HARDWARE ACCESS AND MONITORING CONTROL

• US 20090300717A1
• Filed: 06/03/2008
• Published: 12/03/2009
• Est. Priority Date: 06/03/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Mandava, Srikanth
• Granted Patent: US 8,341,729 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Various embodiments described and illustrated here include one or more of systems, methods, software, and data structures that may be used to implement policies for hardware access and monitoring control. One embodiment includes obtaining device property data from each device coupled to a system and determining if each device is a device authorized for use with the system. Such embodiments may further include allowing only devices authorized for use with the system to be accessed by processes of the system.

Claims

1. A computerized method comprising:

obtaining device property data from each device coupled to a system;

determining if each device is a device authorized for use with the system;

allowing only devices authorized for use with the system to be accessed by processes of the system.

2. The computerized method of claim 1, further comprising:

retrieving data identifying one or more devices authorized for use with the system for use in the determining.

3. The computerized method of claim 1, further comprising:

receiving a notification from a process operable on the system that a new device has been coupled to the system;

obtaining device property data from the new device;

determining if the new device is a device authorized for use with the system; and

allowing processes of the system to access the new device only if the new device is determined to be authorized for use.

4. The computerized method of claim 1, wherein allowing only devices authorized for use with the system to be accessed by processes of the system includes allowing the processes of the system limited access to a particular device.

5. The computerized method of claim 4, wherein the limited access includes allowing less than all of reading, writing, deleting, and updating data with regard to a particular device.

6. The computerized method of claim 1, further comprising:

receiving a notification from a process of the system that a particular device has been removed from communication with the system; and

sending a notice that the particular device is no longer in communication with the system.

7. The computerized method of claim 6, wherein the notice is sent to a remote system and includes data identifying the system and the particular authorized device.

8. A computer-readable medium, with instructions thereon that are executable by a computer to:

maintain a list of devices coupled to a computer;

determine if each device in the list is communicatively coupled to the computer; and

upon determining a device in the list is not physically coupled to the computer, send a notice that the device is not communicatively coupled to the computer.

9. The computer-readable medium of claim 8, wherein the notice is sent to a premises security system that controls ingress and egress from a premises, the notice including data identifying one or more users of the computer.

10. The computer-readable medium of claim 8, with further executable instructions to:

receive a request to determine if all devices included in the list of devices are communicatively coupled to the computer; and

send a response indicating if any devices in the list of devices are not communicatively coupled to the computer.

11. A system comprising:

a bus;

a network interface coupled to the bus;

a peripheral device coupled to the bus;

a processor coupled to the bus and including an out-of-band controller, wherein the out-of-band controller is operable when the system is turned off to;

receive a request from a requestor over the network interface to determine if the peripheral device is coupled to the bus;

request and receive, over the bus, property data from the peripheral device;

compare the property data to known property data of the peripheral device to confirm the peripheral device has expected properties; and

send data to the requester, the data identifying if the peripheral device has the expected properties.

12. The system of claim 11, wherein the known property data of the peripheral device is stored in a non-volatile memory coupled to the bus and accessible by the out-of-band controller.

13. The system of claim 11, wherein the known property data of the peripheral device includes a serial number of the data storage device.

14. The system of claim 11, wherein the out-of-band controller includes a microprocessor and a non-volatile memory.

15. The system of claim 11, wherein the peripheral device is a Peripheral Component Interface (“

PCI”

) device.

16. The system of claim 15, wherein the PCI device is a data storage device.

17. A system comprising:

a bus;

a memory coupled to the bus;

a processor coupled to the bus;

a device driver held in the memory and operable on the device to;

retrieve property data from a peripheral device upon connection to the bus;

determine if the peripheral device is authorized for use with the system; and

initialize the peripheral device if the peripheral device is authorized.

18. The system of claim 17, wherein the determination if the peripheral device is authorized includes determining if a serial number of the peripheral device included in the retrieved property data is included in a list of authorized peripheral devices stored in the memory.

19. The system of claim 18, wherein the list of authorized peripheral devices identifies authorized functions that may be performed with regard to the peripheral device.

20. The system of claim 19, wherein the authorized functions include less than all of reading, writing, deleting, and updating data with regard to the peripheral device, and wherein the device driver allows only authorized functions to be performed with regard to the peripheral device.

21. The system of claim 17, wherein the peripheral device is a hard disk.