Encryption sentinel system and method

• US 8,347,359 B2
• Filed: 12/23/2008
• Issued: 01/01/2013
• Est. Priority Date: 12/28/2007
• Status: Active Grant

• Current Assignee: Asperatus, LLC
• Original Assignee: Bruce Backa
• Inventors: Backa, Bruce
• Primary Examiner(s): Pearson, David
• Assistant Examiner(s): Rahman, Mahfuzur
• Application Number:
  US12/342,929
• Publication Number:
  US 20090172786A1
• Time in Patent Office: 1,470 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

An encryption sentinel system and method protects sensitive data stored on a storage device and includes sentinel software that runs on a client machine, sentinel software that runs on a server machine, and a data storage device. When a client machine requests sensitive data from the data storage device, the data storage device interrogates the sentinel software on the server machine to determine if this client machine has previously been deemed to have proper encryption procedures and authentication. If the sentinel server software has this information stored, it provides an approval or denial to the storage device that releases the data if appropriate. If the sentinel server software does not have this information at hand or the previous information is too old, the sentinel server interrogates the sentinel software that resides on the client machine which scans the client machine and provides an encryption update to the sentinel server software, following which data will be released if appropriate.

Claims

1. A system for controlling access to sensitive data, said system comprising:

a data storage device, configured for storing data and including a data storage controller, responsive to a request to access data from a client access device, for providing a request indication of said request to access data, and for providing said data only upon receiving an authorization indication from a data access control server that said client access device is authorized to access said data;

the data access control server, coupled to said data storage device and to said client access device and including an encryption sentinel server, said encryption sentinel server responsive to said request indication from said data storage device, and responsive to a security indication of whether said client access device is secure, for controlling access to said data on said data storage device by said client access device;

the client access device, coupled to said data storage device and to said data access control server and including a client data access controller, configured for initiating said request to access data, and responsive to said encryption sentinel server, for providing the security indication with secure status of a storage device on said client access device; and

wherein said encryption sentinel server is configured to store the secure status of said client access device, including a timestamp of said status, on said data access server.

2. The system of claim 1, wherein said data stored on said data storage device is deemed to be sensitive data by a system administrator.

3. The system of claim 1, wherein said data stored on said data storage device is encrypted.

4. The system of claim 1, wherein said data access control server is configured for checking the secure status of said client access device.

5. A method for controlling access to sensitive data using the system of claim 1, comprising the acts of:

receiving, by said data storage device, a request from said client access device for access to sensitive data stored on said data storage device;

in response to said received request, said data storage device issuing a request to said data access control server to inquire whether said client access device is authorized to receive the requested sensitive data;

in response to said issued request by said data storage device, said data access control server determining whether said client access device is secure, and providing an indication of said secure status of said client access device to said data storage device in response to said issued request; and

responsive to said provided indication of the secure status of said client access device provided by said data access control server, said data storage device providing said requested sensitive data to said client access device if said indication of the secure status of said client access device is positive or otherwise providing a sensitive data access denial response to said client access device.

6. The method of claim 5, wherein said act of determining whether said client access device is secure by said data access control server includes the act of searching said data access control server for an indicator of whether said client access device is secure or not secure, and for providing said indication based on said search.

7. The method of claim 5, wherein said act of determining whether said client access device is secure by said data access control server includes the act of querying said client access device for an indicator from said client access device of whether or not it is secure, and receiving from said client access device the indicator of whether or not it is secure.

8. Method of claim 7, further including after the act of receiving from said client access device the indicator of whether or not it is secure, the further act of storing said indicator on said data access control server.

9. The method of claim 8, wherein said stored indicator of the secure status of said client access device includes timestamp indicating when said secure status was received.

10. The method of claim 9, wherein said act of determining whether said client access device is secure by said data access control server includes the act of searching said data access control server for said indicator, and if said indicator is stored on said data access control server, further including the act of reviewing said timestamp indicating when said secure status was received and if said timestamp is less than or equal to a predetermined amount of time from the current time, providing said indication indicating that said client access device is secure, and if said timestamp is greater than a predetermined amount of time from the current time, providing said indication indicating that said client access device is not secure.