Secure disk access control

• US 9,672,374 B2
• Filed: 06/28/2013
• Issued: 06/06/2017
• Est. Priority Date: 10/19/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Teddy, John, Kabra, Atul, Hughes, Michael
• Primary Examiner(s): HO, DAO Q
• Application Number:
  US14/126,880
• Publication Number:
  US 20140310800A1
• Time in Patent Office: 1,439 Days
• Field of Search: 726 4, 713165
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A request is received from a security tool, the request relating to an event involving data records in a storage device. An application programming interface (API) is used to interface with secure storage functionality of the storage device, the secure storage functionality enabling a set of secure storage operations. A security operation is caused to be performed at the storage device involving the data records based at least in part on the request. In one aspect, the set of secure storage operations can include a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

receive, at a disk access security agent, a request from a security tool, the request relating to an event involving data records in a particular one of a plurality of storage devices, wherein each of the plurality of storage devices possesses local secure storage functionality and the disk access security agent has protected access to a common application programming interface (API) to interface with any one of the plurality of storage devices and invoke, through the common API, any one of a set of secure storage operations to be performed locally at the respective storage device, wherein the set of secure storage operations are defined through the common API;

use the common API to interface with secure storage functionality of the particular storage device to invoke a particular one of the set of secure storage operations at the particular storage device based at least in part on the request, wherein the set of secure storage operations comprises a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation,

wherein the copy-on-write operation comprises identifying an attempted write operation of a particular one of the data records and, prior to allowing the attempted write operation, copying data of the one or more data records to a copy-on-write backup location, and

wherein the save-attempted-write operation comprises disallowing an attempted write operation on a first record, causing the write operation to be instead performed on a save-attempted-write (SAW) record, and causing a response to be generated to a read-back request of the particular data record with a false data read incorporating contents of the written-to SAW record.

2. The non-transitory machine accessible storage medium of claim 1, wherein the API facilitates the set of secure storage operations for any one of a host-based secure storage capability, a chipset-based secure storage capability, and the firmware-based secure storage capability.

3. The non-transitory machine accessible storage medium of claim 1, wherein the particular secure storage operation includes a direct read of a particular one of the data records, the instructions further cause the machine to communicate content of the particular data obtained through the direct read to the security tool, and the particular data record is to be rewritten through an instance of the direct write operation.

4. The non-transitory machine accessible storage medium of claim 1, wherein the particular secure storage operation comprises an instance of the copy-on-write operation.

5. The non-transitory machine accessible storage medium of claim 4, wherein causing the particular secure storage operation further comprises causing the particular data record, following the attempted write operation, to be remediated by replacing data of the written-to particular data record with data of the copy-on-write backup.

6. The non-transitory machine accessible storage medium of claim 5, wherein the data of the written-to particular data record is replaced with the data of the copy-on-write backup through a direct write operation.

7. The non-transitory machine accessible storage medium of claim 1, wherein the particular secure storage operation further comprises causing the attempted write operation to be allowed after saving the attempted write operation, and using contents of the SAW record to allow the attempted write operation.

8. The non-transitory machine accessible storage medium of claim 1, wherein the set of secure storage operations includes a false data read operation.

9. The non-transitory machine accessible storage medium of claim 1, wherein the set of secure storage operations includes a data range lockdown operation.

10. The non-transitory machine accessible storage medium of claim 1, wherein the instructions when executed on the machine, further cause the machine to receive feedback data from the secure storage device via the API, wherein the feedback data describes results of the particular secure storage operation.

11. The non-transitory machine accessible storage medium of claim 10, wherein the feedback data is to be included in a callback.

12. The non-transitory machine accessible storage medium of claim 10, wherein the feedback is to be included in a log generated by the secure storage platform.

13. A method comprising:

receiving, at a disk access security agent, a request from a security tool, the request relating to an event involving data records in a particular one of a plurality of storage devices, wherein each of the plurality of storage devices possesses local secure storage functionality and the disk access security agent has protected access to a common application programming interface (API) to interface with any one of the plurality of storage devices and invoke, through the common API, any one of a set of secure storage operations to be performed locally at the respective storage device, wherein the set of secure storage operations are defined through the common API; and

using the common API to interface with secure storage functionality of the particular storage device to invoke a particular one of the set of secure storage operations at the particular storage device based at least in part on the request, wherein the set of secure storage operations comprises a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation,

wherein the copy-on-write operation comprises identifying an attempted write operation of a particular one of the data records and, prior to allowing the attempted write operation, copying data of the one or more data records to a copy-on-write backup location, and

wherein the save-attempted-write operation comprises disallowing an attempted write operation on a first record, causing the write operation to be instead performed on a save-attempted-write (SAW) record, and causing a response to be generated to a read-back request of the particular data record with a false data read incorporating contents of the written-to SAW record.

14. A system comprising:

a processor device;

a secure storage-enabled storage device including logic to perform a set of secure storage operations at records of the storage device, wherein the set of secure storage operations comprises a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation;

a common application programming interface (API) to interface with any one of the plurality of storage devices and define a set of secure storage operations;

a disk access security agent, when executed by the processor device to;

receive a request from a security tool, the request relating to an event involving data records in a particular one of a plurality of secure storage-enabled storage devices, wherein the disk access security agent has protected access to the common API; and

use the common API to interface with secure storage functionality of the particular storage device to invoke a particular one of the set of secure storage operations at the particular storage device based at least in part on the request,

wherein the copy-on-write operation comprises identifying an attempted write operation of a particular one of the data records and, prior to allowing the attempted write operation, copying data of the one or more data records to a copy-on-write backup location, and

wherein the save-attempted-write operation comprises disallowing an attempted write operation on a first record, causing the write operation to be instead performed on a save-attempted-write (SAW) record, and causing a response to be generated to a read-back request of the particular data record with a false data read incorporating contents of the written-to SAW record.

15. The system of claim 14, wherein the set of secure storage operations further comprise an allow write operation, and a block write operation.

16. The system of claim 15, wherein the set of secure storage operations further comprise a false data read operation and a false write success operation.