Methods and systems for promoting security in a computer system employing attached storage devices

• US 7,461,270 B2
• Filed: 02/02/2006
• Issued: 12/02/2008
• Est. Priority Date: 07/25/2001
• Status: Expired due to Term

• Current Assignee: ESW Holdings, Inc. (ESW Capital, LLC)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Thibadeau, Robert H.
• Primary Examiner(s): Parthasarathy, Pramila
• Application Number:
  US11/346,118
• Publication Number:
  US 20070174920A1
• Time in Patent Office: 1,034 Days
• Field of Search: None
• US Class Current: 713/193
• CPC Class Codes: G06F 2003/0697 device management, e.g. handlers, drivers, I/O schedulers
• CPC Class Codes: G06F 21/805 using a security table for the storage sub-system
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0674 Disk device

Abstract

The present methods and systems use specially isolated techniques for promoting security in a computer system. In one embodiment of these methods and systems, a simple file system is concealed in the storage of the computer system and is managed with a processor and simple non-writeable code operating on the storage device. Strong cryptographic design permits the present computer security methods and systems to secure data on the storage device. In one method embodiment, a computer system is provided with an operating system in operative association with at least one storage device, wherein the storage device includes firmware and a processor for processing data and instructions stored on the storage device. The method includes creating at least one security partition in, and restricting access to, at least a portion of the storage device by the operating system. The method also includes creating at least one security partition in the storage device. The method also includes providing at least one authority record and data associated with the authority record in the storage device. System and computer-readable medium embodiments structured in accordance with the method embodiments discussed herein are also provided.

Claims

1. A storage device comprising:

a storage medium having a security partition containing at least one authority record and at least one data set associated with each of the authority records; and

a mechanism within the storage device adapted to limit access to the security partition based on the at least authority record, wherein the mechanism comprises a processor disposed within the storage device and adapted to limit access to the security partition by an operating system of a computer system, based at least in part on authentication of a passcode and a signed nonce, which are received from the operating system and verified by the mechanism according to the at least one authority record.

2. The storage device of claim 1, wherein:

the nonce is generated within the storage device and stored with the passcode in the at least one authority record.

3. The storage device of claim 2, wherein:

the nonce is generated within the storage device and provided to the operating system in response to at least one procedural call from the operating system.

4. The storage device of claim 1, wherein:

the authority record validates use of the nonce by the operating system only one time.

5. The storage device of claim 1, wherein:

the authority record comprises a public key;

the passcode provided by the operating system are encrypted by the public key; and

the mechanism is adapted to decrypt the passcode using the private key.

6. A disk drive data storage device comprising:

a data storage medium comprising a data storage disk;

a secure area defined on the data storage disk, the secure area containing at least one authority record and associated data, the authority record determining access to the associated data, including an cryptographic key; and

a controller within the data storage device, which is adapted to control access to the associated data based on the at least one authority record, wherein the controller is adapted to perform cryptographic operations within the disk drive data storage device using the key based on established procedure calls within the disk drive data storage device that execute cryptographic operations on behalf of, but concealed from, one or more user applications.

7. The disc drive data storage device of claim 6, wherein at least some of the cryptographic operations are unrelated to the associated data.

8. The disk drive data storage device of claim 6 wherein the controller allows only write access to the secure area for concealing information, including the cryptographic key, the controller adapted to prohibit read access to the information.

9. A system for promoting security in a computer system having an operating system in operative connection with at least one storage device, wherein said storage device includes a processor for processing data stored on said storage device, said system for promoting security comprising:

a security partition defined in the storage device and containing at least one authority record and associated data, the authority record determining access to the associated data and storage device settings, and wherein the authority record comprises at least one of a cryptographic key or hash, which authorizes at least one of reading or writing the data and storage device settings; and

wherein access to the security partition in the storage device by the operating system of the computer system is limited by the processor on the storage device according to the authority record.

10. The system of claim 9, wherein the cryptographic key comprises a public key associated with the authorization.

11. The system of claim 9, wherein the device settings are stored in a writable space within the security partition.

12. The system of claim 9, wherein the at least one authority record employs a write-once-no-delete mode to record authenticated software calls.

13. A system for promoting security in a computer system having an operating system in operative connection with at least one storage device, wherein said storage device includes a processor for processing data stored on said storage device, said system for promoting security comprising:

a security partition formed in said storage device having at least one authority record comprising an authority for authorizing read operations to an associated data set and a separate authority for authorizing write operations to the associated data set; and

wherein access to the security partition in the storage device by the operating system of the computer system is limited by the processor on the storage device according to the at least one authority record.

14. The system of claim 13 wherein at least one of the authorities for authorizing write and read operations implements a write but not read authorization.