Protected device management

• US 9,426,147 B2
• Filed: 08/22/2014
• Issued: 08/23/2016
• Est. Priority Date: 12/21/2009
• Status: Active Grant

• Current Assignee: SK Hynix NAND Product Solutions Corporation (SK Hynix Inc.)
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned M., Moore, Victoria C., Grobman, Steven L.
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US14/466,447
• Publication Number:
  US 20140366116A1
• Time in Patent Office: 732 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0632 by initialisation or re-initialisation of storage systems
• CPC Class Codes: G06F 3/0671 In-line storage system
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A method, apparatus, system, and computer program product for management of storage devices protected by encryption, user authentication, and password protection and auditing schemes in virtualized and non-virtualized environments.

Claims

1. A computer-implemented method comprising:

authenticating first credentials of a user of a system before access is allowed to any device of a plurality of devices attached to the system;

intercepting an event indicating a hot-plug attachment of a new device to the system, wherein the intercepting is performed by firmware in a secure partition of the system, and the secure partition is isolated from a host operating system of the system;

requesting second credentials to access the new device using the firmware to establish trusted path connections to a display device to display a request for the second credentials and a user input device to receive the second credentials, wherein the second credentials are requested by the firmware without rebooting the system;

authenticating the second credentials;

enabling access to the new device after authenticating the second credentials; and

delivering a hot plug event for the new device from the secure partition to the host operating system.

2. The method of claim 1, wherein enabling access to the new device comprises using a native command for the device to enable decryption of the new device.

3. The method of claim 1, wherein the second credentials comprise a password for the new device;

and

enabling access to the new device comprises using the password to unlock the new device.

4. The method of claim 1, wherein the second credentials comprise a user identifier;

and

enabling access to the new device comprises providing the user identifier to a trusted third party and enabling access to the new device if the trusted third party authenticates the user identifier.

5. An apparatus comprising:

at least one processor;

a secure partition isolated from a host operating system executing on the processor; and

a memory comprising instructions for firmware executing in the secure partition to perform the following;

authenticating first credentials of a user of a system before access is allowed to any device of a plurality of devices attached to the system;

intercepting an event indicating a hot-plug attachment of a new device to the system, wherein the intercepting is performed by the secure partition;

requesting second credentials to access the new device using the firmware to establish trusted path connections to a display device to display a request for the second credentials and a user input device to receive the second credentials, wherein the second credentials are requested by the firmware without rebooting the system;

authenticating the second credentials;

enabling access to the new device after authenticating the second credentials; and

delivering a hot plug event for the new device from the secure partition to the host operating system.

6. A computer program product comprising:

a non-transitory computer-readable storage medium; and

instructions in the computer-readable storage medium, wherein the instructions, when executed in a secure partition of a processing system, cause firmware executing in the secure partition to perform operations comprising;

authenticating first credentials of a user of a system before access is allowed to any device of a plurality of devices attached to the system;

intercepting an event indicating a hot-plug attachment of a new device to the system, wherein the intercepting is performed by the secure partition, and the secure partition is isolated from a host operating system of the system;

requesting second credentials to access the new device using the firmware to establish trusted path connections to a display device to display a request for the second credentials and a user input device to receive the second credentials, wherein the second credentials are requested by the firmware without rebooting the system;

authenticating the second credentials;

enabling access to the new device after authenticating the second credentials; and

delivering a hot plug event for the new device from the secure partition to the host operating system.