system comprising a. In a data encryption system, At least one host device; At least one data storage device; And Effectively coupled between at least one host device and at least one data storage device, wherein the at least one when data is not being streamed during IDE / ATA data transfer between the at least one host device and the at least one data storage device At least one cryptographic interface adapted to delay transmission of the IDE / ATA dataflow control signal between the host device and the at least one data storage device. Data encryption system comprising a. In the encryption interface for adjusting IDE / ATA data transfer, A first IDE controller supporting some ATA protocols; And A second IDE controller that supports some ATA protocols and is effectively coupled to the first IDE controller Including; The first and second IDE controllers may include at least one host IDE controller of the at least one host device when data is being streamed during IDE / ATA data transfer between at least one host device and at least one data storage device. Adapted to transmit IDE / ATA dataflow control signals between the data storage IDE controllers of at least one data storage device, And the at least one host IDE controller and the at least one data storage IDE controller support full ATA protocol. In the encryption interface for adjusting IDE / ATA data transfer, A first IDE controller supporting some ATA protocols; And A second IDE controller that supports some ATA protocols and is effectively coupled to the first IDE controller Including; The first and second IDE controllers include at least one host IDE controller of the at least one host device when data is not being streamed during IDE / ATA data transfer between at least one host device and at least one data storage device. Is adapted to delay transmission of the IDE / ATA data flow control signal between a data storage IDE controller of the at least one data storage device, And the at least one host IDE controller and the at least one data storage IDE controller support full ATA protocol. The method of claim 7, wherein At least one crypto engine adapted to transparently perform real-time data encryption processing with the first and second IDE controllers during IDE / ATA data transfer between the at least one host device and the at least one data storage device Password interface, characterized in that it further comprises. The method of claim 8, At least one crypto engine adapted to transparently perform real-time data encryption processing with the first and second IDE controllers during IDE / ATA data transfer between the at least one host device and the at least one data storage device Password interface, characterized in that it further comprises. The method of claim 9, And the at least one crypto engine is effectively coupled between at least one small input data buffer and at least one small output data buffer. The method of claim 10, And the at least one crypto engine is effectively coupled between at least one small input data buffer and at least one small output data buffer. The method of claim 11, And the at least one host IDE controller includes at least one large data buffer. The method of claim 11, And said at least one data storage IDE controller comprises at least one large data buffer. The method of claim 12, And the at least one host IDE controller includes at least one large data buffer. The method of claim 12, And said at least one data storage IDE controller comprises at least one large data buffer. The method of claim 11, And wherein said at least one crypto engine is programmed to stop cryptographic data processing upon detecting that said at least one small output data buffer is fully filled. In the encryption interface for adjusting IDE / ATA data transfer, A first IDE controller supporting some ATA protocols; And A second IDE controller that supports some ATA protocols and is effectively coupled to the first IDE controller Including; The first and second IDE controllers include at least one host IDE controller of the at least one host device when data is being streamed during a UDMA / multiword DMA data transfer between at least one host device and at least one data storage device. And transmit a data flow control signal between a data storage IDE controller of the at least one data storage device, And the at least one host IDE controller and the at least one data storage IDE controller support full ATA protocol. In the encryption interface for adjusting IDE / ATA data transfer, A first IDE controller supporting some ATA protocols; And A second IDE controller that supports some ATA protocols and is effectively coupled to the first IDE controller Including; The first and second IDE controllers include at least one host IDE of the at least one host device when no data is being streamed during the UDMA / multiword DMA data transfer between the at least one host device and the at least one data storage device. Is adapted to delay transmission of a data flow control signal between a controller and a data storage IDE controller of the at least one data storage device, And the at least one host IDE controller and the at least one data storage IDE controller support full ATA protocol. In the encryption interface for adjusting IDE / ATA data transfer, A first IDE controller supporting some ATA protocols; And A second IDE controller that supports some ATA protocols and is effectively coupled to the first IDE controller Including; The first and second IDE controllers include at least one host IDE controller of the at least one host device and the at least one when data is being streamed during PIO data transfer between at least one host device and at least one data storage device. Is adapted to transmit data flow control signals between the data storage IDE controllers of the data storage devices of the And the at least one host IDE controller and the at least one data storage IDE controller support full ATA protocol. In the encryption interface for adjusting IDE / ATA data transfer, A first IDE controller supporting some ATA protocols; And A second IDE controller that supports some ATA protocols and is effectively coupled to the first IDE controller Including; The first and second IDE controllers include at least one host IDE controller and the at least one of the at least one host device when data is not being streamed during PIO data transfer between at least one host device and at least one data storage device. Adapted to delay transmission of data flow control signals between the data storage IDE controllers of one data storage device, And the at least one host IDE controller and the at least one data storage IDE controller support full ATA protocol. A method of encrypting data during IDE / ATA data transfer between a host device and a data storage device, the method comprising: Blocking at least one IDE / ATA data transfer between the host device and the data storage device, Transmitting an IDE / ATA data flow control signal between the host device and the data storage device when data is streaming between the host device and the data storage device; Delaying transmission of an IDE / ATA data flow control signal between the host device and the data storage device when data is not streaming between the host device and the data storage device; And Transparently real-time encryption of data Data encryption method comprising a. A method of blocking coordination of data transfer during IDE / ATA data transfer between a host device and a data storage device, the method comprising: Receiving an IDE / ATA data flow control signal; Determining whether an end control signal has been received; And Immediately transmitting the received IDE / ATA data flow control signal between the host device and the data storage device when the termination control signal is not received; Transmission coordination blocking method of the data comprising a. The method of claim 23, wherein Determining whether data transmission is completed; And And if the data transmission is not completed, immediately transmitting the received IDE / ATA data flow control signal between the host device and the data storage device. A method of blocking coordination of data transfer during IDE / ATA data transfer between a host device and a data storage device, the method comprising: Processing incoming data, Transmitting a write strobe generated by the host device from the host device to the data storage device; Determining whether data transmission is completed; And Generating a corresponding write strobe for transfer from the host device to the data storage device Transmission coordination blocking method of the data comprising a. A method of blocking coordination of data transfer during IDE / ATA data transfer between a host device and a data storage device, the method comprising: Processing the incoming data; Transmitting a read strobe generated by the host device from the host device to the data storage device; Determining whether data transmission is completed; And Prohibiting the host device from transmitting the generated read strobe from the host device to the data storage device. Transmission coordination blocking method of the data comprising a.