IronKey Workspace W700-SC, Руководство пользователя

Страница: 7 / 45

Device specifications
7
ABOUT MY IRONKEY WORKSPACE W700-SC DEVICE
IronKey Workspace W700-SC User Guide
The IronKey Workspace W700-SC adds an extra security factor when authenticating, a smart card. Instead of
a device password like other IronKey Workspace devices, you can use your smart card to unlock the device.
The encryption key from the smart card is paired with the device and bound to the device authentication
method.
The IronKey Cryptochip is hardened against physical attacks such as power attacks and bus sniffing. It is
physically impossible to tamper with its protected data or reset the password counter. If the Cryptochip
detects a physical attack, it destroys the Cryptochip, making the stored encrypted files inaccessible.
We strive to be very open about the security architecture and technology that we use in designing and
building this product. We use established cryptographic algorithms, we develop threat models, and we
perform security analyses (internal and third party) of our systems all the way through design, development
and deployment.
Note: The W700-SC “device password” referred to in this section is the smart card encryption certificate that
is protected by the smart card PIN.
Data Encryption Keys
• AES key generated by onboard Random Number Generator
• AES key is generated at initialization time and encrypted with a hash of the device password
• No back-doors: AES key cannot be decrypted without the device password
• AES key never leaves the hardware and is not stored in NAND flash
Data Protection
• Windows To Go partition is not accessible until the device password is verified in hardware
• Device password retry-counter implemented in tamper-resistant hardware
• If you exceed the smart card PIN retry-count, the smart card will lock and an administrator will have
to unlock the card.
• Sensitive data and settings are stored in hardware
Device Password Protection
• USB command channel encryption to protect device communications
• Password-in-memory protection to protect against cold-boot and other attacks
The device password is hashed using salted SHA-256 before being transmitted to the device firmware over a
secure USB channel. It is stored in an extremely inaccessible location in the protected Cryptochip hardware.
The hashed password is validated in hardware (there is no “getPassword” function that can retrieve the hashed
password), and only after the password is validated is the AES encryption key decrypted. The password try-
counter is also implemented in hardware to prevent memory rewind attacks.
DEVICE SPECIFICATIONS
The following table provides details about your W700-SC device.
Table 1: Device specifications
Specification Details
Capacity* 32GB, 64GB, 128GB
Dimensions 82mm X 21.1mm X 9.1mm