March 2007 13P u b l i s h e d b y t h e I E E E C o m p u t e r S o c i e t y

I N D U S T R Y T R E N D S

I nformation security during thepast few years has concentratedlargely on data in motion—information communicated vianetworks. However, the focus

has been shifting recently to pro-tecting data at rest, which includesinformation on hard drives, flashmemory devices, and magnetic tape.

This shift has been fueled in part byalmost weekly reports of securitybreaches involving the theft or loss of laptops containing corporate orgovernment secrets or sensitive per-sonal data—including Social Security,credit card, and bank account num-bers; passwords; and even medicalinformation—that government agen-cies, insurance companies, healthcarefacilities, financial institutions, andother organizations have collected.

To help address these concerns,companies are increasingly adoptinghard drives that encrypt data as it iswritten, which vendors such asLaCie, Seagate, and StonewoodElectronics manufacture.

These types of hard drives havebeen around for several years butonly as niche products, primarily forgovernment agencies, banks, andother organizations with particularlystrict privacy or secrecy requirements.Thus, as of mid-2006, only 15 per-cent of organizations encrypted dataon laptops, noted Paul Stamp, seniorsecurity and risk analyst for ForresterResearch.

Hardware-based encryption dif-fers from the traditional approach to

encrypting data on hard drives, inwhich computer CPUs run crypto-graphic software.

The hardware-based techniqueoffers several advantages, includingfaster performance and less strain ona host system’s processing resources.

However, the approach also hasdisadvantages, such as additionalcost and the inability to patch orupgrade products.

DRIVING THE SWITCH TOHARDWARE

The ongoing loss of sensitive orother important information storedon computers is a major drivingforce behind the move to hard-drive-based encryption.

Most of the lost information hascome from misplaced, stolen, loaned,improperly reassigned, or discardedlaptops, although desktop comput-ers also present a risk. Many organi-zations have experienced potentiallytroublesome problems. For example,a recent audit by the US Departmentof Justice’s Office of the InspectorGeneral revealed that the FBI has lost160 laptops over a 44-month period.

Organizations are thus looking fornew ways to protect information.

“Companies choosing not to pro-tect their data in spite of the recentprevalence of data theft will find it almost impossible to defend theirposition to the public,” said Stone-wood IT security advisor AndrewDonaghue.

Many Asian, European, andNorth American governments man-date that companies in variousfields—such as healthcare, finance,and education—protect data.

Regulations include the US govern-ment’s Health Insurance Portabilityand Accountability Act, the EuropeanCommunity’s Directive on Protectionof Individuals with Regard to theProcessing of Personal Data and onthe Free Movement of Such Data, andSouth Korea’s Act on the Protectionof Personal Information Maintainedby Public Agencies.

Numerous government agenciesthroughout the world also mandatethat the computer equipment theybuy include encryption capabilities.

Meanwhile, many individualswho keep private or personallyimportant material on their com-puters also want better protection.

Proponents say the hard drive is agood place to implement data secu-rity because it is a closed environ-ment in which the internal opera-tions are sealed off from other com-puting-system elements.

“Nothing goes on the disk unlessit’s encrypted. Whatever else hap-pens [in the host system], the datawill still be unreadable,” said secu-rity expert and Purdue UniversityProfessor Eugene Spafford.

Hardware-based encryption ismore dependable because it is builtinto the drive and cannot be tam-pered with, unlike software-basedencryption, which users can updateor modify via potentially unreliabledownloads, added Michael Willett,senior director of security at hard-disk vendor Seagate.

Moreover, he said, the software-based approach—offered by ven-dors such as PGP and WinMagic—

Taking a Hard-Line Approach to EncryptionCameron Laird

r3intr.qxp 23/2/07 12:06 PM Page 13

14 Computer

I N D U S T R Y T R E N D S

a single protected computer or dataset. The systems also come with key-management tools.

All of the products work with astandard hard drive; a cryptographicapplications-specific integrated cir-cuit (ASIC), usually proprietary, forencoding and decoding; a smallamount of memory to preserve ses-sion information such as the currentkey; and hardwired interconnectsthat ensure that only encrypted infor-mation reaches the disk.

The ASICs and other related tech-nologies are designed to be fastenough to avoid slowing the harddrive’s read and write activities.

The ASICs also process informa-tion independently of the host OSand thus function across multipleoperating systems and aren’t vulner-able to attacks from host processes.

Vendors working with the TrustedComputing Group (TCG) industryconsortium (www.trustedcomputinggroup.org) will be able to include aTrusted Platform Module crypto-graphic chip in their hard-drive elec-tronics.

Encryption-enabled hard-drive sys-tems use established schemes such asthe Advanced Encryption Standard,a symmetrical (the same crypto-graphic key encrypts and decryptsdata) technique that employs 128-bitblocks and 128-, 192-, or 256-bitencryption keys. The US governmentadopted AES as one of its officialcryptographic systems in 2000.

uses considerable host-processorresources, potentially slowing over-all performance and consuminglarge amounts of power.

THE BIG PICTURESeveral companies, including

IBM, experimented with crypto-graphic coprocessors for hard-drive-based encryption in the mid1990s.

Under the hoodThe central idea behind hardware-

based encryption is to encrypt alldata in real time as it is stored on acomputer’s hard disk. The techniquerequires users to provide access keysto retrieve the data. Thus, if thedevice is lost, stolen, or even acci-dentally assigned to a different user,presumably without an access key,unauthorized people can’t view thedata it contains.

Encryption-enabled hard drivescould be either external or internal,while the encryption hardware couldbe either part of the drive or an inde-pendent module.

The keys for these systems includeconventional user name-passwordcombinations, designated charactersequences, biometric identifiers suchas fingerprints, hardware tokens,and various combinations of theseelements.

Encryption-enabled hard drivescan accommodate multiple keys toenable numerous users to work with

All encryption and decryptionoccurs on the hard drive, so the sys-tem doesn’t consume any of the hostcomputer’s processing or memoryresources.

Destroying the access key or keysmakes protected data inaccessible.Thus, this process can make hard drives safe to dispose of or reassignwithout undertaking the time-con-suming disk-wiping process, notedAage Kalsaeg, High Density Devices’chief marketing officer.

Variations on a themeSeveral vendors are selling differ-

ent types of hard drives with encryp-tion capabilities. More products arescheduled for the near future.

High-Density Devices. As Figure

1 shows, HDD’s SecureD technologyis a hardware module that workswith any standard off-the-shelf harddrive. SecureD sits in what tradi-tionally has been a direct connectionbetween the CPU and hard drive.The module includes a reader thatworks with smart cards functioningas removable access keys.

SecureD Desktop and SecureDLaptop are packaged with internaldrives. HDD also bundles its smart-card reader with a standard 120-gigabyte external hard drive andcontroller that connect to systemsvia FireWire or Universal Serial Bustechnology.

A user can configure SecureDeither to lock all data cryptographi-cally as soon as the key is removedor to continue decrypting for a des-ignated period of time after removal,thereby allowing others to access theinformation temporarily if desired.

LaCie. LaCie’s d2 SAFE externalhard drives for desktop and laptopcomputers use AES encryption andfingerprint-based biometric keys,said Marie Renouard, the company’sproduct manager.

The system takes readings ofauthorized users’ fingerprints, calcu-lates hash values for them, and thenstores the information as well as eachperson’s permitted level of systemaccess. People who want to work

SecureDencryption

module

User

Motherboard,CPU, memory,I/O controllers

Storagedevice

DataEncrypted

data

Key tokeninterface

Smart card

Source: High Density Devices

Figure 1. High Density Devices’ SecureD technology is a hardware module that

encrypts all data passing from a CPU to a hard drive or other storage device.To access

data, users must insert a smart card with the correct access key into a reader.

r3intr.qxp 23/2/07 12:06 PM Page 14

March 2007 15

with a system pass a fingertip over asensor, and if their fingerprint’s hashvalue matches that of an authorizeduser, they gain access. Registeredusers can swipe a finger across thesensor to relock their systems.

d2 SAFE drives also offeradjustable power-usage levels toconserve energy.

Seagate. Seagate sells encryption-enabled hard drives for digital videorecorders and plans to release othermodels for internal use in laptops andeventually servers soon.

The company targets big organiza-tions ordering large numbers of high-end hard drives at one time. Thus, itsDriveTrust products simplify theadministration process. They includea standard API and a software devel-oper’s kit to let companies writeapplications that, for example, man-age and update keys, report on diskusage, and handle authentication.

The top DriveTrust models use twoASICs to achieve high throughput.

Current DriveTrust products relyon Triple DES (Data EncryptionStandard). However, Willett said,the upcoming Momentus line of dri-ves will offer the stronger AES. Thedisks use password-based keys andan optional thumbprint-based bio-metric approach.

Stonewood Electronics. Stone-wood’s FlagStone technology inte-grates data storage, AES encryption,and authentication into internal andportable disk drives for desktop and laptop computers. The drivesoffer storage capacities between 30and 120 gigabytes and operate across multiple operating systemsand applications.

The products present authentica-tion requests as the BIOS processbegins. Each requires different typesand levels of authentication, depend-ing on the desired security level, tocontinue the bootup process andenable hard-drive access. For exam-ple, FlagStone Corporate requires asingle password, FlagStone BaselinePlus requires two passwords, andFlagStone Enhanced requires a pass-word and a token.

BARRIERSRetail comparisons show that

200-gigabyte hard drives with en-cryption capabilities cost up to $150more than those without them. Theadditional cost may be a barrier tosome small firms but probably notto companies for whom data pro-tection is a high priority.

Encryption-enabled hard drivesadd key management, maintenance,and other administrative tasks.However, companies such as Seagateinclude features designed to makethis process easier.

At the same time, standardizationof hardware-based encryption re-mains in its infancy, so managementtools from one vendor do not workwith products from a different vendor.

Most software-based encryptionproducts, on the other hand, workacross different hard-disk platformsand types, which makes manage-ment easier, according to JohnDasher, PGP’s director for productmanagement.

Software-based encryption is alsoflexible and scalable, which enablesbetter key management, particularlywhen used across large numbers ofdrives, stated WinMagic founder,CEO, and president Thi Nguyen-Huu.

Purdue’s Spafford said software-based encryption might be betterthan hard-drive-based encryption atrecovering data from disks withhardware-based defects.

Another issue is that security func-tionality is hardwired into mostencryption-enabled hard drives,which thus can’t be patched orupgraded if problems arise orimprovements are available later.

And if users who have access todata lose their password, smart card,or other key, the information thatthe key accesses cannot be retrieved.

O ver time, the technology inencryption-enabled hard drivesis likely to change. Drives could

increasingly include TCG technologyor use new types of encryption asthey are developed.

For example, hard drives eventu-ally could work with elliptic curveencryption, said Seagate’s Willett.ECC is a public-key encryption tech-nique, not yet widely used, based onelliptic curve equations that can cre-ate faster, smaller, and more efficientcryptographic keys.

Currently, the encryption-enabledhard-drive market is fragmented,with most offerings from small ven-dors, noted Johannes Ulrich, chiefresearch officer with the SANSInstitute, a computer-security train-ing and research organization.

Of course, this could change as themarket grows. And, Ullrich said,growth appears to be in the offingbecause the technology is receivingconsiderable attention from indus-try observers.

In fact, because of ongoing cyber-crime and data breaches and theexpected adoption by many users ofMicrosoft Vista—which has two ver-sions that offer a software-basedhard-disc encryption utility calledBitLocker—2007 could be a crucialyear for hard-drive-based encryption.

Organizations’ specific securityrequirements and practices varyenormously, so there apparently willbe a healthy demand for both soft-ware- and hardware-based hard-drive encryption.

“No one size fits all,” saidForrester’s Stamp.

“We’re seeing a trend in which theboundaries around our data areshrinking,” he concluded. “Securityused to be about protecting theperimeter. We’re on a path to whatwe really need: an infrastructure thatprotects the data itself. A big part ofthat is encrypting the data as itappears on hard drives.” ■

Cameron Laird is a freelance technol-ogy writer based in Friendswood,Texas. Contact him at cameron@phaseit.net.

Editor: Lee Garber, Computer,l.garber@computer.org

r3intr.qxp 23/2/07 12:06 PM Page 15