Cryptographic control for mobile storage means

• US 20090217385A1
• Filed: 05/15/2006
• Published: 08/27/2009
• Est. Priority Date: 05/13/2005
• Status: Active Grant

• Current Assignee: Cryptomill Incorporated
• Original Assignee: Cryptomill Incorporated
• Inventors: Thanos, Daniel, Dainow, Ernest, Teow, Kha Sin, Nikolaev, Leonid
• Granted Patent: US 8,689,347 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system and method that regulates the various operations between computing stations and storage devices. Storage devices are the storage means that are contained upon devices that are able to have data stored upon them. Any operation that involves or may lead to the exchange or accessing of content (data) between a storage device and computing station may be regulated by means of a policy which comprise a set of rules. Rules may be defined according to specific criteria, including the type of storage device, the type of content, the attributes of the content, and other attributes associated with the storage device and/or the content. The policy will be dynamically installed upon a computing station for specific user(s) and will regulate the data operations that may take place between the computing stations and storage devices based on evaluation of the policy. Based on the evaluation of the policy, the requested operation is permitted, restricted in some areas, or denied.

Claims

1. ) A method of regulating the interaction between a computing station and mobile storage means, the method comprising:

a) monitoring one or more interfaces associated with the computing device for operational requests made by the mobile storage means;

b) identifying the operational requests and information associated with the mobile storage means;

c) retrieving a policy that comprises one or more rules associated with the computing station; and

d) evaluating the one or more rules associated with the policy to determine whether the operational request may be granted.

2. ) The method of claim 1, wherein the operational request is selected from the group consisting of:

mount operations, copy operations, delete operations, secure delete operations, read operations, write operations, transmit operations, and execute operations.

3. ) The method of claim 1, wherein the information associated with the mobile storage means is selected from the group consisting of:

a unique identifier, hash of a security domain, hash of a security sub domain, a user ID, an expiry date, a provision date, encryption information, an encryption key, and a signature.

4. ) A method of regulating interaction between a computing station and a mobile storage means, the method comprising:

a) defining a policy for the computing station, wherein the policy comprises one or more allowable operations;

b) associating the policy with the computing station by making the policy accessible to the computing station; and

c) evaluating the policy in response to requested operations from the mobile storage means based on information retrieved from the mobile storage means.

5. ) The method of claim 4, wherein the policy further comprises security domain information.

6. ) The method of claim 4, wherein the policy further comprises security sub domain information.

7. ) The method of claim 4, wherein the requested operations are selected from the group consisting of:

mount operations, copy operations, delete operations, secure delete operations, read operations, write operations, transmit operations, and execute operations.

8. ) The method of claim 4, wherein information retrieved from the mobile storage means includes security domain information.

9. ) The method of claim 4, wherein information retrieved from the mobile storage means includes security sub domain information.

10. ) The method of claim 4, wherein information retrieved from the mobile storage means includes provisioning information.

11. ) A computing device having access to computer program code, wherein when executed, configures the computing device to:

a) restrict the operations that may take place between a computing device and a mobile storage means;

b) monitor one or more interfaces associated with the computing device to detect operational requests made by or to the mobile storage means; and

c) enforce one or more rules associated with a policy that regulates the interaction between the computing device and the mobile storage means.