Device controller and method of enforcing time-based sector level security

• US 10,095,431 B2
• Filed: 05/10/2016
• Issued: 10/09/2018
• Est. Priority Date: 06/18/2015
• Status: Active Grant

• Current Assignee: Cigent Technology, Inc.
• Original Assignee: John Edward Benkert, Tony Edward Fessel
• Inventors: Benkert, John Edward, Fessel, Tony Edward
• Primary Examiner(s): GIDDINS, NELSON S
• Application Number:
  US15/150,860
• Publication Number:
  US 20160371488A1
• Time in Patent Office: 882 Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0653 Monitoring storage devices or systems
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

A device controller interfaced between an electronic processing device and a sector-based data storage device, includes a processor connected to a clock, and a computer memory having a control list stored therein. A control list including a security feature entry including a target sector range, time data associated with the target sector range, and at least one security response associated with the target sector range. The processor determines, based at least in part on interrogation of the control list and a clock time, the time data of the entry conflicts with the clock time, and executes the at least one security response. Time data can represent an expiration date or a time window, with a conflict arising if the clock time is beyond the expiration date or within the time window, respectively.

Claims

1. A device controller interfaced between an electronic processing device and a sector-based data storage device having a plurality of sectors, said controller comprising:

at least one processor communicatively connected to a clock and at least one computer memory having stored therein a control list including a security feature entry respectively including a target sector range, time data associated with the target sector range and representing a time window, and at least one security response associated with the target sector range, the target sector range being a subset of the plurality of sectors; and

an event monitor, communicatively connected to said at least one processor and another clock, and including another processor and a data store containing at least one security alarm event associated with the target sector range;

wherein said event monitor issues an alarm interrupt to said at least one processor when the other processor determines the security alarm event occurs based on at least one of another clock time generated by the other clock and environmental data provided by an environmental sensor communicatively connected to said event monitor, and upon receipt of the alarm interrupt, said at least one processor executes the at least one security response of the security feature associated with the target sector range after confirming a data keep alive check flag is true and when said at least one processor determines based, at least in part, on interrogation of the control list and a clock time generated by the clock, the time data of the security feature entry conflicts with the clock time when the clock time is beyond the time window.

2. The device controller of claim 1, wherein said event monitor is powered by a battery and said at least one processor is powered by the electronic processing device.

3. The device controller of claim 1, wherein the at least one security response of the particular entry includes at least one of a write access denial, a read access denial, an encryption of existing data within the target sector range, a deletion of the existing data within the target sector range, a wiping of the existing data within the target sector range, a relocation of the existing data within the target sector range to at least one of the data storage device and the at least one computer memory, and a storage in the at least one of the data storage device and the at least one computer memory of a log entry.

4. The device controller of claim 1, wherein said at least one processor requests the clock time from the clock in response to receipt, from said electronic processing device, of a processing request involving the storage device.

5. The device controller of claim 1, wherein said at least one processor determines, after a wait state, the time data conflicts with the clock time.

6. The device controller of claim 1, wherein said at least one processor determines the time data conflicts with the clock time in response to receipt, from said electronic processing device, of a processing request involving the storage device.

7. The device controller of claim 1, wherein the target sector range is a determinable sector range.

8. A method of enforcing sector-based security by a device controller interfaced between an electronic processing device and a sector-based data storage device having a plurality of sectors, with the device controller having at least one processor communicatively connected to a clock and at least one computer memory having stored therein a control list including a security feature entry respectively including a target sector range, time data associated with the target sector range and representing a time window, and at least one security response associated with the target sector range, the target sector range being a subset of the plurality of sectors, and an event monitor, communicatively connected to the at least one processor and another clock, and including another processor and a data store containing at least one security alarm event associated with the target sector range, said method, comprising:

receiving, by the at least one processor, an alarm interrupt from the event monitor after the other processor determines the security alarm event occurs based on at least one of another clock time generated by the other clock and environmental data provided by an environmental sensor communicatively connected to the event monitor; and

upon receipt of the alarm interrupt, executing by the at least one processor the at least one security response of the security feature associated with the target sector range when the at least one processor determines based, at least in part, on interrogation of the control list and a clock time generated by the clock, the time data of the security feature entry conflicts with the clock time when the clock time is beyond the time window and a data keep alive check flag is true.

9. The method of claim 8, wherein the event monitor is powered by a battery and the at least one processor is powered by the electronic processing device.

10. The method of claim 8, wherein the at least one security response of the particular entry includes at least one of a write access denial, a read access denial, an encryption of existing data within the target sector range, a deletion of the existing data within the target sector range, a wiping of the existing data within the target sector range, a relocation of the existing data within the target sector range to at least one of the data storage device and the at least one computer memory, and a storage in the at least one of the data storage device and the at least one computer memory of a log entry.

11. The method of claim 8, wherein in the step of executing the at least one processor requests the clock time from the clock in response to receipt, from the electronic processing device, of a processing request involving the storage device.

12. The method of claim 8, wherein in said step of executing, the at least one processor determines the time data conflicts with the clock time after a wait state.

13. The method of claim 8, wherein in said step of executing, the at least one processor requests the clock time from the clock in response to receipt, from the electronic processing device, of a processing request involving the storage device.

14. The method of claim 8, wherein the target sector range is a determinable sector range.