Security Architecture for Device Encryption and VPN Ammar Alkassar^ • Michael Scheibel^ • Christian Stiible^ Ahmad-Reza Sadeghi^ • Marcel Winandy^ ^Sinix AG Security Technologies {a.alkassar | m.scheibel}@sirrix.com ^Ruhr-University Bochum stueble@acm.org ihr-University Bocl {sadeghi | winandy}® crypto.rub.de ^ Ruhr-University Bochum Abstract Encryption systems are widely used to protect stored and communicated data from unauthorized ac- cess. Unfortunately, most software-based encryption products suffer from various vulnerabilities such as insecure storage and usage capabilities for security-critical cryptographic keys and operations. In this paper we present a security architecture that allows secure, reliable and user-friendly encryption of devices and of TCP/IP conmiunication. The architecture is capable of using Trusted Computing func- tionalities and offers a security level which is comparable to a hardware based solution, but is far more cost-effective. We have already implemented a device encryption system and a VPN client. Moreover, the security architecture is an appropriate basis for many applications such as Enterprise Rights Man- agement (ERM) and secure Online Banking. 1 Introduction Encryption systems are widely used to protect stored and communicated data from unauthor- ized access. Application areas include device (e.g. hard disk) encryption as well as Virtual Private Networks (VPN). Unfortunately, most software-based encryption products suffer from various vulnerabilities such as insecure storage and usage capabilities for security-critical cryptographic keys and operations. The underlying operating systems (OS) cannot prevent other (potentially mali- cious) applications from gaining access to the critical key data. The reasons lie in conceptual weaknesses of common computing platforms, in particular in insecure OS architectures. This is evident by the huge number of exploits and constant security updates. S. Paulus, N. Pohlmann, H. Reimer (Editors): Securing Electronic Business Processes, Vieweg (2006), 54-63