System and method for data storage firewall on data storage unit

• US 8,051,053 B2
• Filed: 06/14/2007
• Issued: 11/01/2011
• Est. Priority Date: 03/02/2006
• Status: Active Grant

• Current Assignee: Nytell Software LLC (Intellectual Ventures LLC)
• Original Assignee: Noam Camiel
• Inventors: Camiel, Noam
• Primary Examiner(s): Coby; Frantz
• Application Number:
  US11/763,409
• Publication Number:
  US 20070266063A1
• Time in Patent Office: 1,601 Days
• Field of Search: 707/609, 707/694, 707821-828
• US Class Current: 707/694
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

A system and method is introduced for implementing a storage firewall for protecting files when a storage device connects to a digital appliance. A storage device may connect to a number of appliances and is therefore at risk of getting infected with viruses and other malware risking subsequent transfer of these infections to other appliances. The storage device is further at risk of leaking sensitive information or loosing critical information. The storage firewall protects data on a storage device that connects to a digital appliance in various manners using a standard, unencrypted partition and a standard file system. Protected and unprotected files may reside homogeneously on the file system of the storage device. Using the storage firewall, files on digital appliance may be protected from infected files residing on storage device connected to digital appliance. No application is required to be activated on digital appliance when storage device connects to digital appliance. Protection is activated by default and carried out by storage device.

Claims

1. A file storage unit for storing data files via an external file interface, said external file interface accessible to a directly attached external unit said file storage unit comprising:

a physical file storage for storing files homogenously on at least part of said physical file storage;

said external file interface for direct access of said external unit supporting sector level commands for direct-attached storage;

a storage firewall located in between said physical file storage and said external file interface containing sector level rules associated with respective files having a file access restriction for allowing or blocking sector level requests between said external file interface and said at least part of physical file storage for storing files homogenously;

a policy mode indicator containing a policy mode for altering said sector level rules of said storage firewall whereby said file storage unit autonomously allows or blocks access to said files having file access restriction from said directly attached external unit according to said sector level rules associated with said files having a file access restriction and said policy mode of said policy mode unit.

2. The file storage unit of claim 1 wherein said sector level rules include restrictive write permissions for sectors associated with files of programs located on said file storage unit whereby said programs located on said file storage unit are protected from alteration by said directly attached external unit.

3. The file storage device of claim 1 wherein said sector level rules include restrictive read permissions for sectors associated with files having restrictive read permissions located on said file storage unit whereby said files having restrictive read permissions are protected from being read by said directly attached external unit.

4. The file storage device of claim 1 wherein said sector level rules include restrictive permissions for sectors associated with files having restriction policies on said file storage unit.

5. The file storage device of claim 1 wherein said sector level rules include restrictive read permissions for sectors associated with executable files residing on said file storage unit whereby said external unit is protected from infected executable files residing on said directly attached file storage unit.

6. The file storage device of claim 1 wherein said policy mode contained in said policy mode indicator is changed by sending credentials to said file storage device from directly attached said external unit.

7. The file storage device of claim 1 further comprising a policy decision logic unit for setting file access restrictions to said files residing on said file storage unit.

8. A method of protecting files stored on a file storage unit, some of which have restricted access conditions, from a directly attached external device configured for accessing files stored on said file storage unit through an external file interface using sector level commands for direct-attached storage the method comprising:

a. storing said files homogenously on sectors within a single partition of said file storage unit,

b. identifying permissions of said homogeneously stored files as either unrestricted files or restricted access files,

c. identifying permissions for sectors associated with said restricted access files according to said identified file permissions,

d. calculating permissions for requested sector internally within said file storage unit using said identified permissions of said sector and a current policy mode,

e. allowing full accessibility functionality for sectors of said unrestricted files, whilst restricting accessibility functionality to sectors of said restricted files according to said internally calculated permissions of said sectors associated with said stored restricted access files.

9. A method according to claim 8 wherein said current policy mode is changed by receiving external credentials from said directly attached external device to change said calculated permissions for requested sector.

10. A method according to claim 8 wherein said identified permissions for sectors associated with said restricted access files include write policy restrictions for files which are executable programs whereby said directly attached external device cannot alter said executable programs.

11. A method according to claim 8 wherein said identified permissions for sectors associated with said restricted access files include read policy restrictions for files which are executable programs whereby said directly attached external device cannot read and execute said executable programs thereby protecting said directly attached external device from infected executable files residing on said storage unit.

12. A method according to claim 8 wherein said current policy mode is changed according to logical rules to change said calculated permissions for requested sector.

16. A method according to claim 8 wherein said identified permissions for sectors associated with said restricted access files include restricted read permissions for sectors associated with files having restricted read permissions.

17. A method according to claim 16 wherein said identified permissions for sectors associated with said restricted access files include restricted write permissions for sectors associated with files having restricted write permissions.

13. A file storage device for storing files in sectors for subsequent access through an external file interface said file interface accessible to a digital appliance directly attached to said file storage device, the device comprising:

said externally accessible interface by said directly attached digital appliance for direct access of said files through sector level commands to support direct-attached storage, and an internal inaccessible interface located above said sector level access to limit access to certain files according to an indication of sector level rules for said stored sectors associated with a respective file of a file access restriction, and an internal policy mode indicator containing a policy mode for internally altering access restrictions as indicated by said indication of said sector level rules associated with a respective file of a file access restriction in respect to said policy mode whereby said digital appliance accesses said stored files on directly attached said storage device according to said indication of sector level rules associated with respective said stored files in respect to said policy mode.

14. The file storage device of claim 13 wherein said policy mode of said internal policy mode indicator is changed by sending credentials from said directly attached digital appliance through said externally accessible interface.

15. The file storage device of claim 13 further comprising a policy decision logic unit for setting file access restrictions to files residing on said file storage device.