METHOD AND SYSTEM FOR SECURELY IDENTIFYING COMPUTER STORAGE DEVICES

• US 20100071030A1
• Filed: 12/21/2005
• Published: 03/18/2010
• Est. Priority Date: 12/30/2004
• Status: Active Grant

• Current Assignee: Supercom IP LLC
• Original Assignee: Safend Ltd.
• Inventors: Hazama, Hay, Rosenan, Avner, Gutterman, Zvi, Gan, Orli
• Granted Patent: US 8,271,790 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

In a private network setting in which various computers can be attached, the confidential or sensitive data within the various devices on the private network is vulnerable. The ability to copy such confidential or sensitive data to a storage device communicatively coupled to a client computer on the network is governed and controlled. Only devices that include an authentic stamp or digital certificate can be accessed by client computers. If a device does not have a valid stamp or the stamp has been black listed, then the access to the device can be prevented or greatly limited.

Claims

1. A method for securely controlling access of devices that are capable of storing data, the method comprising the steps of

uniquely identifying a device;

and

applying a security policy that is based at least in party on the unique identification.

2. The method of claim 1, wherein the step of uniquely identifying the device comprises utilizing a unique digital certificate for each device.

3. The method of claim 1, wherein the step of uniquely identifying the device is performed within a network setting.

4. The method of claim 3, wherein the devices are associated with a client device that includes a client agent, and the client device is associated with a server running a security manager module, and wherein the step of uniquely identifying the device comprises the client agent extracting identification information from the device and providing the identifying information to the security manager module.

5. The method of claim 4, further comprising the steps of:

the security manager module;

creating a unique digital certificate; and

storing the unique digital certificate within the devices; and

wherein the step of uniquely identifying the device comprises the steps of;

the client agent extracting the digital certificate from the device; and

checking the validity of the digital certificate of the device.

6. The method of claim 1, wherein the step of applying the security policy comprises performing one or more of the following actions:

blocking access to the device;

enabling access to the device;

disabling all writing operations to the device; and

logging that the device was introduced to the client agent.

7. The method of claim 5, wherein the step of creating a unique digital certificate comprises creating an unchangeable signature S1.

8. The method of claim 7, wherein creating the unchangeable signature S1 comprises the steps of:

obtaining parameters P associated with the device;

obtaining a name N representing an ascription;

obtaining a unique identification value I; and

signing the values of P, N, and I for generating the unchangeable signature S1.

9. The method of claim 8, further comprising:

obtaining a time variable Time;

encrypting a function of the P, N, I, and Time values with a symmetric key K to generate a first portion of a signature S1;

encrypting the symmetric key K with a shared key to generate a second portion of a signature S1; and

combining these two portions along with the value of N, I and Time into a signature S1.

10. The method of claim 9, further comprising generating a second signature S2.

11. The method of claim 10, wherein generating a second signature S2 comprises the steps of:

obtaining a sequence number Q;

obtaining a date D; and

encrypting the values of Q and D using the symmetric key K to obtain the signature S2.

12. The method of claim 3, further comprising:

sending a log to the server, said log including information on the usage of the device.

13. The method of claim 12, wherein the information on the usage of the device includes at least one parameter selected from the group consisting of date and time of usage, the identification value I, and the sequence number Q.

14. The method of claim 12, wherein the server is adapted to analyze the information on the usage of the device and determine whether the device is a forged device.

15. The method of claim 10, wherein the step of providing at least a portion of a value related to or derived from the digital certificate to the security manager module comprises the steps of:

decrypting the second portion of the signature S1 to obtain the symmetric key K;

decrypting the first portion of the signature Si with the symmetric key K to obtain a first value function of the P, N, I, and Time values;

extracting parameters P′

from the device;

generating a value represented by a second value function of P′

, N, I, and Time;

if the first value function and the second value function are equivalent, applying an appropriate security policy.

16. The method of claim 15, wherein if the first value function and the second value function are not equivalent, applying a default security policy.

17. The method of claim 16, further comprising the step of updating the value of S2 upon accessing the device.

18. The method of claim 1, further comprising the step of maintaining a log of usage of the device.

19. The method of claim 1, further comprising the steps of:

creating a unique digital certificate;

storing the unique digital certificate within the devices; and

wherein the step of uniquely identifying a device comprises extracting the digital certificate.

20. A system for securely controlling access to memory storage devices existing or introduced into a network setting, the system comprising:

a server housing a security manager module;

a plurality of client devices coupled to the server through a network;

wherein the security manager module is operable to;

control access to the each of the plurality of client devices contingent at least in part upon said client device being associated with a client agent; and

apply a security policy related to accessing the storage device based at least in part on the identification information.

21. The system of claim 20, wherein the client agent is operable to:

detect a memory storage device communicatively coupled to the client device;

extract information from the memory storage device that uniquely identifies the memory storage device; and

validate the identification information that uniquely identifies the memory storage device.

22. The system of claim 21, wherein the client agent is further operable to provide the information to the security manager module.

23. The system of claim 21, wherein the security policy can be used to determine one or more actions selected from the group consisting of:

blocking access to the memory storage device;

enabling access to the memory storage device;

disabling all writing operations to the memory storage device; and

logging that the specific memory storage device was introduced to the client agent.

24. The system of claim 20, wherein the security policy can be used to perform one or more actions comprising the actions of:

blocking access to the memory storage device;

enabling access to the memory storage device;

disabling all writing operations to the memory storage device; and

logging that the specific memory storage device was introduced to the client agent.

25. The system of claim 24, wherein the client agent is software embedded within the client device.

26. The system of claim 24, wherein the client agent is hardware embedded within the client device.

27. The system of claim 20, wherein the server includes a stamping module, the stamping module being operable to:

detect the connection of the memory storage device to the server;

obtain one or more parameters from the storage device;

generate a digital certificate based at least in part on the one or more parameters; and

store the digital certificate within the memory storage device.

28. The system of claim 27, wherein the stamping module is further operable to receive additional data and is operable to generate the digital certificate based at least in part on the additional data.

29. A method for protecting transferring of data between one or more client computers and one or more external devices, wherein the one or more client computers are clients of a private network that includes a security server, the method comprising the steps of:

a. connecting an external device to one of the one or more client computers;

b. searching for a digital certificate that was previously written on the external device and was generated by the security server;

if the digital certificate was not found, then limiting the transfer of data to or from the external device, if the digital certificate exist proceeding to step c;

c. processing the digital certificate and determining what type of data

transferring is allowed between the external device and the client computer; and

d. controlling the data transfer according to the processed decision.

30. A method of controlling access to storage devices to a system comprising:

determining a level of access to a storage device based on a security policy, said security policy based at least in part on a unique identifier previously stored on said storage device.

31. The method of claim 30, further comprising storing on said storage device said unique identifier.

32. The method of claim 31, wherein said unique identifier is stored on said storage device by a security server.

33. The method of claim 32, wherein said security policy is provided to by said security server to a client agent.

34. The method of claim 33, wherein said step of determining a level of access based on said security policy is performed by said client agent.

35. The method of claim 30, wherein determining access comprises enabling or blocking access to said storage device.

36. The method of claim 30, wherein determining access comprises performing an action selected from the list consisting of:

blocking access to the storage device;

enabling access to the storage device; and

disabling all writing operations to the storage device.

37. The method of claim 36, further comprising logging the access to the storage device by the client agent.