SYSTEMS AND METHODS TO PROVIDE SECURE STORAGE

• US 20150341371A1
• Filed: 08/05/2015
• Published: 11/26/2015
• Est. Priority Date: 09/28/2012
• Status: Active Grant

• Current Assignee: SK Hynix NAND Product Solutions Corporation (SK Hynix Inc.)
• Original Assignee: Intel Corporation
• Inventors: Triantafillou, Nicholas D., Saxena, Paritosh, Thadikaran, Paul J., Durham, David Michael
• Granted Patent: US 10,091,213 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

Systems and method to provide secure storage are disclosed. An example method includes establishing a secure tunnel between a storage device and an agent, provide a command from the agent to the storage device via the secure tunnel, access first data at the storage device in response to the command, and identify a modification to data stored on the storage device by comparing the first data to second data, wherein the comparison is done using the storage device.

Claims

1. A tangible computer readable storage medium comprising computer readable instructions which, when executed, cause a processor of a storage device to at least:

responsive to a command from an agent to the storage device via a secure tunnel between the storage device and the agent, access first data at the storage device; and

identify a modification to data stored on the storage device by comparing the first data to second data on the storage device, the first data including at least one of trusted data and a hash of the trusted data, and the second data including at least one of untrusted data and a hash of the untrusted data.

2. A storage medium as defined in claim 1, wherein the agent executes on a host platform of the storage device or on a platform remote to the host platform.

3. A storage medium as defined in claim 1, wherein the instructions further cause the processor to expose an application programming interface and receiving a request to the application programming interface from the agent, the request including a trusted signature.

4. A storage medium as defined in claim 1, wherein the processor is part of a system-on-a-chip in the storage device.

5. A storage medium as defined in claim 1, wherein the command includes at least one of a file system identification, a file name identification, a command to generate a hash of a file stored on the storage device, or a command to compare a first hash value to a second hash value.

6. A storage medium as defined in claim 1, further including instructions to cause the processor to determine whether a result of the comparison is representative of a presence of malware.

7. A storage medium as defined in claim 1, further including instructions to cause the processor to transfer a result of the comparison from the storage device to the agent via the secure tunnel.

8. A storage medium as defined in claim 1, wherein the second data is stored at the storage device.

9. A storage medium as defined in claim 8, wherein the first data is stored in a secure storage area on the storage device.

10. A storage device, comprising:

a secure storage area;

a second storage area; and

a processor, the processor responsive to a command received from an agent via a secure tunnel, the processor to identify a modification to first data stored in the second storage area by comparing second data stored in the secure storage area to the first data in response to the command.

11. A storage device as defined in claim 10, wherein the second data includes a hash of trusted data stored in the secure storage area.

12. A storage device as defined in claim 11, wherein the first data includes a hash of untrusted data.

13. A storage device as defined in claim 10, wherein the processor is to compare a difference between the first data and the second data to a malware definition to determine whether malware is present.

14. A storage device as defined in claim 10, wherein the first data is stored on the storage device, but not in the secure storage area.

15. A storage device as defined in claim 10, wherein the secure tunnel is to prevent software executing in an operating system from modifying data stored in the secure storage area.

16. A storage device as defined in claim 10, wherein the processor is to transfer a result of the comparison from the storage device to the agent via the secure tunnel.

17. A method, comprising:

responsive to a command from an agent to the storage device via a secure tunnel between the storage device and the agent, accessing, with a processor, first data at the storage device; and

identifying, with the processor, a modification to data stored on the storage device by comparing the first data to second data on the storage device, the first data including at least one of trusted data and a hash of the trusted data, and the second data including at least one of untrusted data and a hash of the untrusted data.

18. A method as defined in claim 17, wherein the processor is part of a system-on-a-chip in the storage device.

19. A method as defined in claim 17, wherein the command includes at least one of a file system identification, a file name identification, a command to generate a hash of a file stored on the storage device, or a command to compare a first hash value to a second hash value.

20. A method as defined in claim 17, further including determining, with the processor, whether a result of the comparison is representative of a presence of malware.