Data Encryption Key Protection - Protecting Key Files and their internal Encryption keys against direct access to the Data Encryption Key
While SecureDoc performs an invaluable service ensuring that data is protected by encryption and that user access to SecureDoc-protected devices is locked down and governed by permitting only specific users to authenticate at Pre-Boot, there are other risks that any security-conscious organization should be aware of and include in its overall security design.
Protecting Key Files and their internal Encryption keys against direct access to the Data Encryption Key
Where SecureDoc creates Encryption Key Files (secure, encrypted files that contain one or more Data Encryption Keys), each Key File stores one or more Encryption keys in encrypted format within itself. This protection takes the form of several layers of encryption.
Working from the inside (the Encryption key that is used to encrypt something such as a hard disk), that Encryption Key itself is encrypted with a different random encryption key known only to the SecureDoc client solution, which is then then encrypted again using another key random key, and the result of that encryption is encrypted with yet another encryption key that can be decrypted using the personal credentials (password, token certificate, smart card, fingerprint cipher) the user has presented.
All aspects of SecureDoc that can access and manipulate Encryption Keys do so in a FIPS-approved secure manner, ensuring that the actual encryption key is either stored in a protected Key File, or is stored in an encrypted field within the SES database. In either case, the key itself can only be accessed by a SecureDoc application element, and no other applications have all the elements necessary to "reach in" to a Key File or interpret the encrypted contents of the database except through the use of SecureDoc.
Where Encryption Keys are transmitted, SecureDoc will always protect the key inside a Key File, which can then be transmitted securely (protected internally by the encryption described above) inside a data stream (that is itself encrypted) to endpoint devices across a network connection; each end of this communication "trusts" the other thanks to a Certificate each end holds. This certificate is used to encrypt the transmitted data so communicated using RSA 2048-bit encryption.