Methods, systems, and apparatuses for managing a hard drive security system

• US 10,181,042 B2
• Filed: 10/29/2015
• Issued: 01/15/2019
• Est. Priority Date: 03/01/2011
• Status: Active Grant

• Current Assignee: Softex LLC (FIG LLC (d/b/a Fortress Investment Group LLC))
• Original Assignee: Softex Incorporated
• Inventors: Bhansali, Apurva M., Patel, Mehul R., Dhanani, Kamal M., Chauhan, Rajnish S., Cheung, David
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US14/926,939
• Publication Number:
  US 20160063256A1
• Time in Patent Office: 1,174 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 9/4406 Loading of operating system

Abstract

A system for use with a computer is provided, the computer including a self-encrypting drive (SED), the SED including a nominal space and a pre-boot region, wherein the nominal space can be locked to prevent access to the nominal space. The system includes SED management software configured to be loaded in the pre-boot region of the SED. The SED management software includes a pre-boot operating system (OS) and an unlocking program. The unlocking program is configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of a user, to unlock the nominal space of the SED. Other embodiments are described and claimed.

Claims

1. A system for use with an electronic device, the electronic device including a self-encrypting drive (SED), the SED including a nominal space and a pre-boot region, wherein the nominal space can be locked to prevent access to the nominal space, the system comprising:

SED management software configured to be loaded in the pre-boot region of the SED, the SED management software comprising;

a pre-boot operating system (OS); and

at least one pre-boot functionality capable of operating when the nominal space is locked,

wherein the SED management software further comprises an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of the user, to unlock the nominal space, and

wherein the SED management software is configured to temporarily grant write access to the pre-boot region, store the unlocking program in the pre-boot region, and revert the pre-boot region to read-only.

2. The system of claim 1, wherein the at least one pre-boot functionality comprises a pre-boot erase utility, operable to permit an administrator to erase a password or encryption key from the pre-boot region.

3. The system of claim 1, wherein the at least one pre-boot functionality comprises a pre-boot back-up utility, operable to back up the nominal space of the electronic device.

4. The system of claim 1, wherein the at least one pre-boot functionality comprises a pre-boot work utility, operable to permit a user to transfer files between the nominal space and the pre-boot region, wherein files transferred from the nominal space to the pre-boot region are accessible to the user when the nominal space is locked.

5. The system of claim 4, wherein the files are presentations, word processing documents and/or spreadsheets.

6. The system of claim 1, wherein the pre-boot functionality comprises a pre-boot graphical user interface (GUI) operable to permit interaction with a user during a pre-boot authentication process of the electronic device while the nominal space is locked.

7. The system of claim 6, wherein the pre-boot functionality comprises a pre-boot keyboard functionality operable to provide a virtual keyboard on the pre-boot GUI.

8. The system of claim 1, wherein the pre-boot functionality comprises a pre-boot browsing functionality, the pre-boot browsing functionality permitting a user to browse the Internet using a browser accessible from the pre-boot region.

9. The system of claim 1, wherein the pre-boot region further comprises at least one pre-boot entertainment library and the pre-boot functionality comprises a pre-boot entertainment functionality, the pre-boot entertainment functionality permitting a user to use entertainment programs and files.

10. The system of claim 1, wherein the at least one pre-boot functionality comprises a pre-boot communication utility, operable to permit a user to communicate with another via a communication network.

11. The system of claim 10, wherein the pre-boot communication functionality comprises e-mail or instant messaging.

12. The system of claim 11, wherein a PST file is copied from the nominal space to the pre-boot region.

13. The system of claim 10, wherein the pre-boot communication functionality comprises voice communications.

14. The system of claim 10, wherein the pre-boot communication functionality comprises video communications.

15. The system of claim 1, wherein the pre-boot OS may be programmed to power on only such hardware as is required by one or more particular pre-boot functionalities being used by a user.

16. The system of claim 1, wherein the at least one pre-boot functionality is capable of operating prior to successful authentication by a user.

17. The system of claim 1, further comprising:

the electronic device including the SED, the SED including the nominal space and the pre-boot region, wherein the nominal space can be locked to prevent access to the nominal space, and wherein the SED management software is loaded in the pre-boot region.

18. The system of claim 17, further comprising a server operable to communicate with the electronic device, wherein the electronic device serves as a client.

19. The system of claim 17, wherein the nominal space is configured to store applications, files and data.

20. The system of claim 17, wherein the nominal space comprises a nominal OS, the nominal OS comprising a Windows®

OS, an Android™

OS, or another OS.

21. The system of claim 17, wherein the SED comprises a processor configured to encrypt and decrypt the nominal space.

22. The system of claim 17, wherein the SED comprises a password key for encryption/decryption.

23. The system of claim 17, wherein the nominal space and the pre-boot region are non-overlapping portions of the SED.

24. The system of claim 17,

wherein the SED management software further comprises an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of the user, to unlock the nominal space, and

wherein the unlocking program is stored in the pre-boot region.

25. The system of claim 17,

wherein the SED management software further comprises an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of the user, to unlock the nominal space, and

wherein the pre-boot region comprises one or more sectors, and the unlocking program is stored in a first sector of the pre-boot region.

26. The system of claim 17,

wherein the SED management software further comprises an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of the user, to unlock the nominal space, and

wherein the unlocking program is stored in an area that is rendered read-only after the unlocking program is written to the area.

27. The system of claim 17, wherein, after activation of encryption on the SED, the pre-boot region is read-only.

28. The system of claim 17, wherein the pre-boot region is hidden from users when the nominal space is unlocked.

29. The system of claim 17, wherein the nominal space is hidden from users when the pre-boot region is unlocked.

30. The system of claim 17, wherein the pre-boot region is hidden from users after the successful authentication of the user.

31. The system of claim 17, wherein the nominal space is hidden from users prior to the successful authentication of the user.

32. The system of claim 17, wherein, if the electronic device is powered on with encryption on, the nominal space is encrypted and locked.

33. The system of claim 17, wherein, if the electronic device is powered on with encryption on, the pre-boot region is accessible to a user.

34. The system of claim 17, wherein, if the electronic device is powered on with encryption on and a first sector of the nominal space is requested, a first sector of the pre-boot region is returned.

35. The system of claim 1,

wherein the SED management software further comprises an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of the user, to unlock the nominal space, and

wherein the nominal space includes a nominal OS, and wherein, if the electronic device is powered on with encryption on, control is transferred to the unlocking program prior to control being transferred to the nominal OS.

36. The system of claim 1,

wherein the SED management software further comprises an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of the user, to unlock the nominal space,

wherein the electronic device further comprises a memory,

wherein the nominal space includes a nominal OS and a plurality of sectors including sector 0,

wherein sector 0 of the nominal space contains the nominal OS and,

wherein, upon the successful authentication of the user, the unlocking program reads, puts into the memory, and transfers control to sector 0 of the nominal space.

37. The system of claim 1,

wherein the SED management software further comprises an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of the user, to unlock the nominal space, and

wherein the unlocking program is configured to send a credential to unlock the SED, upon entry of an item of authentication by the user.

38. The system of claim 1, wherein the nominal space includes a nominal OS, and the SED management software is configured to cause the nominal OS to boot the electronic device upon the successful authentication of the user.

39. The system of claim 1, wherein the SED management software further comprises:

an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of the user, to unlock the nominal space.

40. The system of claim 1, wherein the nominal space contains a nominal OS, and wherein the SED management software further comprises:

an unlocking program configured (a) to execute within the pre-boot OS, and (b) upon successful authentication of a user, to transfer control to the nominal OS.

41. The system of claim 9, wherein the entertainment files include videos, music, and/or games.

42. The system of claim 9, wherein the pre-boot entertainment functionality comprises a media player, operable to permit a user to play media.

43. The system of claim 17, wherein the pre-boot OS comprises a Linux®

-based OS, an Android™

OS, or another OS.

44. The system of claim 20, wherein the pre-boot OS comprises a Linux®

-based OS, an Android™

OS, or another OS.

45. The system of claim 20, wherein the SED management software is configured to switch from a first state in which the nominal space is accessible and the nominal OS is running to a second state in which the nominal space is hidden, the nominal OS is not running, the pre-boot region is accessible, and the pre-boot OS is running.

46. The system of claim 45, wherein the switch from the first state to the second state is effected by a user action.

47. The system of claim 46, wherein the user action comprises pressing a button on a keyboard.

48. The system of claim 46, wherein the user action comprises inputting a command.

49. The system of claim 46, wherein the user action comprises:

(1) (a) powering off the electronic device, or (b) causing the electronic device to enter Hibernate mode; and

(2) subsequently booting the electronic device into the pre-boot region to run the pre-boot OS.

50. The system of claim 45, wherein the switch from the first state to the second state is effected by an action initiated via the keyboard.