IBM recently announced an effort to enmesh data security in the chips found in cell phones, PDAs, and other portable devices. More than half of all unprotected data can be found on these gadgets, says the company, and encryption that relies on software is not as secure as encryption built into hardware.

Some experts believe that IBM’s new technology could be useful in certain instances, such as when a PDA containing sensitive, proprietary information goes missing. But the technology also raises the hackles of those who fear it might one day be used by companies – in the entertainment industry, in particular – to further restrict people’s uses of copyrighted material. Content providers, the argument goes, could use such a chip to lock movies, music, or television shows to a gadget or computer, keeping them from being distributed.

This new IBM technology, called SecureBlue, is meant to address some of the limitations of software security, especially in portable electronics, says Guerney Hunt, senior manager for distributed infrastructures, IBM Research. “This kind of encryption technique was developed because it’s increasingly possible for these devices to fall into the wrong hands,” he says. “Software cryptography has to be turned on and turned off, and it can be defeated by software attacks.” But if the security and tamper protection is incorporated into the chip, he says, sensitive information cannot be removed without destroying the chip.

SecureBlue is a set of chip circuitry that uses a common type of encryption called Advanced Encryption Standard. When data enters a chip with SecureBlue technology, it encounters an extra processing step that encrypts the data as it travels throughout the chip and onto other device components such as the hard drive. Hardware encryption does not replace security software, but rather helps to protect data that might otherwise slip past the radar of security software.

For instance, when programs run, they copy small amounts of information to a hard drive, where it may be unintentionally stored, explains Burt Kaliski, vice president of research at RSA Security, a Bedford, MA-based digital security company. As this happens, encryption software might not account for all the data that is stored on the hard drive of a device. This is “one of the vulnerabilities of a computer system,” says Kaliski. But if the data is encrypted from the start, he says, that vulnerability is addressed and all of the data is securely in the hardware of the device. Kaliski adds that going after unencrypted remnants of data stored on hard drives is a “very sophisticated attack” that would be difficult to carry out.

But some industry observers aren’t so impressed. David Wagner, professor of computer science at the University of California, Berkeley, says that encrypting the chip doesn’t address the majority of cybercrime. “Encryption isn’t the main problem we face today in the security field,” he says; instead, most threats come from viruses, worms, and online identity theft. “There are certainly some applications that can benefit from hardware acceleration of cryptography,” says Wagner, but most computer users “don’t need this fancy stuff. Existing technology is adequate for many purposes.”

One of the major possible uses for chip-level encryption, according to Wagner, is for keeping music and videos from being distributed in ways that violate copyright laws. That possibility is the “elephant in the room,” he says. Currently, digital rights management (DRM) is programmed into products such as CDs or DVDs, and software such as iTunes and Windows Media Player. The DRM policies of iTunes, for example, limit the number of times a CD can be copied.

Depending on the type of DRM tools used, they’re “pretty easy to bypass,” Wagner says. “All you have to do is tamper with the software” to remove the feature that counts the number of times a CD has been burned, he explains. But when DRM software is coupled with encrypted hardware, the software containing DRM is much more resistant to tampering.

At the hardware level, Wagner says, there’s already an encryption technology called a Trusted Platform Module (TPM), which is an extra chip inside a computer that can help enforce DRM policies when used with compatible software. Such an chip could protect the DRM software of iTunes or Windows Media Player from being tampered with. While the TPM chip doesn’t directly impose DRM, it makes it much more difficult to bypass the DRM on software. Microsoft’s upcoming operating system, Vista, is designed to support computers that have TPM.

SecureBlue might offer stronger DRM protection than TPM, though, because IBM’s encryption is integrated into the processor itself, instead of residing on a separate chip. This “enables computer manufacturers to build DRM protection that is hard to subvert,” Wagner says.

“I can certainly imagine this being marketed as a DRM solution,” says Bruce Schneier, founder and CTO of Counterpane Internet Security, a Mountain View, CA company. Building security onto a single chip would eliminate the “tamper attack” on the connection between a separate security chip and processor, he says.

Of course, stronger DRM for computer hardware has different implications – depending on which side of the digital-rights debate one sits on. For Hollywood, Wagner says, the technology would be beneficial because it would prevent consumers from copying music and illegally distributing it. However, more DRM security built into a computer could also restrict how people use music and video, he says, even when it’s legitimate, from copying CDs to transferring a movie from a computer to a portable video player.

IBM has not announced whether its SecureBlue customers (undisclosed at this time) intend to use the chips as a DRM tool, and the company also declined to comment on the issue of DRM.

But Berkeley’s Wagner says the company’s technology is reminiscent of the type of technology that “one might consider if one wanted to build DRM protection that is harder to break.” If SecureBlue is able to give Hollywood “more control over people’s computers,” he says, the technology is “likely to be pretty controversial.”