Storage Volume Protection Supporting Legacy Systems

• US 20100211802A1
• Filed: 02/19/2009
• Published: 08/19/2010
• Est. Priority Date: 02/19/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Xie, Ping, Humphries, Russell, Ferguson, Niels T., Ureche, Octavian T.
• Granted Patent: US 8,417,969 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

A storage volume is encrypted using a particular encryption technique, the storage volume including an access application and one or more cover files. The access application can be executed by a computing device having an operating system lacking support for the particular encryption technique, and allows the computing device to access data on the storage volume encrypted using the particular encryption technique.

Claims

1. A method implemented in a computing device, the method comprising:

accessing an encrypted storage volume encrypted using an encryption technique unsupported by an operating system of the computing device;

identifying an access application on the encrypted storage volume; and

executing, without administrator privileges at the computing device, the access application, the access application allowing the computing device to access encrypted data files stored on the encrypted storage volume.

2. A method as recited in claim 1, the access application further verifying credentials of a current user of the computing device, and allowing the device to access the encrypted data files only if the credentials are verified.

3. A method as recited in claim 2, the credentials of the current user comprising a password entered by the current user.

4. A method as recited in claim 1, wherein the access application allowing the device to access the encrypted data files comprises allowing the device read-only access to the encrypted data files.

5. A method as recited in claim 1, the access application accessing a protected file directory on the encrypted storage volume to identify locations of the encrypted data files on the encrypted storage volume.

6. A method as recited in claim 1, wherein the encrypted storage volume comprises a portable flash memory storage device.

7. A method as recited in claim 1, further comprising displaying a prompt notifying a current user of the computing device that the access application is to be executed in order to access the encrypted data files, and executing the access application only if a user input indicates that the access application is to be executed.

8. A method as recited in claim 7, further comprising automatically displaying the prompt when the encrypted storage volume is coupled to the computing device.

9. A method as recited in claim 1, the encrypted storage volume further storing a protected file directory accessible to an additional computing device that supports the encryption technique, the protected file directory identifying locations of the encrypted data files on the encrypted storage volume and allowing the additional computing device to bypass the access application and access the encrypted data files.

10. A method implemented in a computing device, the method comprising:

generating a discovery volume portion on a storage volume; and

storing, in the discovery volume portion, an access application that can be executed by an additional computing device having an operating system lacking support for an encryption technique used to encrypt the storage volume, the access application allowing the additional computing device to access data on the storage volume encrypted using the encryption technique.

11. A method as recited in claim 10, the access application being executable by the additional computing device to allow access to the one or more encrypted files only after the access application has verified credentials of a current user of the additional computing device.

12. A method as recited in claim 11, the credentials of the current user comprising a passphrase entered by the current user.

13. A method as recited in claim 10, wherein the encrypted storage volume comprises a portable flash memory storage device.

14. A method as recited in claim 10, further comprising including in the discovery volume portion a reserved part in which at least part of a new version of the access application can be stored.

15. A method as recited in claim 10, further comprising storing on the storage volume a protected file directory identifying where the one or more encrypted files are stored on the storage volume, the protected file directory allowing both the access application and one or more other computing devices with operating systems that support the encryption technique to access the one or more encrypted files.

16. A method as recited in claim 10, further comprising storing, in the discovery portion, an autorun file that indicates to the computing device to display, when the storage volume is coupled to the computing device, a prompt notifying a current user of the computing device that the access application is to be executed in order to access the one or more encrypted files.

17. A method as recited in claim 16, the access application being executable by the additional computing device to allow access to the one or more encrypted files only after a user input in response to the prompt indicates the access application is to be executed, and only after the access application has verified credentials of the current user.

18. A method as recited in claim 10, wherein the access application is allowed read-only access to the one or more encrypted files.

19. A storage volume comprising:

a first portion storing both one or more encrypted files and a protected file directory of the one or more encrypted files, the protected file directory being accessible to one or more devices with operating systems that support an encryption technique used by the storage volume;

a second portion storing an access application that is executed by one or more other devices with operating systems that lack support for the encryption technique used by the storage volume, wherein execution of the access application can be done without administrator privileges on the one or more other devices; and

the access application, when executed, verifying credentials of a user of one of the one or more other devices and allowing the user to access the one or more encrypted files even though the one of the one or more other devices lacks support for the encryption technique used by the storage volume.

20. A storage volume as recited in claim 19, the second portion further storing a particular sequence of bits at a particular location to identify to the one or more devices that the storage volume is encrypted using the encryption technique.