Approaches for Ensuring Data Security

• US 20100050244A1
• Filed: 11/05/2009
• Published: 02/25/2010
• Est. Priority Date: 08/08/2008
• Status: Active Grant

• Current Assignee: Absolute Software Corporation
• Original Assignee: Absolute Software Corporation
• Inventors: Gupta, Ravi, Tarkhanyan, Anahit
• Granted Patent: US 8,556,991 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss

Abstract

Techniques for protecting resources of a client from theft or unauthorized access. A BIOS agent stores policy data within a BIOS of the client. The BIOS agent is one or more software modules operating in the BIOS of the client. The policy data describes one or more security policies which the client is to follow. In response to the client following at least one of the one or more security policies, a persistent storage medium of the client is locked by instructing a controller of the persistent storage medium to deny, to any entity, access to data stored on the persistent storage medium unless the entity supplies, to the controller, a recognized authentication credential. In this way, a malicious user without access to the recognized authentication credential cannot access the data stored on the persistent storage medium, even if the persistent storage medium is removed from the client.

Claims

1. A machine-readable medium storing one or more sequences of instructions for securing a client, which when executed, cause:

a BIOS agent storing policy data within a BIOS of the client, wherein the BIOS agent is one or more software modules operating in the BIOS of the client, and wherein the policy data describes one or more security policies followed by the client; and

in response to the client following at least one of the one or more security policies, locking a hard-disk drive (HDD) of the client by instructing a controller of the hard-disk drive (HDD) to deny, to any entity, access to data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized authentication credential.

2. The machine-readable medium of claim 1, wherein the client is a laptop computer.

3. The machine-readable medium of claim 1, wherein the at least one of the one or more security policies was obtained by the client, from a server, over a communications link, and wherein the at least one of the one or more security policies cannot be changed by a user of the client.

4. The machine-readable medium of claim 1, wherein the client is configured to be locked after the client is manufactured, and wherein a purchaser of the client is provided a password to unlock the client.

5. The machine-readable medium of claim 1, wherein the controller is configured such that, upon the hard-disk drive (HDD) being removed from the client, the controller continues to deny, to any entity, access to the data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized password.

6. The machine-readable medium of claim 1, wherein the controller denies, to any entity, access to the data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized password by preventing the client from booting unless the recognized password is supplied to the controller.

7. The machine-readable medium of claim 1, wherein locking the hard-disk drive (HDD) of the client further comprises:

encrypting data stored on the hard-disk drive (HDD) using a key stored in the BIOS of the client.

8. The machine-readable medium of claim 1, wherein locking the hard-disk drive (HDD) of the client further comprises:

determining features supported by the client to assess how to deny, to any entity, access to the data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized password.

9. The machine-readable medium of claim 1, wherein at least one of the one or more security policies instructs the client to lock the hard-disk drive (HDD) when the client enters a disabled state.

10. The machine-readable medium of claim 1, wherein execution of the one or more sequences of instructions further causes:

in response to receiving, over a communications link, a command from a server, the client locking the hard-disk drive (HDD).

11. A method for securing a client, comprising:

a BIOS agent storing policy data within a BIOS of the client, wherein the BIOS agent is one or more software modules operating in the BIOS of the client, and wherein the policy data describes one or more security policies followed by the client; and

in response to the client following at least one of the one or more security policies, locking a hard-disk drive (HDD) of the client by instructing a controller of the hard-disk drive (HDD) to deny, to any entity, access to data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized authentication credential.

12. The method of claim 11, wherein the client is a laptop computer.

13. The method of claim 11, wherein the at least one of the one or more security policies was obtained by the client, from a server, over a communications link, and wherein the at least one of the one or more security policies cannot be changed by a user of the client.

14. The method of claim 11, wherein the client is configured to be locked after the client is manufactured, and wherein a purchaser of the client is provided a password to unlock the client.

15. The method of claim 11, wherein the controller is configured such that, upon the hard-disk drive (HDD) being removed from the client, the controller continues to deny, to any entity, access to the data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized password.

16. The method of claim 11, wherein the controller denies, to any entity, access to the data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized password by preventing the client from booting unless the recognized password is supplied to the controller.

17. The method of claim 11, wherein locking the hard-disk drive (HDD) of the client further comprises:

encrypting data stored on the hard-disk drive (HDD) using a key stored in the BIOS of the client.

18. The method of claim 11, wherein locking the hard-disk drive (HDD) of the client further comprises:

determining features supported by the client to assess how to deny, to any entity, access to the data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized password.

19. The method of claim 11, wherein at least one of the one or more security policies instructs the client to lock the hard-disk drive (HDD) when the client enters a disabled state.

20. The method of claim 11, further comprising:

in response to receiving, over a communications link, a command from a server, the client locking the hard-disk drive (HDD).

21. An apparatus for securing resources thereof, comprising:

one or more processors; and

a machine-readable medium storing one or more sequences of instructions, which when executed by the one or more processors, causes;

a BIOS agent storing policy data within a BIOS of the client, wherein the BIOS agent is one or more software modules operating in the BIOS of the client, and wherein the policy data describes one or more security policies followed by the client; and

in response to the client following at least one of the one or more security policies, locking a persistent storage medium of the client by instructing a controller of the persistent storage medium to deny, to any entity, access to data stored on the persistent storage medium unless the entity supplies, to the controller, a recognized authentication credential.