Mechanisms to secure data on hard reset of device

• US 10,140,463 B2
• Filed: 09/16/2016
• Issued: 11/27/2018
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Inventors: Chaturvedi, Pradeep Kumar, Sahoo, Prasanta Kumar
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gyorfi, Thomas A
• Application Number:
  US15/267,427
• Publication Number:
  US 20170004321A1
• Time in Patent Office: 802 Days
• CPC Class Codes: G06F 11/1441 Resetting or repowering
• CPC Class Codes: G06F 11/1461 Backup scheduling policy
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2201/80 Database-specific techniques

Abstract

Mechanisms to secure data on a hard reset of a device are provided. A hard reset request is detected on a handheld device. Before the hard reset is permitted to process an additional security compliance check is made. Assuming, the additional security compliance check is successful and before the hard reset is processed, the data of the handheld device is backed up to a configurable location.

Claims

1. A method, comprising:

detecting an attempt to process an operation of the operating system;

preventing the operation from processing on a device and forcing execution of a customized hardware interrupt service on the device;

requesting, by the customized hardware interrupt service, an entered credential;

verifying, by the customized hardware interrupt service, the entered credential for the device before passing the operation to the operating system for processing on the device; and

ignoring, by the customized hardware interrupt service, the attempt to process the operation after a time duration during which the entered credential is undetected.

2. The method of claim 1, wherein verifying further includes preventing the operation from being handled by the operating system when the entered credential is invalid.

3. The method of claim 1, wherein verifying further includes recognizing the entered credential as input supplied by a user of the device.

4. The method of claim 1, wherein verifying further includes recognizing the entered credential as a different credential from that which is associated with logging into the device.

5. The method of claim 1, wherein verifying further includes recognizing the entered credential as a same credential as that which is associated with the logging into the device.

6. The method of claim 1, wherein verifying further includes backing up selective data based on data types for data of the device when the entered credential is verified and before passing the operation to the operating system for processing on the device, based on a policy associated with the operation that identifies the data types.

7. The method of claim 6, wherein backing up further includes backing up the selective data to an external network location that is external to the device.

8. The method of claim 7, wherein backing up further includes identifying the external network location from the policy.

9. The method of claim 6;

wherein backing up further includes backing up the selective data to storage located on the device.

10. The method of claim 6, wherein backing up further includes backing up the selective data to storage of a memory device in communication with the device.

11. A method, comprising:

identifying a hard reset device operation that is attempting to process on a device and forcing execution of a customized hardware interrupt service on the device before a kernel process of an operating system (OS) of the device can process the hard reset device operation;

enforcing, by the customized hardware interrupt service that is processing at a highest priority available to a kernel of the OS, a security policy on the device before the hard reset device operation is processed on the device; and

permitting, by the customized hardware interrupt service, the hard reset device operation to process on the device once the security policy is satisfied by passing the hard reset device operation back to the kernel process for processing the reset device operation.

12. The method of claim 11, wherein enforcing further includes obtaining the security policy from an external location that is external to the device.

13. The method of claim 11, wherein enforcing further includes obtaining the security policy from a location that is internal to the device.

14. The method of claim 11, wherein enforcing further includes backing up selective data from the device to an external location that is external to the device once the security policy is satisfied.

15. A system, comprising:

a processor;

a customized hardware interrupt service; and

a validator module, the validated module operable to;

(i) execute on the processor at a highest priority that is available to a kernel of an Operating System being of the processor, (ii) stop execution of an operation associated with the OS by forcing execution of the customized hardware interrupt service on the processor before a kernel process of the OS takes control of the operation for processing, and (iii) validate an entered credential before permitting the operation to be passed to the kernel process.

16. The system of claim 15 further comprising, a backup module, the backup module operable to:

(i) execute on the processor, and (ii) ensure selective data on a device associated with the processor is backed up when the entered credential is validated and before the kernel process handles the operation.

17. The system of claim 16, wherein the backup module is further operable to (iii) backup of the selective data to a location defined by a policy.

18. The system of claim 17, wherein the location is one of:

storage on the device;

storage in an external network location from the device, and storage for a memory device in communication with the device.

19. The system of claim 15, wherein validator module is further operable to (iv) prompt the user to dynamically supply the entered credential.

20. The system of claim 15, wherein the validator module is further operable to (iv) enforce a policy located in a secure area of a device associated with the processor that is inaccessible to the user.