Enabling access to removable hard disk drives

• US 8,924,733 B2
• Filed: 06/14/2010
• Issued: 12/30/2014
• Est. Priority Date: 06/14/2010
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kritt, Barry Alan, Law, Douglas Alan, Vargas, Juan F.
• Primary Examiner(s): Vostal, O. C.
• Application Number:
  US12/814,586
• Publication Number:
  US 20110307708A1
• Time in Patent Office: 1,660 Days
• Field of Search: 713/182, 713/2, 713/100, 713/185, 726/19, 365/200, 380/44
• US Class Current: 713/182
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04K 1/00 Secret communication
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A method, apparatus, and computer program product for accessing a device. The device receives a key from an operating system in response to the device in a locked state being connected to a data processing system after the operating system for the data processing system is running. The device compares the key received from the operating system with a set of keys stored in the device. The key is based on a system identifier for the data processing system and a password. The device determines whether a match is present between the key and the set of keys. The device changes the device from the locked state to an unlocked state in response to a determination that the match is present.

Claims

1. A method for accessing a device, the method comprising:

storing, by the device, a set of keys in a data structure in the device;

responsive to the device in a locked state being connected to a data processing system after an operating system running on the data processing system is running, receiving, by the device, a first key from the operating system, wherein the device may not be accessed or used by the data processing system while in a locked state, wherein the device is selected from one of a storage device, a peripheral device, a hard disk drive, a solid state drive, a universal serial bus drive, and a printer;

comparing, by the device, the first key received from the operating system for the data processing system with the set of keys stored in the device, wherein the first key is based on a system identifier for the data processing system and a first password;

determining, by the device, whether a match is present between the first key and the set of keys;

responsive to a determination that the match is present, changing, by the device, the device from the locked state to an unlocked state;

responsive to an absence of the determination that the match is present, waiting, by the device, for an administrative password for the device;

responsive determining that the administrative password is valid, determining, by the device, whether space is available within the data structure to add additional keys;

responsive to determining that space is available within the data structure, retrieving, by the device, the system identifier from the data processing system, and receiving the password;

responsive to retrieving the system identifier and receiving the password, generating a second key, wherein the key is based on a system identifier for the data processing system and a second password; and

responsive to generating the second key, storing the second key in the data structure.

2. The method of claim 1 further comprising:

identifying, by the operating system, the system identifier and the password; and

generating, by the operating system, the key using the system identifier and the password.

3. The method of claim 1 further comprising:

responsive to the device in the locked state being connected to the data processing system after the operating system for data processing system is running, determining, by the device, whether the device has been enabled for use with the data processing system; and

responsive to a determination that the device has not been enabled for use with the data processing system, preventing, by the device, activating the changing step.

4. The method of claim 1, wherein the data structure is a table.

5. The method of claim 1 further comprising:

receiving, by the device, the second key from the operating system;

comparing, by the device, the second key received from the operating system for the data processing system with the set of keys stored in the device, wherein the second key is based on the system identifier for the data processing system and a second password;

determining, by the device, whether a match is present between the second key and the set of keys; and

responsive to a determination that the match is present, changing, by the device, the device from the locked state to an unlocked state.

6. An apparatus comprising:

a device having a set of keys stored thereon, wherein the device has a locked state and an unlocked state; and

an access system located in the device, wherein the access system is configured to receive a first key from an operating system in response to the device in the locked state being connected to a data processing system after the operating system running on the data processing system is running, wherein the device may not be accessed or used by the data processing system while in a locked state, wherein the device is selected from one of a storage device, a peripheral device, a hard disk drive, a solid state drive, a universal serial bus drive, and a printer;

compare the first key received from the operating system for the data processing system with the set of keys stored in the device, wherein the first key is based on a system identifier for the data processing system and a first password;

determine whether a match is present between the first key and the set of keys; and

change the device from the locked state to an unlocked state in response to a determination that the match is present;

wait for an administrative password for the device in response to an absence of the determination that the match is present;

determine whether space is available within the data structure to add additional keys in response to determining that the administrative password is valid;

retrieve a system identifier for the data processing system and receive a password in response to determining that space is available within the data structure;

generate a second key, wherein the second key is based on a system identifier for the data processing system and a second password, in response to retrieving the system identifier and receiving the password; and

store the second key in the data structure in response to generating a second key.

7. The apparatus of claim 6, wherein the operating system is configured to identify the system identifier and the password;

and generate the key using the system identifier and the password.

8. The apparatus of claim 6, wherein the access system is configured to store the set of keys in a data structure in the device.

9. The apparatus of claim 6, wherein the access system is configured to determine whether the device has been enabled for use with the data processing system in response to the device in the locked state being connected to the data processing system after the operating system for the data processing system is running;

and prevent activating the changing step in response to a determination that the device has not been enabled for use with the data processing system.

10. The apparatus of claim 8, wherein the data structure is a table.

11. The apparatus of claim 6, wherein the access system is further configured:

to receive the second key from the operating system;

to compare the second key received from the operating system for the data processing system with the set of keys stored in the device, wherein the second key is based on the system identifier for the data processing system and a second password;

to determine whether a match is present between the second key and the set of keys; and

in response to a determination that the match is present, to change the device from the locked state to an unlocked state.

12. A computer program product for accessing a device comprising:

a non-transitory computer readable storage medium;

program code, stored on the computer readable storage medium, for storing a set of keys in a data structure in the device;

program code, stored on the computer readable storage medium, for receiving a first key from an operating system in response to the device in a locked state being connected to a data processing system after the operating system running on the data processing system is running, wherein the device may not be accessed or used by the data processing system while in a locked state, wherein the device is selected from one of a storage device, a peripheral device, a hard disk drive, a solid state drive, a universal serial bus drive, and a printer;

program code, stored on the computer readable storage medium, for comparing the first key received from the operating system for the data processing system with a set of keys stored in the device, wherein the first key is based on a system identifier for the data processing system and a first password;

program code, stored on the computer readable storage medium, for determining whether a match is present between the first key and the set of keys;

program code, stored on the computer readable storage medium, for changing the device from the locked state to an unlocked state in response to a determination that the match is present;

program code, stored on the computer readable storage medium, for waiting for an administrative password for the device in response to an absence of the determination that the match is present;

program code, stored on the computer readable storage medium, for determining whether space is available within the data structure to add additional keys in response to determining that the administrative password is valid;

program code, stored on the computer readable storage medium, for retrieving a system identifier for the data processing system and for receiving a password in response to determining that space is available within the data structure;

program code, stored on the computer readable storage medium, for generating a second key, wherein the second key is based on a system identifier for the data processing system and a second password, in response to retrieving the system identifier and receiving the password; and

program code, stored on the computer readable storage medium, for storing the second key in the data structure in response to generating a second key.

13. The computer program product of claim 12 further comprising:

program code, stored on the computer readable storage medium, for requesting an administrative password for the device in response to an absence of the determination that the match is present.

14. The computer program product of claim 12 further comprising:

program code, stored on the computer readable storage medium, for storing the set of keys in a data structure in the device.

15. The computer program product of claim 12 further comprising:

program code, stored on the computer readable storage medium, for determining whether the device has been enabled for use with the data processing system in response to the device in the locked state being connected to the data processing system after the operating system for the data processing system is running; and

program code, stored on the computer readable storage medium, for preventing activating the changing step in response to a determination that the device has not been enabled for use with the data processing system.

16. The computer program product of claim 15, wherein the data structure is a table.

17. The computer program product of claim 12 further comprising:

program code, stored on the computer readable storage medium, for receiving the second key from the operating system;

program code, stored on the computer readable storage medium, for comparing the second key received from the operating system for the data processing system with the set of keys stored in the device, wherein the second key is based on the system identifier for the data processing system and a second password;

program code, stored on the computer readable storage medium, for determining whether a match is present between the second key and the set of keys; and

program code, stored on the computer readable storage medium, in response to a determination that the match is present, for changing the device from the locked state to an unlocked state.