Secure access to encrypted information

• US 20090327720A1
• Filed: 06/30/2008
• Published: 12/31/2009
• Est. Priority Date: 06/30/2008
• Status: Active Grant

• Current Assignee: NCR Corporation
• Original Assignee: NCR Corporation
• Inventors: Cathro, Ian A.
• Granted Patent: US 8,739,305 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: G06F 17/00 Digital computing or data processing equipment or methods, specially adapted for specific functions information retrieval, database structures or file system structures therefor G06F16/00
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A method of using a mini filter driver to secure access to encrypted information stored on a removable storage device. The method comprises receiving a request to read information from the removable storage device. The mini filter driver ascertains if the request originated from an authorized client. The mini filter driver receives encrypted information read from the removable storage device, and decrypts the encrypted information in the event that the request originated from an authorized client. The decrypted information can then be conveyed to the authorized client. If the client is not authorized, then the mini filter driver does not decrypt the information.

Claims

1. A method of using a mini filter driver to secure access to encrypted information stored on a removable storage device, the method comprising:

receiving a request to read information from the removable storage device;

ascertaining if the request originates from an authorized client;

receiving encrypted information read from the removable storage device;

decrypting the encrypted information in the event that the request originated from an authorized client; and

conveying the decrypted information to the authorized client.

2. A method according to claim 1, wherein the request to read information from the removable storage device is relayed via a file system filter manager with which the mini filter driver is registered.

3. A method according to claim 1, wherein ascertaining if the request originates from an authorized client further comprises:

requiring a client to send a registration request to the mini filter driver prior to that client sending a request to read information from the removable storage device;

validating the registration request;

sending an acknowledgement to that client; and

creating an entry for that client in an authorized client list.

4. A method according to claim 1, wherein decrypting the encrypted information in the event that the request originated from an authorized client further comprises using decryption technology stored within the mini filter driver to decrypt the encrypted information.

5. A method according to claim 1, wherein decrypting the encrypted information in the event that the request originated from an authorized client further comprises using decryption technology stored on the removable storage device to decrypt the encrypted information.

6. A method according to claim 5, wherein the method may further comprises removing any portions of the encrypted information that contain the decryption technology prior to sending the encrypted information to an unauthorized client.

7. A method according to claim 1, wherein the method comprises the further step of:

conveying the encrypted information to an unauthorized client in the event that the request originated therefrom.

8. A computer memory storing in kernel mode the mini filter driver implementing the steps of claim 1.

9. A file management system comprising:

a storage device driver for reading information from and writing information to a removable storage device;

a file system driver in communication with the storage device driver for organizing files stored on the removable storage device;

a file system filter manager in communication with the file system driver; and

a mini filter driver registered with the file system filter manager, the mini filter driver further comprising a list of authorized clients, and decryption technology whereby the mini filter driver is operable to decrypt information read by the file system driver in response to a request from an authorized client.

10. A file management system according to claim 9, wherein the mini filter driver further comprises a volume labels of interest list storing volume labels of removable storage devices known to include encrypted information.

11. A file management system according to claim 9, wherein the mini filter driver further comprises a client authentication component for receiving a code and an identifier from a client.

12. A self-service terminal including a plurality of devices requiring periodic maintenance, the terminal comprising:

a management application for providing restricted functions accessible only by an authorized user;

a port for receiving a removable storage device from a user, where the removable storage device contains encrypted information relating to maintaining the devices; and

a file system filter manager including a mini filter driver for decrypting the encrypted information stored on a removable storage device in response to a request for the information from an authorized application;

wherein the management application is operable to register with the mini filter to become an authorized application.

13. A terminal according to claim 12, wherein the self-service terminal includes a cash dispenser.