Encryption Sentinel System and Method

• US 20090172786A1
• Filed: 12/23/2008
• Published: 07/02/2009
• Est. Priority Date: 12/28/2007
• Status: Active Grant

• Current Assignee: Asperatus, LLC
• Original Assignee: Bruce Backa
• Inventors: Backa, Bruce
• Granted Patent: US 8,347,359 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

An encryption sentinel system and method protects sensitive data stored on a storage device and includes sentinel software that runs on a client machine, sentinel software that runs on a server machine, and a data storage device. When a client machine requests sensitive data from the data storage device, the data storage device interrogates the sentinel software on the server machine to determine if this client machine has previously been deemed to have proper encryption procedures and authentication. If the sentinel server software has this information stored, it provides an approval or denial to the storage device that releases the data if appropriate. If the sentinel server software does not have this information at hand or the previous information is too old, the sentinel server interrogates the sentinel software that resides on the client machine which scans the client machine and provides an encryption update to the sentinel server software, following which data will be released if appropriate.

Claims

1. A system for controlling access to sensitive data, said system comprising:

a data storage device, configured for storing data and including a data storage controller, responsive to a request to access data from a client access device, for providing an indication of said request to access data from a client access device and for providing said data only upon receiving an indication from a data access control server that said client access device is authorized to access said data;

a data access control server, coupled to said data storage device and to a client access device and including an encryption sentinel server, said encryption sentinel server responsive to said request from said data storage device for access to stored data by a client access device, and responsive to a determination of whether said client access device is secure, for controlling access to said data on said data storage device by said client access device; and

a client access device, coupled to said data storage device and to said data access control server and including a client data access controller, configured for initiating a request to access said data on said data storage device and responsive to said encryption sentinel server, for providing an indication of the secure status of a storage device on said client access device.

2. The system of claim 1, wherein said data stored on said data storage device is deemed to be sensitive data by a system administrator.

3. The system of claim 1, wherein said data stored on said data storage device is encrypted.

4. The system of claim 1, wherein said data access control server is configured for checking the secure status of said client access device.

5. The system of claim 1, wherein said encryption sentinel server stores the secure status of said client access device on said data access control server.

6. The system of claim 5, wherein said secure status of said client access device includes a timestamp of said status.

7. A method for controlling access to sensitive data using the system of claim 1, comprising the acts of:

receiving, by said data storage device, a request from said client access device for access to sensitive data stored on said data storage device;

in response to said received request, said data storage device issuing a request to said data access control server to inquire whether said client access device is authorized to receive the requested sensitive data;

in response to said issued request by said data storage device, said data access control server determining whether said client access device is secure, and providing an indication of said secure status of said client access device to said data storage device in response to said issued request; and

responsive to said provided indication of the secure status of said client access device provided by said data access control server, said data storage device providing said requested sensitive data to said client access device if said indication of the secure status of said client access device is positive or otherwise providing a sensitive data access denial response to said client access device.

8. The method of claim 7, wherein said act of determining whether said client access device is secure by said data access control server includes the act of searching said data access control server for an indication of whether said client access device is secure or not secure, and for providing said indication based on said search.

9. The method of claim 7, wherein said act of determining whether said client access device is secure by said data access control server includes the act of querying said client access device for an indication from said client access device of whether or not it is secure, and receiving from said client access device an indication of whether or not it is secure.

10. Method of claim 9, further including after the act of receiving from said client access device an indication of whether or not it is secure the further act of storing said indication on said data access control server.

11. The method of claim 10, wherein said stored indication of the secure status of said client access device includes a timestamp indicating when said secure status was received.

12. The method of claim 11, wherein said act of determining whether said client access device is secure by said data access control server includes the act of searching said data access control server for an indication of whether said client access device is secure or not secure, and if there is an indication stored on said data access control server that said client access device is secure, further including the act of reviewing said timestamp indicating when said secure status was received and if said timestamp is less than or equal to a predetermined amount of time from the current time, providing an indication that said client access device is secure, and if said timestamp is greater than a predetermined amount of time from the current time, providing an indication that said client access device is not secure.