An encryption system permits end-to-end encryption of information over an
untrusted interconnection network. The information encryption system
includes at least one client for processing information. The system also
includes at least one storage device for holding the information. At least
one key server provides a data key for encrypting and decrypting the
information. An encryption module is associated with each client. Each
encryption module has a first processor accessing a first memory and a
second processor accessing a second memory different from the first
memory. The first processor communicates with the associated client. The
second processor communicates with the storage device. The first processor
communicates with the second processor through a dedicated channel. The
second processor obtains the data key from the key server. Information is
received from the first processor over the dedicated channel and encrypted
using the data key. The encrypted information is then stored on the
storage device. The second processor also reads the encrypted information
from the storage device, decrypts the information using the data key, and
sends the decrypted information to the first processor over the dedicated
channel.
