MANAGING SELF-ENCRYPTING DRIVES IN DECENTRALIZED ENVIRONMENTS

• US 20130067242A1
• Filed: 09/12/2011
• Published: 03/14/2013
• Est. Priority Date: 09/12/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Lyakhovitskiy, Grigory B., Tsang, Michael H.
• Granted Patent: US 8,856,553 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A self-encrypting drive allows finely grained control, i.e., the ability to create, protect, lock and unlock, of different volumes on the same drive. The different volumes enable multiple different operating systems to be booted, depending on the volume that is selected for booting.

Claims

1. A computer system comprising:

one or more processors, wherein the processors process computer program instructions;

a self-encrypting drive;

wherein the computer program instructions, when processed, manage access to the self encrypting drive, wherein a provisioned drive includes one or more locking ranges and a global range and;

an authority object for each locking range that stores authentication information for the locking range, and

a locking range object for each locking range that stores state information for the locking range.

2. The computer system of claim 1, wherein the computer program instructions, when processed, provision the self-encrypting drive using a provisioning process comprising:

ensuring the authority object and locking range object for each locking range are configured; and

enabling all users to read the authority object and locking range objects, but enabling only the user assigned to the locking range to modify the authority object and locking range objects for the locking range.

3. The computer system of claim 2 wherein the provisioning process further comprises disabling authorities other than a user authority and a physical presence authority for each locking range.

4. The computer system of claim 2, wherein the provisioning process further comprises disabling all locking ranges other than the global range.

5. The computer system of claim 2, wherein the provisioning process further comprises setting access control for each locking range to provide for a single user authority.

6. The computer system of claim 2, wherein the provisioning process further comprises enabling cryptographic erase of a locking range without user authentication.

7. The computer system of claim 2, wherein the computer program instructions, further include code that, when processed, creates a volume by aligning a locking range with the volume.

8. The computer system of claim 7, wherein the computer program instructions further include code that, when processed, activates protection of a volume.

9. The computer system of claim 8, wherein the computer program instructions, further include code that, when processed, deactivates protection of a volume.

10. The computer system of claim 8, wherein the computer program instructions further include code that, when processed, locks a volume.

11. The computer system of claim 10, wherein the computer program instructions further include code that, when processed, unlocks a volume.

12. The computer system of claim 7 wherein the computer program instructions further include code that, when processed, removes a volume by disabling the locking range associated with the volume.

13. The computer system of claim 1, further comprising a plurality of volumes on the self-encrypted drive, each volume including a different operating system.

14. The computer system of claim 13, further comprising a centralized boot manager which selects a volume from which to boot an operating system.

15. The computer system of claim 14, wherein the boot manager includes a key manager, and wherein the boot manager uses the key manager and key information stored in the data store for a locking range corresponding to the selected volume to unlock the volume and boot the operating system.

16. The computer system of claim 13, further comprising computer program instructions that, when processed, perform a process comprising:

identifying a volume to unlock;

unlocking the identified volume; and

instructing a boot manager to boot the operating system from the unlocked volume.

17. The computer system of claim 1, wherein the provisioned self-encrypting drive further comprises:

a data store object including information stored for each locking range including key management data.

18. The computer system of claim 17, wherein the computer program instructions, when processed, provision the self-encrypting drive using a provisioning process comprising:

ensuring the data store object, authority object and locking range object for each locking range are configured; and

enabling all users to read the data store object, authority object and locking range objects, but enabling only the user assigned to the locking range to modify the data store object, authority object and locking range objects for the locking range.

19. An article of manufacture comprising:

a computer storage medium;

computer program instructions stored on the computer storage medium which, when processed by a processing device, instruct the processing device to perform a process for provisioning a self encrypting drive comprising;

specifying one or more locking ranges and a global range;

creating data structures for storing information about the specified ranges, including;

an authority object for each locking range that stores authentication information for the locking range, and

a locking range object for each locking range that stores state information for the locking range.

20. The article of manufacture of claim 19, wherein the provisioned self-encrypting drive further comprises a data store object including information stored for each locking range including key management data.