Method and apparatus for centrally managed encrypted partition

• US 20080107262A1
• Filed: 11/02/2006
• Published: 05/08/2008
• Est. Priority Date: 11/02/2006
• Status: Active Grant

• Current Assignee: Sap Portals Israel Ltd (SAP SE)
• Original Assignee: Sap Portals Israel Ltd (SAP SE)
• Inventors: Shribman, Aidan, Helfman, Nadav Binyamin
• Granted Patent: US 8,396,214 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss

Abstract

A method and apparatus for protecting a remote computer connected through a network to a main computer, by creating a cryptokey on the main computer, supplying the cryptokey to the remote computer and mounting a partition on the remote computer using the cryptokey. The cryptokey is not persistently stored on the remote computer but rather saved in its memory, and the connection of the remote computer to the main computer is periodically tested. Once the remote computer is disconnected, the encrypted partition is unmounted and the cryptokey is erased form the memory, thus disabling access of an attacker to data stored in the encrypted partition. The method incorporates swap partition encryption using a cryptokey created each time during the boot of the remote computer.

Claims

1. In a computer network comprising an at least one main computer comprising a first storage device and an at least one remote computer comprising a memory unit and a second storage device, a method for protecting data stored on the second storage device of the at least one remote computer, the method comprising the steps of:

creating a first cryptokey;

storing the first cryptokey on the first storage device of the at least one main computer;

authenticating the at least one remote computer to the at least one main computer;

providing the first cryptokey to the at least one remote computer;

storing the first cryptokey in the memory unit of the at least one remote computer; and

mounting an operative partition encrypted with the first cryptokey to the at least one remote computer, said operative partition mapped to the second storage device, whereby said data stored on said second storage device is accessible only if said at least one remote computer is authenticated by said at least one main computer.

2. The method of claim 1 further comprising the steps of:

creating a second cryptokey;

creating a swap partition encrypted with the second cryptokey on a hard disk of the at least one remote computer; and

mounting the swap partition on the at least one remote computer.

3. The method of claim 1 further comprising the steps of:

testing whether the at least one remote computer is connected to the at least one main computer; and

unmounting the operative partition and erasing the first cryptokey from the memory unit of the at least one remote computer, if the at least one remote computer is not connected to the at least one main computer.

4. The method of claim 1 wherein the authentication step comprises considering an at least one rule.

5. The method of claim 4 wherein the at least one rule relates to one or more or the group consisting of:

when was the at least one remote computer disconnected from the network;

a user of the at least one remote computer;

or an intended use of the at least one remote computer.

6. The method of claim 2 wherein the swap partition is created and mounted during each boot sequence of the at least one remote computer.

7. An apparatus for protecting data stored on a storage device associated with an at least one remote computer connected through a network to an at least one main computer, the apparatus comprising:

a cryptokey generator for generating an at least one cryptokey;

a partition generating component for generating an at least one encrypted partition using the at least one cryptokey;

a mount/unmount device for mounting or unmounting the at least one encrypted partition to the at least one remote computer using the at least one cryptokey, said at least one encrypted partition mapped to the storage device;

a connection testing component for testing whether the at least one remote computer is connected to the at least one main computer through the network; and

an authentication component for determining whether the at least one remote computer is authenticated for being connected to the at least one main computer.

8. The apparatus of claim 7 wherein the at least one encrypted partition is a swap partition.

9. The apparatus of claim 7 wherein the cryptokey generator is run by the at least one remote computer.

10. The apparatus of claim 7 wherein the at least one encrypted partition is an operative partition.

11. The apparatus of claim 7 wherein the cryptokey generator is run by the at least one main computer.

12. A computer readable storage medium containing a set of instructions for a general purpose computer, the set of instructions comprising:

creating a first cryptokey;

storing the first cryptokey on a first storage device of an at least one main computer;

authenticating an at least one remote computer to the at least one main computer;

providing the first cryptokey to the at least one remote computer;

storing the first cryptokey in a memory unit of the at least one remote computer; and

mounting an operative partition encrypted with the first cryptokey to the at least one remote computer, said operative partition mapped to a second storage device storing data whereby said data is accessible only if said at least one remote computer is authenticated by said at least one main computer.