Methods and systems for promoting security in a computer system employing attached storage devices

• US 7,036,020 B2
• Filed: 07/25/2001
• Issued: 04/25/2006
• Est. Priority Date: 07/25/2001
• Status: Expired due to Term

• Current Assignee: SecureWave Storage Solutions Inc. (Quarterhill Inc. (f/k/a Wi-LAN Inc.))
• Original Assignee: Antique Books, Inc
• Inventors: Thibadeau, Robert H.
• Primary Examiner(s): Revak, Christopher
• Assistant Examiner(s): Parthasarathy, Pramila
• Application Number:
  US09/912,931
• Publication Number:
  US 20030023867A1
• Time in Patent Office: 1,735 Days
• Field of Search: 713/200, 713/189, 380/277
• US Class Current: 713/193
• CPC Class Codes: G06F 2003/0697 device management, e.g. handlers, drivers, I/O schedulers
• CPC Class Codes: G06F 21/805 using a security table for the storage sub-system
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0674 Disk device

Abstract

The present methods and systems use specially isolated techniques for promoting security in a computer system. In one embodiment of these methods and systems, a simple file system is concealed in the storage of the computer system and is managed with a processor and simple non-writeable code operating on the storage device. Strong cryptographic design permits the present computer security methods and systems to secure data on the storage device. In one method embodiment, a computer system is provided with an operating system in operative association with at least one storage device, wherein the storage device includes firmware and a processor for processing data and instructions stored on the storage device. The method includes creating at least one security partition in, and restricting access to, at least a portion of the storage device by the operating system. The method also includes creating at least one security partition in the storage device. The method also includes providing at least one authority record and data associated with the authority record in the storage device. System and computer-readable medium embodiments structured in accordance with the method embodiments discussed herein are also provided.

Claims

1. A storage device for promoting security in a computer system, the storage device comprising:

a storage medium for storing data;

firmware for reading data from and writing data to the storage medium; and

a partition defined on the storage medium for dividing the storage medium into a data partition and a secure data partition, the secure data partition for storing secure data and one or more authority records, wherein the one or more authority records define access permissions relating to the secure data partition and the secure data;

wherein the secure data partition contains a master authority record, wherein the one or more authority records can be created and deleted as required by a user having access permissions according to the master authority record; and

wherein only the firmware is permitted to access the secure data and the one or more authority records.

2. The storage device of claim 1 wherein the storage device is in communication with a computer system having an operating system.

3. The storage device of claim 2, wherein secure data stored in the secure data partition is invisible to the operating system.

4. The storage device of claim 1 wherein each of the one or more authority records contains one public-private key pair for authenticating data that originates from the security partition.

5. The storage device of claim 1, wherein the storage device further comprises:

cryptographic operations embedded in the firmware of the storage device.

6. The storage device of claim 5, wherein cryptographic code is authenticated with a root assurance in the firmware of the device, wherein the firmware is non-writable.

11. The storage device of claim 1, wherein the secure data is accessed by the firmware using a security partition open call internal to the storage device and hidden from a user.

7. A method for promoting security in a computer system having an operating system in operative connection with a storage device, wherein said storage device includes a processor and firmware for processing data stored on the storage device, the method comprising:

partitioning a storage medium of the storage device into a data partition and a secure data partition, the data partition being accessible to a user and the secure data partition being invisible to the user, the secure data partition for storing secure data and one or more authority records, wherein the secure data is encrypted and a cryptographic code is embedded in the firmware;

restricting access to the secure data partition such that only the firmware may access the secure data and the one or more authority records; and

authenticating the cryptographic code with a root assurance in the storage device.

8. The method of claim 7, further comprising:

prohibiting access to the secure data partition by the operating system of the computer system.

9. The method of claim 8, wherein a portion of the firmware is non-writable.

10. The method of claim 7, further comprising:

writing data to the secure data partition by executing of a portion of the firmware of the storage device; and

associating the data with a particular record of the one or more authority records.

12. A storage device comprising:

a storage medium having a security partition containing one or more authority records and at least one data set associated with each of the one or more authority records; and

a mechanism within the storage device adapted to limit access to the security partition based on the one or more authority records, wherein the mechanism comprises a processor disposed within the storage device adapted to limit access to the security partition by an operating system of a computer system, and firmware disposed within the storage device adapted to limit access to the security partition by an operating system of a computer system.

13. The storage device of claim 12 wherein the one or more authority records comprises a master authority record including instructions for governing the one or more authority records in said storage device.

14. The storage device of claim 12 wherein each of the one or more authority records comprises a plurality of fields, wherein a first field of the plurality of fields contains access rights governing access to the at least one data set.