Methods and systems for a portable data locker

• US 9,129,138 B1
• Filed: 10/29/2010
• Issued: 09/08/2015
• Est. Priority Date: 10/29/2010
• Status: Active Grant

• Current Assignee: Western Digital Technologies Incorporated (Western Digital Corporation)
• Original Assignee: Western Digital Technologies Incorporated (Western Digital Corporation)
• Inventors: Hesselink, Lambertus, Batra, Rajesh K.
• Primary Examiner(s): Truong, Thanhnga B
• Assistant Examiner(s): LANE, GREGORY A
• Application Number:
  US12/916,342
• Time in Patent Office: 1,775 Days
• Field of Search: 713/185, 713/189, 707/784, 726/27
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1011 to devices
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

The embodiments provide for binding files to an external drive, a secured external drive, or portable data locker. The files are bound in order to help restrict or to prevent access and modification by certain computers or users. Computers or users that are authorized or within the authorized domain are permitted full access. The files stored on the external drive may be bound in various ways. The files may be encapsulated in a wrapper that restricts the use and access to these files. The bound files may require execution of a specific application, plug-in, or extension. A computer may thus be required to execute program code that limits the use of the secured files. In one embodiment, the external drive provides the required program code to the computer. In other embodiments, the required program code may be downloaded from a network or provided by an external authority.

Claims

1. A method of binding a file to an external drive, said method comprising:

saving a file to an external drive, wherein the file is bound to the external drive to restrict the file from being moved to another storage location in an unauthorized manner;

determining when the external drive has been coupled to a computer; and

restricting access by the computer to the file based on program code that is installed by the external drive to the computer and that executes on the computer, wherein the program code is configured to at least restrict the computer from copying and saving at least a portion of the file to a location other than the external drive, and wherein the program code is configured to intercept file system commands of applications running on the computer.

2. The method of claim 1, wherein determining when the external drive has been coupled to the computer comprises identifying the computer via a USB connection from the external drive.

3. The method of claim 1, wherein restricting access by the computer comprises installing a driver that is specific to the external drive.

4. The method of claim 1, wherein restricting access by the computer comprises encapsulating the file in a wrapper that requires execution of program code by the computer.

5. The method of claim 1, wherein restricting access by the computer comprises installing program code into an operating system of the computer.

6. The method of claim 1, wherein restricting access by the computer comprises installing program code that modifies the execution of user applications installed on the computer.

7. The method of claim 6, wherein installing program code that modifies the execution of user applications further comprises installing a plug-in for a user application installed on the computer.

8. The method of claim 1, wherein installing program code that modifies the execution of user applications further comprises installing an extension for a user application installed on the computer.

9. The method of claim 1, wherein the restricted access by the computer is revoked based on a policy applicable to the at least one file.

10. The method of claim 1, wherein the restricted access by the computer is revoked based on a time interval.

11. The method of claim 1, wherein the restricted access by the computer is dynamically changed by the program code based on detection of an event.

12. The method of claim 11, wherein the restricted access by the computer is dynamically changed based on the program code receiving an update from an external authority.

13. An external drive that is configured to limit access and use of a file from a first computing device when the external drive is coupled to another computing device, said external drive comprising:

a storage medium for storing at least one file written from the first computing device;

a communications interface; and

a processor, configured by instructions, to identify when a device that is not the first computing device has been coupled to the communications interface, install program code on the other device when it is not the first computing device, and to require the other device to execute the program code to at least restrict the other computing device from copying and saving at least a portion of the file to a location other than the storage medium on the external drive, wherein the program code is installed into an operating system of the computer and comprises a kernel level exception that intercepts file system commands by applications running on the other computing device.

14. The external drive of claim 13, further comprising a memo storing an encryption key, and wherein the processor is configured to encrypt at least a portion of the at the least one file based on the encryption key.

15. The external drive of claim 13, wherein the communications interface comprises a USB interface.

16. A computing device configured with restricted access to a file from another computing device that has been stored on an external drive, said computing device comprising:

a communications interface capable of being coupled to the external drive;

a client application executing on the computing device that is capable of accessing the file from the external drive; and

a processor, configured to;

receive program code from the external device over the communications interface;

install the received program code into an operating system of the computing device, the program code comprising a kernel level exception that intercepts file system commands by applications running on the computing device and

execute the installed program code to restrict the client application from copying and saving at least a portion of the file to a location other than the external drive.

17. The computing device of claim 16, wherein the program code is adapted to further configure the processor to install a plug-in that modifies the execution of the client application.

18. The computing device of claim 16, wherein the program code is adapted to further configure the processor to install an extension that modifies the execution of the client application.

19. The computing device of claim 16, wherein the program code is adapted to further configure the processor to execute an application that embeds the execution of the client application.

20. The computing device of claim 16, wherein the client application communicates via a network with an access control server to determine at least one rule governing the restricted access to the file from the external drive.

21. The computing device of claim 16, wherein the client application communicates with the external drive to retrieve at least one rule governing the restricted access to the file from the external drive.

22. The computing device of claim 16, wherein the client application communicates with the external drive to retrieve information indicating a revocation of access for the computing device to the file from the external drive.

23. The computing device of claim 16, wherein the client application communicates with the external drive to retrieve information indicating a revocation of access for a user of the computing device to the file from the external drive.