Remote access control of storage devices

• US 9,111,103 B2
• Filed: 11/26/2012
• Issued: 08/18/2015
• Est. Priority Date: 06/17/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Sadovsky, Vladimir, Olarig, Sompong Paul, Lionetti, Chris, Hamilton, James Robert
• Primary Examiner(s): CHEUNG, CALVIN K
• Application Number:
  US13/685,179
• Publication Number:
  US 20130125249A1
• Time in Patent Office: 995 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 3/0605 by facilitating the interaction with a user or administrator
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An access control device can be communicationally coupled to a storage device and can control access thereto. The access control device can comprise information, such as identities of authorized entities, to enable the access control device to independently determine whether to provide access to an associated storage device. Alternatively, the access control device can comprise information to establish a secure connection to an authorization computing device and the access control device can implement the decisions of the authorization computing device. The access control device can control access by instructing a storage device to execute specific firmware instructions to prevent meaningful responses to data storage related requests. The access control device can also comprise storage-related cryptographic information utilized by the storage device to encrypt and decrypt data. In such a case, the access control device can control access by not releasing the storage-related cryptographic information to the storage device.

Claims

1. A method of provisioning an access control device comprising:

communicationally coupling the access control device to a provisioning computing device, the access control device having a physical configuration of a memory card;

storing, on the access control device, using the provisioning computing device, a first set of access control information identifying whether the access control device will allow a storage device, to which the access control device will be communicationally coupled, to meaningfully respond to data storage related requests directed to a first set of data that is stored on the storage device; and

storing, on the access control device, using the provisioning computing deice, a second set of access control information, differing from the first set of access control information, identifying whether the access control device will allow the storage device to meaningfully respond to data storage related requests directed to a second set of data that is also stored on the storage device, the second set of data differing from the first set of data;

wherein the access control device comprises one or more processing units that are configured to;

determine whether to allow the storage device to meaningfully respond to the data storage related requests based, at least in part, on the stored first set of access control information or the store second set of access control information.

2. The method of claim 1, wherein at least one of the first set of access control information and the second set of access control information comprise access control cryptographic information for establishing a secure communicational tunnel with an authorization computing device external to the access control device.

3. The method of claim 2, wherein the access control device selectively allows the storage device to meaningfully respond to data storage requests based upon information received from the authorization computing device via the secure communicational tunnel.

4. The method of claim 1, wherein at least one of the first set of access control information or the second set of access control information comprise one or more identities of one or more entities for which the access control device is to enable the storage device to meaningfully respond to data storage related requests from the one or more entities.

5. The method of claim 4, wherein at least one of the first set of access control information or the second set of access control information comprise authentication information associated with at least some of the one or more entities.

6. The method of claim 1, further comprising:

storing, on the access control device, storage-related cryptographic information utilizable by a hardware cryptographic system of the storage device to encrypt data provided to the storage device prior to storing the provided data and to decrypt encrypted data already stored by the storage device;

wherein the access control information is utilized by the access control device to selectively provide access to the storage-related cryptographic information to the hardware cryptographic system of the storage device.

7. The method of claim 6, further comprising:

storing, on the access control device, additional storage-related cryptographic information utilizable by a hardware cryptographic system of another storage device;

wherein the access control information is further utilized by the access control device to selectively provide access to the additional storage-related cryptographic information to the hardware cryptographic system of the other storage device.

8. The method of claim 6, further comprising:

instructing the access control device to delete at least some of the storage-related cryptographic information.

9. The method of claim 1, wherein the access control device comprises a physical connector that is connectable to, and detachable from, a physical receptor that is part of the storage device and that is independent of a physical connection between storage device and a host computing device issuing the data storage related requests to the storage device.

10. The method of claim 1, further comprising:

communicationally coupling the storage device to a host computing device issuing the data storage related requests to the storage device;

receiving, at the host computing device, an indication from the storage device that the access control device is communicationally connected to the storage device;

establishing a communicational connection between the host computing device and the access control device through the storage device;

providing, to the access control device, from the host computing device, identifying information; and

receiving, at the host computing device, meaningful responses to the data storage related requests directed to the storage device after the access control device allows the storage device to do so;

wherein the one or more processing units of the access control device are configured to perform further steps comprising;

determining whether to allow the storage device to provide the meaningful responses based, at least in part, on the provided identifying information.

11. A method of accessing data stored on a storage device comprising:

communicationally coupling the storage device to a host computing device issuing data storage related requests to the storage device;

receiving, at the host computing device, an indication from the storage device that an access control device, having a physical configuration of a memory card, is communicationally connected to the storage device;

establishing a communicational connection between the host computing device and the access control device through the storage device;

providing, to the access control device, from the host computing device, identifying information; and

receiving, at the host computing device, meaningful responses to data storage related requests directed to the storage device after the access control device allows the storage device to do so;

wherein one or more processing units of the access control device are configured to;

determine whether to allow the storage device to provide the meaningful responses based, at least in part, on the provided identifying information.

12. The method of claim 11, wherein the storage device comprises a hardware cryptographic system and the access control device comprises storage-related cryptographic information;

and wherein further the receiving the meaningful responses to the data storage related requests occurs after the access control device provides access to the storage-related cryptographic information to the hardware cryptographic system of the storage device.

13. The method of claim 11, further comprising:

receiving, at the host computing device, an authentication challenge from the access control device, wherein the providing the identifying information to the access control device comprises providing, to the access control device, an authentication response to the authentication challenge.

14. The method of claim 11, further comprising:

receiving, at the host computing device, from the access control device, a first information to be provided to an authentication computing device external to the access control device;

establishing, from the host computing device, a communicational connection with the authentication computing device;

providing, from the host computing device, the first information to the authentication computing device;

receiving, from the authentication computing device, at the host computing device, a second information to be provided to the access control device; and

providing the second information to the access control device from the host computing device;

wherein the access control device determines whether to allow the storage device to provide meaningful responses further based upon the provided second information.

15. The method of claim 14, further comprising:

establishing a communicational connection from the host computing device to a network and receiving, as part of the establishing the communicational connection to the network, a network address of the authorization computing device;

wherein the establishing the communicational connection with the authentication computing device comprises establishing, from the host computing device, a network communicational connection with the authentication computing device utilizing the received network address of the authorization computing device.

16. The method of claim 14, further comprising the steps of:

implementing, on the host computing device, a virtual process to act as the authentication computing device;

wherein the establishing the communicational connection with the authentication computing device comprises establishing a communicational connection with the virtual process.

17. The method of claim 11, further comprising:

loading, on the host computing device, an access control extension, by a storage device driver stack in response to the receiving the indication from the storage device that the access control device is communicationally connected to the storage device;

wherein the access control device extension comprises the computer executable instructions for establishing the communicational connection with the access control device and for providing the identifying information to the access control device.

18. The method of claim 17, further comprising:

establishing a secure communicational connection between the access control device and the storage device, each of the access control device and the storage device being independently communicationally coupled to the host computing device;

wherein the access control device extension further comprises the computer-executable instructions for establishing the secure communicational connection between the access control device and the storage device.

19. A system comprising:

an access control device having a physical configuration of a memory card, the access control device comprising;

one or more processing units that are configured to;

determine whether to allow a storage device, to which the access control device will be communicationally coupled, to meaningfully respond to data storage related requests;

wherein the determining is based, at least in part, on a first set of access control information stored on the access control device or a second set of access control information also stored on the access control device; and

a provisioning computing device comprising;

a communicational coupling to the access control device;

one or more processing units; and

computer-readable storage media comprising computer-executable instructions, which, when executed by the one or more processing units, cause the provisioning computing device to;

store, on the access control device, the first set of access control information, wherein the first set of access control information identifies whether the access control device will allow the storage device, to which the access control device will be communicationally coupled, to meaningfully respond to data storage related requests directed to a first set of data that is stored on the storage device; and

store, on the access control device, the second set of access control information, wherein the second set of access control information differs from the first set of access control information and identifies whether the access control device will allow the storage device to meaningfully respond to data storage related requests directed to a second set of data that is also stored on the storage device, the second set of data differing from the first set of data.

20. The system of claim 19, further comprising:

a host computing device comprising;

a communicational coupling to the storage device;

one or more processing units; and

computer-readable storage media comprising computer-executable instructions, which, when executed by the one or more processing units, cause the host computing device to;

receive an indication from the storage device that an the access control device is communicationally connected to the storage device;

establish a communicational connection between the host computing device and the access control device through the storage device;

provide, to the access control device, identifying information; and

receive meaningful responses to data storage related requests directed to the storage device after the access control device allows the storage device to do so;

wherein the one or more processing units of the access control device are configured to;

determine whether to allow the storage device to provide the meaningful responses based, at least in part, on the provided identifying information.