Mechanisms to secure data on hard reset of device

• US 8,640,226 B2
• Filed: 06/27/2008
• Issued: 01/28/2014
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Chaturvedi, Pradeep Kumar, Sahoo, Prasanta Kumar
• Primary Examiner(s): Schwartz, Darren B
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US12/147,737
• Publication Number:
  US 20090328131A1
• Time in Patent Office: 2,041 Days
• Field of Search: 726/17, 726/19, 726/34, 713/1
• US Class Current: 726/19
• CPC Class Codes: G06F 11/1441 Resetting or repowering
• CPC Class Codes: G06F 11/1461 Backup scheduling policy
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2201/80 Database-specific techniques

Abstract

Mechanisms to secure data on a hard reset of a device are provided. A hard reset request is detected on a handheld device. Before the hard reset is permitted to process an additional security compliance check is made. Assuming, the additional security compliance check is successful and before the hard reset is processed, the data of the handheld device is backed up to a configurable location.

Claims

1. A machine-implemented method for processing a hard reset operation on a handheld device, comprising:

receiving, via an operating system kernel, the hard reset operation on the handheld device and interacting with hardware of the handheld device to disable all interrupts;

enforcing a configured security policy before permitting the hard reset operation to proceed, wherein enforcing further includes prompting a user of the handheld device to enter authentication credentials defined by the configured security policy before proceeding further with the hard reset operation on the handheld device, the authentication credentials are different from other authentication credentials of the user for access to the handheld device or log on to the handheld device, and the authentication credentials are a secure Personal Identification Number (PIN) that has to be provided within a limited time duration by the user otherwise the interrupts are re-enabled; and

backing up user data held on the handheld device to a different location that is external from the handheld device when the security policy is successfully enforced.

2. The method of claim 1 further comprising, passing the hard reset operation along to a kernel of an operating system to be processed on the handheld device once the user data is backed up.

3. The method of claim 1, wherein receiving further includes receiving, by an application, a notice from a kernel of an operating system of the handheld device that the hard reset operation has been requested on the handheld device.

4. The method of claim 1, wherein enforcing further includes accessing the configured security policy on the handheld device from a location that is not subject to the hard reset operation.

5. The method of claim 1, wherein backing up further includes identifying the location as a removable memory card interfaced to the handheld device or as a remote storage location located over a wide-area network that the handheld device is in communication with.

6. A machine-implemented method, comprising:

identifying an attempt by a resource to perform a hard reset on a handheld device and disabling all interrupts on the handheld device;

requesting additional credentials from the resource to authorize the hard reset; and

verifying the additional credentials before proceeding with the hard reset on the handheld device, the additional credentials are different from other credentials of the resource that the resource has for log on or access to the handheld device, and the authentication credentials are a secure Personal Identification Number (PIN) that has to be provided within a limited time duration by the resource otherwise the interrupts are re-enabled.

7. The method of claim 6 further comprising, backing up resource data from the handheld device to a location that is independent from the handheld device before proceeding with the hard reset on the handheld device.

8. The method of claim 7, wherein backing up further includes backing up the resource data to a remote and external network location.

9. The method of claim 7, wherein backing up further includes backing up the resource data to a removable memory card inserted into the handheld device.

10. The method of claim 6, wherein requesting further includes prompting a user that is identified as the resource to enter an identifier and a password that are assigned to the hard reset.

11. The method of claim 10, wherein prompting further includes identifying the identifier and the password as being associated with an administrator assigned set of credentials that is different from a resource identifier and a resource password used by the user to access the handheld device on startup of the handheld device.

12. A machine-implemented system, comprising:

a hard reset validator implemented in a machine-accessible and readable medium that process on a handheld device; and

a backup service implemented in a machine-accessible and readable medium and to process on the handheld device;

wherein the hard reset validator ensures that additional security compliance is achieved when a hard reset is requested on the handheld device by disabling all interrupts on the handheld device, and wherein when the additional security compliance is achieved the backup service backs up user data located on the handheld device to a different location that is external and independent from the handheld device before the hard reset is processed on the handheld device, the additional security compliance ensures that a user provides different credentials from what the user has to logging into or accessing the handheld device, and the different credentials are a secure Personal Identification Number (PIN) that has to be provided within a limited time duration by the user otherwise the interrupts are re-enabled.

13. The system of claim 12, wherein the additional security compliance is pre-defined as a policy located in a secure area of the handheld device.

14. The system of claim 12, wherein hard reset validator interacts with a user in response to the additional security compliance to acquire an administrator-defined set of credentials that the hard reset validator validates before permitting the hard reset to proceed on the handheld device.

15. The system of claim 12, wherein the hard reset validator is triggered in response to a notification from a kernel process of an operating system for the handheld device that receives the hard reset as an OS interrupt.

16. The system of claim 12, wherein the backup service uses a backup policy to identify types of the user data to backup and to identify the different location for storing the user data.

17. The system of claim 12, wherein when the backup service stores the user data to one or more of the following:

a removable media card interfaced to the handheld device, another device interfaced to the handheld device, and a network storage location located over a wide-area network connection from the handheld device.

18. A machine-implemented system, comprising:

an operating system (OS) kernel implemented in a machine-accessible and readable medium and that processes on a handheld device; and

a hard reset interrupt handler implemented in a machine-accessible and readable medium and to process within the OS kernel of the handheld device;

wherein a kernel process of the OS kernel notifies the hard reset interrupt handler when a hard reset operation is issued on the handheld device and waits for further instruction from the hard reset interrupt handler after notification and disables all interrupts, and wherein the hard reset interrupt handler performs a security compliance check to ensure the hard reset operation is permissible and when it is notifies the kernel process to proceed with the hard reset operation and when it is not notifies the kernel process to ignore the hard reset operation, wherein the hard reset interrupt handler prompts a user of the handheld device for an additional secure Personal identification Number (PIN) in response to the additional security compliance check that are different from an identifier and password of the user to login or access the handheld device, and the secure PIN has to be provided within a limited time duration by the user otherwise the interrupts are re-enabled.

19. The system of claim 18, wherein when the security compliance check indicates that the hard reset operation is permissible and before the hard reset interrupt handler notifies the kernel process, the hard reset interrupt handler backs up data stored on the handheld device.

20. The system of claim 19, wherein the data is backed up to a location that is independent and separate from the handheld device.