Methods for firewall protection of mass-storage devices

• US 8,806,604 B2
• Filed: 06/28/2007
• Issued: 08/12/2014
• Est. Priority Date: 04/09/2007
• Status: Active Grant

• Current Assignee: Western Digital Israel Limited (Western Digital Corporation)
• Original Assignee: SanDisk IL Ltd. (Western Digital Corporation)
• Inventors: Golde, Ittai, Paley, Alexander, Shmulevich, Leonid
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US11/769,760
• Publication Number:
  US 20080250488A1
• Time in Patent Office: 2,602 Days
• Field of Search: 726/11, 726/22, 726/9, 713/182, 345/163, 710/36, 710/74, 710/110, 700/94, 381/58
• US Class Current: 726/11
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls

Abstract

The present invention discloses methods for protecting a host system from information-security risks posed by a URD, the method including the steps of: operationally connecting the URD to the host system; communicating, between the URD and the host system, via a network protocol, through a firewall residing in the host system; and configuring said firewall to provide security measures related to the URD. Preferably, the firewall is a software firewall or a hardware firewall. A method for protecting a host system from information-security risks posed by a URD, the method including the steps of: operationally connecting the URD to the host system; communicating, between the URD and the host system, via a network protocol, through a firewall residing in the host system; and configuring said firewall to restrict access of at least one application to the URD. Preferably, the firewall is a software firewall or a hardware firewall.

Claims

1. A method for protecting a host system from information-security risks posed by a USB removable drive (URD), the method comprising:

in a URD having a non-volatile memory in communication with a controller, while there is a local physical connection of the URD to the host system, the controller;

identifying, via communication over a network protocol, the URD to the host system as a network drive rather than as a local mass storage device;

communicating with the host system, via the network protocol, through a firewall residing in the host system; and

decoding data from the host system with the network protocol and writing the data to the non-volatile memory in the URD, wherein the controller of the URD causes the host system to enable firewall security measures of the firewall via communications over the network protocol rather than a mass storage protocol.

2. The method of claim 1, wherein the firewall is a software firewall.

3. The method of claim 1, wherein the firewall is a hardware firewall.

4. The method of claim 1, wherein the communicating comprises communicating responsive to security measures of said firewall.

5. The method of claim 4, wherein the communicating further comprises receiving restricted access to at least one application on the host system.

6. The method of claim 1, wherein communicating via the network protocol comprises communicating via Internet Protocol.

7. A USB removable drive (URD) comprising:

a non-volatile storage memory;

a USB connector; and

a controller in communication with the non-volatile storage memory, the controller configured to;

control operations performed on the non-volatile storage memory; and

present the URD to a host system as a network drive via transmission of data in a network protocol over the USB connector, rather than a mass storage protocol, wherein the controller of the URD enables communication with the host through a firewall residing in the host system.

8. The URD of claim 7, wherein the non-volatile storage memory includes flash memory.

9. The URD of claim 7, wherein the network protocol comprises Internet Protocol.

10. The URD of claim 7, wherein the controller comprises firmware executable to present the URD to the host system as a network drive.

11. The URD of claim 9, wherein the controller is further configured to decode data from the host system with the network protocol and write the data to the non-volatile storage memory in the URD.