Hardware-based Encryption Devices
Hardware-based encryption devices offer the security of strong encryption with the ease of minimal configuration and platform interoperability. Any device that provides onboard encryption can be categorized as a hardware based encryption device. However, these types of devices are not always a form of storage device; many other nonstorage-specific devices can provide onboard or hardware-based encryption.
Hardware encryption can offer several benefits beyond those provided by software encryption. These include faster algorithm processing, tamper-proof or tamper-resistant key storage, and protection against unauthorized code.
When software encryption is in use, the system's resources (such as the CPU, bus, and RAM) will be partially consumed by the operations of encryption and decryption. These are finite resources, so using a portion of them for cryptographic functions will reduce the resources available for other operations, calculations, and functions. Thus, software encryption often causes a reduction in performance, including delays in processing, laggy response, and longer timeframes for computation. The more cryptography becomes a part of regular activities, the more of a drain the algorithm calculations place on the system. When hardware-based encryption is implemented, the workload of cryptography computation is offloaded to dedicated hardware processors, freeing up the general system resources for other use. This results in faster cryptographic processing as well as an improvement in overall system performance.
Hardware encryption devices often have the ability to store encryption keys and other sensitive items in highly protected areas of RAM or flash memory. Although they are not completely write-proof or change-proof, these storage locations often have restricted and limited access methods and pathways so that only the encryption hardware can interact with data stored there. These forms of secured storage are excellent for temporary and potentially prolonged encryption key storage. This is usually a significant improvement over allowing software to store encryption keys, where usually they are placed in a file on a generic storage device. Even if such a file is encrypted, that encryption key has to be stored somewhere in plaintext. Thus, there is usually a means to gain access to any software-stored secrets.
Hardware encryption devices often have reduced instruction sets or dedicated processor elements that are only able to execute authorized code. Additionally, most of these devices do not support add-on software, nor do they allow other code to run. This effectively prevents malware or other unauthorized code from gaining a foothold in the device. Again, this is much more protection than can be provided by a typical computer, which can run any software brought to the platform by a user.
There are many examples of hardware-based encryption devices. In the following sections, TPM, HSM, USB, and hard-disk encryption devices are discussed. But these are just a few of the many options available.
One example of a hardware-based encryption device is a wireless access point or wireless base station. These devices support encryption services for the radio wave signal used to carry network protocol information. Additionally, wireless adapters on wireless clients support the same hardware encryption features in order to be able to decode and encode signals being exchanged with the base station.
Another example of a hardware-based encryption device is a credit card point-of sale-device. These devices, also known as credit card terminals, typically encrypt the information they read from swiped cards before transmitting them to a processing entity. This onboard encryption is essential due to recent large-scale credit card theft attacks against insecure point-of-sale devices. Encryption has also been a requirement of the PCI-DSS security standard since the 2.0 version of the standard released in October 2010.
Yet another form of hardware-based encryption device is a network bulk encryptor. This is a device that is installed inline along a network path in order to capture cleartext or standard network communications and encrypt them for the remainder of their transmission path. Network bulk encryptors are installed in pairs, one at each end of a communication segment. The benefit of a hardware solution for network encryption is to offload the effort and resource requirements to a dedicated device, separate the encryption functions from full-featured computers, and gain performance improvements through the use of dedicated cryptographic hardware.
A final example of a hardware-based encryption device is a modern CPU with an onboard encryption instruction set. CPU manufacturers Intel and AMD have been producing CPUs with Advanced Encryption Standard (AES) instruction for several years. These additional encryption- focused instruction sets assist with encryption and decryption performance. Rather than needing to code the AES algorithm into software, programmers can call upon those functions built into the CPU.
Trusted Platform Module
The Trusted Platform Module (TPM) is a formal specification as well as a cryptoprocessor found on some motherboards implementing this specification. Originally, TPM chips were found mainly in portable systems, such as notebook computers. Today, TPM chips are common components in a wide range of devices, including all forms of computers, mobile phones, and tablets.
The Trusted Platform Module provides for a form of secured hardware storage of encryption keys as well as some assistance with cryptographic operations. These assistance functions include limiting access to stored encryption keys, serving as a random number generator to increase the entropy of encryption calculations, crafting a non-forgeable identity reference of hardware and software, supplying an endorsement key unique to each TPM, and performing hardware authentication.
Many of these services and features are quite advanced technology, and most end users will never really recognize when these are in use. However, many amazing cryptography services are made possible with the presence of a TPM chip on a system's motherboard.
The most recognizable use or function of the TPM is its link to storage encryption. Storage devices that are encrypted by using software-based full-disk encryption might be able to store encryption keys in the TPM. Additionally, some software might be able to use the TPM's randomization function in the crafting of keys. Hard disk drives and SSDs (solid-state drives) that provide their own onboard hardware encryption can also use the TPM to store their encryption keys. In addition, hardware-based encryption can make broader use of the TPM's other cryptographic features.
Tip:
TPM in conjunction with full-disk encryption rather than in any other context. Though this is a common use of the TPM chip, it is not its only use. Other uses for the TPM include verifying platform integrity, performing password storage, digital rights management, and software license protection.
Hardware Security Module
A hardware security module (HSM) is an add-on hardware device that can provide cryptoprocessing and other security features to a computer, device, or network connection that does not have these items natively. The use of an HSM can provide for faster encryption and decryption operations by offloading those intensive functions from the main CPU and limited system resources. HSMs provide for faster digital signatures, more efficient digital enveloping, and improved secure authentication services.
Most HSMs are add-on adapters. HSMs are designed as slide-in PCMCIA (Personal Computer Memory Card International Association) or PC cards, ExpressCards, or other specialty adapters supported by popular networking devices, such as switches, routers, multiplexors, concentrators, and firewalls. There are also HSM form factors of computer adapter cards, usually with a PCI interface, as well as inline network adapter HSMs.
HSMs provide for accelerated encryption computation, which is most recognizably beneficial when extremely long symmetric keys (longer than 256 bits) or extra long asymmetric keys (longer than 2,048 bits) are used. These longer key lengths often stress the typical computer CPU and system resource set but can be handled adeptly by dedicated cryptographic hardware such as an HSM.
HSMs are available in both generic or at least compatible form factors for use on typical off-the-shelf computing devices as well as in proprietary forms. The compatible forms can be used in any typical IT infrastructure because they are designed around standardized physical interfaces and software APIs. The proprietary forms of HSMs are used in specialty situations, such as ATMs, point-of-sale devices (credit card terminals), and smart card readers. These specialty implementations have proprietary physical interfaces as well as nonstandard (and unpublished) software interfaces. Thus, they are much more difficult to tamper with via external or unapproved connections.
An HSM is not dissimilar to a TPM. However, the primary distinction is that a TPM is usually a chip installed onto the motherboard by the manufacturer. Therefore, the TPM is a permanent component of a system. An HSM is usually an add-on component (although integrated versions for specialty equipment are available). This means that if you have a computer that does not come equipped with a TPM, the motherboard or even the entire system would need to be replaced in order to gain access to a TPM. If a system does not have an HSM from the vendor, often a variety of HSM products are available that can be installed into it, connected to it as a peripheral, or used in conjunction with the system (along a network segment, for example) in order to add the HSM product.
HSMs, like the TPMs, are able to store encryption keys in a tamper-resistant hardware/ software storage system, provide randomization services, and perform encryption and decryption operations, as well as many other cryptographic services. Though not every HSM device provides all possible cryptographic services, there are so many varied HSM products that almost any set of specific cryptographic needs and requirements has an available HSM solution.
USB Encryption
USB encryption is a phrase that usually refers to USB storage devices that provide onboard encryption services. Many vendors now offer onboard-encryption USB storage drives as part of their product lines. A device that provides additional features, especially onboard encryption, will likely be a more expensive product than the same device without that feature. However, the additional protection for the confidentiality and integrity of USB-stored data as well as a significant reduction in malware distribution over USB is often well worth the additional expense.
Most USB devices that provide onboard encryption are fully self-contained and rarely need any additional software or specialized hardware on the computers or systems where they are put to use, although, some of these devices might be able to take advantage of a TPM or HSM to store their master encryption key in the secured compartment provided by those mechanisms rather than storing it on the USB device itself. some USB devices might offer additional services or features through optional software that can be installed onto a target computer.
USB devices that provide hardware encryption either include an on-device credential system or rely upon software-based or hardware-based credentials from the connected computer. Those USB devices that offer onboard credential systems usually have either a keyboard or a fingerprint reader. Because the typical USB storage device is rather small, the keyboards on these devices are often just 10-digit number pads. Those USB devices supporting fingerprint readers usually employ the type of reader in which the finger is swiped across the thin slit of the reader rather than being pressed on a reader area. When these devices are plugged into a receiving USB port, the user provides the code or fingerprint to unlock the encryption. When the USB device is pulled out of the port, it automatically reverts to a locked state.
Some USB devices that provide onboard encryption rely upon a software interface to accept credentials when unlocking the storage. The software might be included on a plaintext partition on the USB device that can be read by any computer. The software might need to be formally installed, it might be able to run in place without being formally installed (this is known as a portable application), or it might auto-launch when the USB device is plugged into a computer. In any case, the software will need to be used to provide credentials. Software-based credentials for USB devices are mostly commonly passwords. A long and complex password should be defined to minimize the risk of password guessing or cracking if the device is ever lost, stolen, or otherwise accessed by an unauthorized individual.
Some USB devices that offer onboard encryption can be configured to only operate when connected to specific systems, rather than being usable on any system. This is usually most effective when TPM chips are present on the systems where use is desired. The USB device will perform a system call or hardware request in order to determine the identity of the system and/or TPM chip present. If the returned identity is not on its list of approved systems, it will disable itself for use on that system. This can be a very secure feature, but if only one system is defined as approved and that system becomes unavailable, the drive will be unusable and unrecoverable.
Some of these devices automatically time out when they are not in active use for a specified period of time. This increases the security of the device by compensating for a user who forgets about the USB drive while it is plugged into a computer. When the timeout setting disables the device, if the user needs access to the drive, he or she just needs to provide the credentials again. However, if the user is no longer near the computer and someone else attempts to access the drive contents, if the timeout is in force, the unauthorized user will be denied access.
USB devices that do not have onboard hardware-provided encryption can always be encrypted by using a software solution such as TrueCrypt, or an operating system-controlled file system solution such as Windows EFS and Linux's dm-crypt+LUKS. Either individual file encryption or full-disk encryption can be applied to any storage device.
Tip:
Keep in mind that most USB drives are not encrypted and thus are a common vector of data loss, data leakage, and malware infection. Whenever possible, apply encryption to USB devices that don't offer native hardware support for encryption.
Hard Drive Encryption
Hard drives can support a range of encryption options. As previously discussed, any hard drive can have individual file encryption or full-disk encryption applied to it by using a native operating system feature or through an add-on software product. However, there are many other options available to consider when it comes to hard drive encryption.
Some hard drives provide onboard encryption. This form of hardware-based encryption, like onboard USB drive encryption, is provided by dedicated cryptoprocessor chips built into the device. Encrypted hard drives of this type can be traditional spinning platter-based disks or solid-state drives (SSDs). The benefit of a self-encrypting hard drive is that the work of the encryption is offloaded from the system to the hard drive's dedicated processing elements.
Unlike USB-encrypted flash drives, a hardware-encrypted hard drive will not be able to use an on-device keyboard or fingerprint reader. A hardware-encrypted hard drive will need to use a TPM or an HSM, or it will need to have a software-only management interface to handle credentials for granting (or denying) access to the secured content.
A hardware-encrypted hard drive can be installed as an internal drive, like those found on typical computers or notebooks. However, a hard drive with onboard encryption can also be housed in an external casing. Using a hard drive enclosure allows the drive to be added to a system without any additional internal hard drive connection interfaces available, to a system that does not use the same connector as the drive, or to a system that uses a different physical size form factor than that of the drive. An external enclosure also allows the user to move the drive between systems. If a hard drive with onboard encryption is to be used externally so that it can be moved between systems, be sure to use a device that can be unlocked from other systems. Any encrypted drive linked to a TPM or an HSM will depend upon the presence of that specific cryptoprocessor to be accessible.
Note:
Another option for hard drive encryption would be to use an enclosure or a drive controller that provides encryption services and then attach a standard hard drive.
Benefits of a hardware-encrypted hard drive include speed performance for the encryption and decryption processes, encryption that is not dependent upon platform or software, and a guarantee that all data on the device will be encrypted. With operating system-controlled or software-controlled encryption, there is a chance that only a portion of a hard drive will be encrypted, if a partition or volume that does not cover the entire surface is created, rather than a full and complete partition or volume. Partitioning (or volumes) would not be a concern with hard drives that use onboard encryption.
A final benefit of on-device encryption is that some devices provide an easy disposal mechanism. This is a special instruction that corrupts the data on the drive or that makes the drive physically unusable. This allows a hard drive to be rendered useless in a matter of seconds, rather than having to perform zeroization, degaussing, or even physical destruction of the device. These processes, when performed on standard hard drives, are either time consuming, unable to be verified as 100 percent effective, difficult, dangerous, or expensive.