Real Time Hard Disk Crypto Gateway

	DES has been introduced since 1971 and has been publicly proven as a solid and quality algorithm.
	3DES (Triple DES) was then introduced to compensate the original 64-bit DES bit length weakness
	due to the advance of microprocessor and integrated circuit manufacturing. In time past, there are
	many research and development efforts based on DES, resulting in plenty of software and hardware
	solutions. However, almost all solutions focus more on file-level other than drive-level (data storage)
	encryption, even with the hardware or ASIC DES/3DES design, as the drive-level encryption
	demands huge bandwidth from the cipher engine in that I/O and interfacing control becomes the
	critical bottleneck.

	It is commonly known that software encryption occupies processing power and takes system
	resources therefore overall system performance reduction is greatly noticeable. Extra CPU and
	memory shall help but will directly impact total project cost and complicate system configurations.
	Cross platform configurations may become an infeasible task to complete. Furthermore, software
	solutions generally prompt GUI (Graphical User's Interface) which frequently intimidates and
	confuses users with their daily computing life. Beside, all software solutions are prone to
	brute-force attacks. With all above mentioned in mind, it's becoming increasingly clear that
	software solution, though offers some degree of flexibility in different aspects, is NOT suitable for
	high bandwidth data storage encryption.

	Off-line Hardware or ASIC solution, on the other hand, can offer some degree of convenient
	bandwidth but normally come in short of compatibility and problem of installation. Frequently device
	driver or software patches are required to make a smooth operation possible. GUI again, is
	witnessed to having induced unnecessary complexity. Off-line encryption cannot process large
	bandwidth data in real-time; also, it involves with memory operation that may cause eavesdropping
	in memory level or in analyzing its power consumption, resulting in reduction of privacy and
	confidentiality of data been protected.

	A real-time physical layer ASIC hard disk crypto-system seems to be able to resolve all concerns
	and disadvantages as those mentioned in software and off-line hardware or ASIC solutions. While
	offering essential feature such as no performance degradation, a physical layer ASIC does not
	require device driver; is independent from all operation systems; does not feature intimidating
	Graphical User's Interface; and does not intimidate users with complex log on process.

	Using DES/3-DES design along with proper hard disk I/O processing architecture, the family of
	real-time physical layer encryption and decryption product can be obtained through a single ASIC
	design. X-Wall DX-64, a cryptographic system controller ASIC utilized a standard IDE/ATA bus to
	protect sensitive information stored on an IDE hard drive, can be the next generation standard of
	real-time high bandwidth data storage encryption/decryption device. To minimized the changes in
	existing system configuration, X-Wall DX-64 will be designed to fit between system Host IDE
	interface and IDE hard drive as the IDE Gateway. To accommodate various system configurations,
	the X-Wall DX-64 will be designed to be device driver free and is completely independent from
	various Operating Systems. A simple and strait-forward command line interface will be served to
	authenticate user and/or to perform the required housekeeping tasks.

	Fundamentals
	The X-Wall DX-64 is an embedded single chip ASIC (Application Specific Integrated Circuit)
	engineered specifically to encrypt/decrypt the entire hard disk content including Boot Sector,
	Operating System and Tables of Content in real-time performance using NIST (National Institute of
	Standards and Technology) certified DES (Data Encryption Standard) algorithm. Other public domain
	algorithm like AES (Advanced Encryption Standard) can be utilized to replace DES/3DES.

	X-Wall DX-64 sits between PCI south bridge and the device on the IDE interface as the real-time
	IDE crypto gateway. It intercepts, interprets, translates, and relays those commands & data to and
	from the disk drives, encrypting the data with DES 64-bit key strength. X-Wall DX-64 can be
	operated with Ultra ATA (Ultra DMA) 33/66 compliant disk drives in real-time mode with a bandwidth
	of 66Mbytes per second.

	Objectives
	The envisioned device will function between the IDE host controller and the IDE hard drive. It
	incorporates both a target and a host interface for IDE Ultra DMA 33/66/100, and effectively
	captures and decodes commands from the host, encrypts data and then regenerates the commands
	and data to the target interface. The device includes a real-time encryption pipeline engine that
	can be inserted into the data stream to encrypt or decrypt the data to or from the hard disk drive.
	Our objectives in implementing X-Wall are listed hereunder:

	1. To provide 3DES (or Single DES) real-time encryption & decryption ASIC
	2. To be completely independent from all Operating Systems
	3. To be free from device driver
	4. To be completely transparent from all system configurations
	5. To provide performance identical to that of a non-encrypted system
	6. To offer a real low power consumption but with high speed ASIC device
	7. To protect X-Wall from unauthorized operation

	A user's PIN (Personal Identification Number) from 8 to 16 characters long is used to authenticate
	a user prior to reaching BIOS (Basic Input/Output System) bootstrap.

	8. To prevent unauthorized disclosures of user's PIN and plain text cipher Key.

	When system BIOS starts up, it shall prompt for user's PIN before bootstrap. After successful PIN
	matched, X-Wall enters into normal operational mode. To modify the user PIN, the user must
	present included original removable media (floppy disk or USB device), which contains PIN associated
	Unlock_Key. The user can only modify the PIN if and only if original Unlock_Key and PIN are both
	presented. Furthermore, the Keys, which store on the built-in Flash, can not be extracted even
	with the use of sophisticated semiconductor extraction and analysis techniques.

	9. To provide indications of operational states

	Since X-Wall is activated when data is transferred to or from the IDE hard drive, it contains
	registers to log the activated ATA Commands and the number of total sectors. A status register will
	log the error conditions. The error bits will be OR'ed with the error bit read from the drive before
	been presented to the Host. These registers are readable by software and can be used as the
	status of operational state and diagnostics purposes.

	10. To detect errors from the operations, and to prevent sensitive data and secret key from being
	compromised due to errors.

	The error detection logic is built within the device. Any non-working condition, CRC mismatch, byte
	count mismatch, or illegal read/write, Streaming_FIFO will result in error bit been set and error code
	logged. The error can also optionally generate interrupt to the Host PCI bus. The hardware decoding
	logic should intercept I/O write to 3F6 to determine if system interrupt has been activated.

	11. A mechanism to recover lost user PIN.

	The user's PIN is encrypted using device secret key prior to be stored in the on-chip FLASH memory.
	When user forgot his/her PIN, a PIN recovery program (Unlock_Key) is used to resume all functions
	of X-Wall from its lock state (after ten failed attempts of user's PIN). Only after successful
	re-activation of the X-Wall, can the user's PIN be re-generated.

*** SEARCH COOLDRIVES SITE: