Automatic Drive Locking: Securing Digital Content Storage in the Digital Home

Transcription

1 Automatic Drive Locking: Securing Digital Content Storage in the Digital Home January 2007

2 Silicon Image White Paper Table of Contents Table of Contents... 1 Introduction... 2 Disk based storage is expanding in new directions... 2 Physical Security of External Hard Drives... 2 Introducing Automatic Drive Locking... 4 Storage Processors and Automatic Drive Locking Applications and Benefits... 6 Conclusion

3 White Paper Silicon Image Introduction External hard drives are an easy way to add digital storage to a variety of electronic devices. Consequently they have become very popular among consumers, with the market projected to grow by over 263% between 2005 and As useful as external drives are, storing data outside the host device creates a new set of problems for users, corporations, and government agencies. The portability of external hard drives creates a security risk, and the stakes are raised by ever increasing drive sizes, as well as by backup programs that copy all of a users important data to the external hard drive. In addition, as external hard drives begin to proliferate in the consumer electronics space, their portability introduces new potential problems for manufacturers who have to balance providing expandable storage to consumers with the requirements of content providers who want a digital rights management scheme that ensures that premium content is being used as intended. Automatic drive locking on a storage processor uses an access-control approach to provide content security for hard drive based storage. It uses a unique, well hidden password burned into the storage processor to lock the drive to the storage processor, rendering the drive inoperable if not attached to its specific host. A major advantage of enabling this feature on a storage processor is that it requires no user intervention. Automatic drive locking provides benefits for a wide range of users, from consumers, to corporations, to government agencies, and across a range of devices that supports internal or external hard drive storage. Automatic drive locking can also be used as a component in an overall content protection strategy by manufacturers who wish to add additional protection of premium content. Disk Based Storage is Expanding in New Directions External hard drives started as a convenient means of adding storage, or backing up data off computers. This is especially true for laptops, which generally have limited internal expansion capabilities. In fact, many external drives come packaged with easy-to-use backup tools that can be executed with the push of a button. Recently, external drives have begun growing into the consumer electronics space, adding capacity to DVRs and HDTV/PVRs and providing more space to store videos, music and pictures. Even video game consoles are jumping on the bandwagon; the PlayStation 3 has a built in hard drive while the Xbox 360 includes an option to add an external hard drive. The additional storage allows users to download games, movie trailers and other premium content directly onto their game console. Physical Security of External Hard Drives Ironically, many of the features that make external drives an attractive and convenient option for consumers also make them attractive targets for theft. The weak physical security of external hard drives creates a 1 Source: IDC, Worldwide Hard Disk Drive Forecast and Analysis: Record-Breaking Years Lie Ahead, Doc #201478, May

4 Silicon Image White Paper problem for everyone who is storing or backing up sensitive data onto an external drive, from home videos and photos, to sensitive business documents, and government personnel records. The increasing popularity of system backups to external drives presents another security risk. System backups create a copy of all of the data on the system to the external drives. While this helps protect a user from losing data due to a system or drive failure, without security mechanisms on the external drives, system backups can actually make data or identity theft easier. The consequences of theft grows as the size of external hard drives increases to allow for a more comprehensive and historical collection of personal information. The recent highly publicized case of data theft at the Department of VA in May of 2006, including a laptop and external hard drive with 26.5 million personnel records of active and retired members of the armed services, underscored all too clearly the dangers of unprotected external storage. 2 After the VA incident, the House of Representatives committee on Government Reform asked various government agencies to provide details about cases of data theft in their departments. One of the primary conclusions of this investigation was that "Physical security of data is essential. Only a small number of the data breaches reported to the Committee were caused by hackers breaking into computer systems online. The vast majority of data loss arose from physical thefts of portable computers, drives, and disks, or unauthorized use of data by employees. 3 [italics added] Manufacturers of consumer electronics devices also have reason to be interested in methods to secure content. Ports for attaching external drives have become commonplace on consumer electronic devices such as DVRs. Much if not all of the content being stored on those drives is considered "premium content". This is content that is under copyright and that has restrictions on where or when it is to be played. The ability to lock a drive to a specific set top box (STB) or DVR adds another layer of content security over existing encryption schemes. In summary, the relatively weak physical security of external hard drives means that data stored on them is vulnerable, and the type of data on them makes them attractive targets. This issue affects everyone who values their content, from families who wish to keep their personal videos, photos, tax returns and bank account information private, to corporations and governments who wish to protect sensitive and confidential data. Consumer electronic manufacturers also have an interest in securing external devices using access control as part of an overall strategy to protect copyrighted content. These are real problems plaguing the industry, and they require a solution that helps protect an external drive by providing access-control level protection. Automatic drive locking on storage processors from Silicon Image meets this need with a complete, automatic, easy-to-use solution. 2 Source: 3 Source: Committee on Government Reform, Staff Report Agency Data Breaches Since January 1, 2003; Oct

5 White Paper Silicon Image Introducing Automatic Drive Locking There are three main approaches to physically secure externally stored data. The first approach attempts to prevent the theft of the drive by using a device such as a Kensington lock to physically secure the drive to it s location. The second approach is to encrypt the data stream, either before transmission from the host, or in some cases on the hard drive itself. The user must then provide proper authentication keys to decrypt the data. The third method involves controlling access to the drive. When combined with a well hidden password, access control is an especially strong form of security. Unlike encryption mechanisms, the access control approach allows no data to be passed until the correct password is provided. There is therefore no possibility that the data can be copied and decrypted without the password. To attain this level of security, automatic drive locking utilizes a unique 128-bit password burned onto a hidden, protected area of the storage processor. All of the approaches described above provides some level of protection and are complementary rather than competing techniques. Using all three in unison will provide the maximum security for the data stored on drives. How it Works Automatic drive locking as implemented on SteelVine storage processors uses the third approach, access control, to lock drives. The operation of all modern consumer hard drives are based on the ATA standard, which specifies how storage devices are attached to host systems. This standard includes a definition for a maximum security mode which, when activated, locks the hard drive until it receives the correct password. When an ATA compliant drive is attached to a storage processor with automatic drive locking and an enumeration command is sent to prepare the drive for writing. The maximum security mode is activated using a unique 128-bit password, which was burned into the ROM of the storage processor at the time of manufacture. As some SteelVine storage processors can 4

6 Silicon Image White Paper support multiple levels of drives (capacity expansion), it is important to note that all drives attached to the storage processor, including cascaded levels, are locked by this single password. Once the security mode is activated, every time the drive is power cycled or hot plugged, the drive automatically locks and will not allow data access until the proper password is given. Since the password in this case is a unique string stored inside the storage processor, only the storage processor can unlock the drive. If the drive is moved to a different host, even another host with a storage processor that supports auto drive locking, the drive will remain locked and the data will be inaccessible. The management of locking drives when first attached and unlocking drives when they are power cycled happens automatically without any user intervention. Security Benefits The access control approach to security has the advantage of not exposing any data without authorization. The drives attached to the storage processor are set to auto-lock on power up or mode change and are only unlocked when the proper password is provided. This prevents any possibility that the data stream could be intercepted and read without being attached to the proper storage processor. The 128-bit strength password is not readily susceptible to brute force attacks and is stored inside the processor s ROM in such a way that the host device has no means to access it. This prevents any attacks through the system or a PROM reader. Only the storage processor can retrieve the password, and it is never exposed to the host. The burned in 128-bit key is also more secure than manual password locking and encryption methods that depend on a diligent user to provide a difficult-to-guess password. Because the data on the drive is automatically locked by the storage processor itself without the need for user intervention, automatic drive locking is not dependent on a user providing a secure password to lock it, nor on the user remembering a password to access it. Ease of Use Automatic drive locking can be used with almost any consumer drive, as the ATA maximum security mode is a standard feature on most of the hard drives on the market. By adding the unique embedded 128-bit password and the total automatic management of the security mode, storage processors with automatic drive locking allow consumers to easily take advantage of the benefits of drive locking without the hassle of setup or management. Safety Mechanisms Part of providing security for the user is taking reasonable steps to ensure that the user is not handicapped by the security mechanisms put in place. At the factory, a verification procedure is used to ensure that each 128-bit password burned into a storage processor is unique. In addition, a delay is placed in the locking 5

7 White Paper Silicon Image mechanism which asks for a user confirmation before the drive will be enumerated (prepared for the first write). Finally, the ATA security mode implemented within a Silicon Image SteelVine processor provides two methods for recovery if the user accidentally locks a hard drive. The Secure Erase master password will erase all of the data on a locked hard drive and then unlock the drive. This tool is ideal for repurposing a drive when replacing or discarding the host device. As an alternative, the Service Center Index exposed by a SteelVine processor allows a user to return a drive to its manufacturer to be unlocked, without erasing the data on the drive. This is done via a service center index that protects the password on the drive at all times. Automatic Drive Locking and Digital Rights Management (DRM) Automatic drive locking is not a digital rights management technology. As a block level device, the storage processor does not provide rights management (which requires file system awareness). Instead, it controls the access of a hard drive attached to a storage processor. This supports digital rights management schemes by ensuring that data stored externally can only be accessed by the single host device it is locked to. Storage Processors and Automatic Drive Locking Applications and Benefits One of the strengths of a storage processor is the wide range of products in which it can be used. Storage processors operate independently of the host, taking over management of the hard drives attached to it and only presenting a single virtual drive to the host. This means that storage processors can be used anywhere hard drive based storage is needed, from external hard drives to embedded applications, from consumer electronics to PCs. However, because automatic drive locking is designed to lock drive(s) to a host device, storage processors that include automatic drive locking are specifically designed to be installed on the motherboard of the host device. If it is used on an external device or in a removable card, the security benefit is greatly reduced. Automatic drive locking provides security by itself, but it also complements the other methods of ensuring physical security, including data encryption and physically securing the device to the location. By providing a secure link between the host device and the external 6

8 Silicon Image White Paper drive automatic drive locking in effect makes the external hard drive part of the host, extending the security bubble of the host to the external drive. Automatic drive locking is useful for anyone who is concerned about the security of their data. Users who backup their data to an external hard drive can rest easier knowing that that drive data cannot be accessed if stolen. Corporations and government agencies can ensure that sensitive information stored on external hard drives remains safe even if theft of the media occurs. PVR and DVR manufacturers can add another tool to help them ensure that premium content stays connected to the DVR/PVR that wrote the content to the drive. While the pressing need for additional security on external drives means that the benefits of automatic drive locking are most easily conveyed in the context of these applications, using this solution with internal drives also yields security benefits. Internal drives are only slightly less vulnerable than external drives, as the time necessary to disassemble the host device to access the physical drive means they are not generally targets of casual malice. However, individuals intent on data theft can easily target internal hard drives. Automatic drive locking can be enabled on internal drives as easily as external drives, providing the same content security in both applications. Conclusion The implementation of automatic drive locking has benefits for consumers, corporations, governmental agencies, and manufacturers. Just one of several methods of securing content, it complements existing security mechanisms by providing a secure link between the storage processor and the host device using a hidden 128-bit key and an access control approach. Based on the ATA maximum security mode supported by almost every consumer hard drive on the market today, automatic drive locking extends the security mode s usefulness by automating the process on the chip, with zero input required from the user. Anyone who is concerned about the management of premium content or about sensitive or private data being stolen should use automatic drive locking to increase content security E. Arques Avenue Sunnyvale, CA T F Silicon Image, Inc. All rights reserved. Silicon Image, the Silicon Image logo and SteelVine are trademarks or registered trademarks of Silicon Image, Inc. in the United States and other countries. Other trademarks are property of their respective holders. Product specifications are subject to change without notice. Printed in the U.S.A 7