Method and apparatus for securing computer mass storage data

• US 9,424,443 B2
• Filed: 08/20/2013
• Issued: 08/23/2016
• Est. Priority Date: 08/20/2013
• Status: Active Grant

• Current Assignee: Janus Technologies, Inc.
• Original Assignee: Janus Technologies, Inc.
• Inventors: Wang, Michael, Porten, Joshua, Raskin, Sofin, Borisov, Mikhail
• Primary Examiner(s): Rojas, Midys
• Application Number:
  US13/971,732
• Publication Number:
  US 20150058587A1
• Time in Patent Office: 1,099 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 12/14 Protection against unauthorised use of memory or access to memory
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1416 by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights G06F12/1458 takes precedence
• CPC Class Codes: G06F 12/1425 the protection being physical, e.g. cell, word, block
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 12/16 Protection against loss of memory contents contains no material, see G06F11/00
• CPC Class Codes: G06F 13/4282 on a serial bus, e.g. I2C bus, SPI bus on daisy chain buses G06F13/4247
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2213/0032 Serial ATA [SATA]
• CPC Class Codes: G06F 3/0614 Improving the reliability of storage systems
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/062 Securing storage systems
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0661 Format or protocol conversion arrangements
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

In general, embodiments of the invention include methods and apparatuses for securely storing computer system data. Embodiments of the invention encrypt and decrypt SATA data transparently to software layers. That makes it unnecessary to make any software modifications to the file system, device drivers, operating system, or application. Encryption key management is performed either remotely on a centralized Remote Management System or locally. Embodiments of the invention implement background disk backups using snapshots. Additional security features that are included in embodiments of the invention include virus scanning, a virtual/network drive, a RAM drive and a port selector that provides prioritized and/or background access to SATA mass storage to a secure subsystem.

Claims

1. A system for securely storing computer system data comprising:

a mass storage device;

a host processor system that executes an operating system and applications that produce and use host data stored on the mass storage device; and

a secure subsystem that performs one or more security functions on the host data transparently to and independently from the host processor, and wherein the secure subsystem further produces and uses secure data stored on the mass storage device, and wherein the secure subsystem controls access to the mass storage device such that the host processor system is unable to access the secure data,

wherein the host processor system includes a SATA host and the mass storage device comprises a SATA device, and wherein the secure subsystem includes a SATA complex that is interposed between the SATA host of the host processor system and the SATA device comprising the mass storage device, wherein the SATA complex includes a SATA device core that communicates with the SATA host of the host processor system.

2. A system according to claim 1, further comprising a remote management system that communicates with the secure subsystem via a network.

3. A system according to claim 2, wherein the remote management system manages keys for encrypting and decrypting the host data stored on the mass storage device.

4. A system according to claim 2, wherein the remote management system manages performing snapshots of the host data stored on the mass storage device.

5. A system according to claim 1, wherein the security functions include virus scanning.

6. A system according to claim 5, wherein the secure subsystem includes a remote management interface that communicates with a remote management system via a network, wherein the remote management interface receives identifying information about viruses from the remote management system for use in the virus scanning.

7. A system according to claim 1, wherein the secure subsystem includes a port selector for controlling an input and output of the host and secure data on the mass storage device.

8. A system according to claim 7, wherein the port selector chooses to input either the host data from the host processor system or the secure data from the secure subsystem.

9. A system according to claim 7, wherein the port selector chooses to output the host data to either the mass storage device, a RAM drive included in the secure subsystem, or a virtual drive, transparently to and independently from the host processor system.

10. A system according to claim 7, wherein the port selector enables prioritized access to the mass storage device by either the host processor system or the secure subsystem.

11. A system according to claim 1, wherein the secure subsystem includes a port multiplier for providing a host drive interface in the host processor system access to a plurality of drives.

12. A system according to claim 11, wherein the plurality of drives include one or more of a hard drive, a solid state drive, a RAM drive, a virtual drive, and a snapshot drive.

13. A system according to claim 1, further comprising a volatile memory, wherein the secure subsystem includes a RAM drive controller coupled to the volatile memory for providing the host processor system access to a RAM drive in the volatile memory transparently to and independently from the host processor system.

14. A system according to claim 1, further comprising a remote management system interface coupled to a network, wherein the secure subsystem includes a virtual drive controller coupled to the remote management system interface for providing the host processor system access to a virtual drive on the network transparently to and independently from the host processor system.

15. A system according to claim 1, wherein the secure subsystem includes a snapshot manager that provides the host processor system access to one of a plurality of stored snapshots of the host data on the mass storage device.

16. A system according to claim 1, further comprising a motherboard to which the host processor and the secure subsystem are commonly attached.