REMOTE ACCESS CONTROL OF STORAGE DEVICES

• US 20100325736A1
• Filed: 06/17/2009
• Published: 12/23/2010
• Est. Priority Date: 06/17/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Sadovsky, Vladimir, Hamilton, James Robert, Olarig, Sompong Paul, Lionetti, Chris
• Granted Patent: US 8,321,956 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 3/0605 by facilitating the interaction with a user or administrator
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An access control device can be communicationally coupled to a storage device and can control access thereto. The access control device can comprise information, such as identities of authorized entities, to enable the access control device to independently determine whether to provide access to an associated storage device. Alternatively, the access control device can comprise information to establish a secure connection to an authorization computing device and the access control device can implement the decisions of the authorization computing device. The access control device can control access by instructing a storage device to execute specific firmware instructions to prevent meaningful responses to data storage related requests. The access control device can also comprise storage-related cryptographic information utilized by the storage device to encrypt and decrypt data. In such a case, the access control device can control access by not releasing the storage-related cryptographic information to the storage device.

Claims

1. One or more computer-readable media comprising computer-executable instructions for provisioning a access control device used in conjunction with a storage device, the computer-executable instructions directed to steps comprising:

storing, on the access control device, access control information utilized by the access control device in selectively enabling the storage device to meaningfully respond to data storage related requests.

2. The computer-readable media of claim 1, wherein the computer-executable instructions for storing the access control information on the access control device comprise computer-executable instructions for storing, on the access control device, access control cryptographic information for establishing a secure communicational tunnel with an authorization computing device external to the access control device.

3. The computer-readable media of claim 1, wherein the computer-executable instructions for storing the access control information on the access control device comprise computer-executable instructions for storing, on the access control device, one or more identities of one or more entities for which the access control device is to enable the storage device to meaningfully respond to data storage related requests from the one or more entities.

4. The computer-readable media of claim 2, comprising further computer-executable instructions directed to storing, on the access control device, storage-related cryptographic information utilized by a hardware cryptographic system of the storage device to encrypt data provided to the storage device prior to storing the provided data and to decrypt encrypted data already stored by the storage device;

wherein the access control information is utilized by the access control device in selectively providing access to the storage-related cryptographic information to the hardware cryptographic system of the storage device.

5. The computer-readable media of claim 4, comprising further computer-executable instructions for storing, on the access control device, additional storage-related cryptographic information utilized by another storage device;

wherein the computer-executable instructions for storing the access control information on the access control device comprise computer-executable instructions for storing, on the access control device, additional access control information utilized by the access control device in selectively providing the additional storage-related cryptographic information to the other storage device.

6. One or more computer-readable media comprising computer-executable instructions for accessing data stored on a storage device comprising a communicational connection to a access control device comprising access control information, the computer-executable instructions directed to steps comprising:

receiving an indication from the storage device that the access control device is communicationally connected to the storage device;

establishing a communicational connection with the access control device through the storage device;

providing, to the access control device, identifying information; and

receiving meaningful responses to data storage related requests after the access control device allows the storage device to do so at least in part because of the provided identifying information.

7. The computer-readable media of claim 6, wherein the storage device comprises a hardware cryptographic system and the access control device comprises storage-related cryptographic information;

and wherein further the receiving the meaningful responses to the data storage related requests occurs after the access control device provides access to the storage-related cryptographic information to the hardware cryptographic system of the storage device.

8. The computer-readable media of claim 6, comprising further computer-executable instructions for receiving an authentication challenge from the access control device, wherein the computer-executable instructions for providing identifying information to the access control device comprise computer-executable instructions for providing, to the access control device, an authentication response to the authentication challenge.

9. The computer-readable media of claim 6, comprising further computer-executable instructions for:

receiving, from the access control device, a first information to be provided to an authentication computing device external to the access control device;

establishing a communicational connection with the authentication computing device;

providing the first information to the authentication computing device;

receiving, from the authentication computing device, a second information to be provided to the access control device; and

providing the second information to the access control device.

10. The computer-readable media of claim 9, comprising further computer-executable instructions for:

establishing a communicational connection to a network and receiving, as part of the establishing the communicational connection to the network, a network address of the authorization computing device;

wherein the computer-executable instructions for establishing the communicational connection with the authentication computing device comprise computer-executable instructions for establishing a network communicational connection with the authentication computing device utilizing the received network address of the authorization computing device.

11. The computer-readable media of claim 9, comprising further computer-executable instructions for implementing a virtual process to act as the authentication computing device;

wherein the establishing the communicational connection with the authentication computing device comprises establishing a communicational connection with the virtual process.

12. The computer-readable media of claim 6 wherein a access control device extension comprises the computer executable instructions for establishing the communicational connection with the access control device and for providing the identifying information to the access control device, the access control device extension being loaded by a storage device driver stack in response to the receiving the indication from the storage device that the access control device is communicationally connected to the storage device.

13. A access control device, physically and communicationally separable from a storage device, the access control device comprising:

at least one communicational interface;

at least one processing unit; and

access control information utilizable by the at least one processing unit to selectively enable the storage device to meaningfully respond to data storage related requests.

14. The access control device of claim 13, further comprising storage-related cryptographic information utilizable by a hardware cryptographic system of the storage device to decrypt encrypted data stored by the storage device;

wherein the access control information is further utilizable by the at least one processing unit to selectively provide the storage-related cryptographic information to the storage device.

15. The access control device of claim 14, wherein specific ones of the storage-related cryptographic information are utilizable by the hardware cryptographic system to decrypt only portions of the encrypted data of the storage device, the portions corresponding to individual users;

wherein the access control information comprises identifications of the individual users; and

wherein further the at least one processing unit causes the provision of at least some of the specific ones of the storage-related cryptographic information if the at least one processing unit receives authentication from at least some of the individual users as specified by the access control information.

16. The access control device of claim 14, further comprising instructions executable by the at least one processing unit to erase the storage-related cryptographic information.

17. The access control device of claim 13, wherein the access control information comprises one or more identities of one or more entities for which the processing unit is to enable the storage device to meaningfully respond to data storage related requests from the one or more entities.

18. The access control device of claim 13, wherein the at least one processing unit performs steps comprising:

receiving identity information and authentication information from an entity;

comparing the received identity information to the access control information;

if the received identity information is listed in the access control information, comparing the received authentication information to a corresponding authentication information listed in the access control information; and

if the received authentication information matches the corresponding authentication information listed in the access control information, instructing the storage device to meaningfully respond to the data storage related requests by performing actions requested by the data storage related requests.

19. The access control device of claim 13, wherein the access control information comprises access control cryptographic information for establishing a secure communicational tunnel with an authorization computing device external to the access control device.

20. The access control device of claim 19, wherein the at least one processing unit performs steps comprising:

utilizing the access control cryptographic information to establish the secure communicational tunnel with the authorization computing device;

providing, to the authorization computing device, through the secure communicational tunnel, information regarding entities associated with an attempted access of the encrypted data;

receiving, from the authorization computing device, through the secure communicational tunnel, an indication regarding the enabling of the storage device to meaningfully respond to the data storage related requests; and

selectively enabling the storage device to meaningfully respond to the data storage related requests in accordance with the indication received from the authorization computing device.