Root of trust assisted access control of secure encrypted drives

Patent metadata

Field	Value
Publication number	US-2020310662-A1
Application number	US-202016832216-A
Country	US
Kind code	A1
Filing date	Mar 27, 2020
Priority date	Apr 1, 2019
Publication date	Oct 1, 2020
Grant date	—

Abstract

A system for data protection includes a computing device comprising a processor, a Hardware Root of Trust (HRoT) module and a storage device. The HRoT device is configured to: validate integrity of the computing device; authenticate the computing device to communicate with the storage device; and take over control of storage device access and behaviour whenever suspicious or unauthorized data access from local or remote computing devices is detected. The HRoT device is further configured to, in response to detecting a security risk to at least one of the computing device and the storage device, block communication of the storage device.

First claim

What is claimed is:

1 . A system for data protection, the system comprising:
a computing device comprising a processor, a Hardware Root of Trust (HRoT) device and a storage device, wherein the HRoT device is configured to:
validate integrity of the computing device;
authenticate the computing device to communicate with the storage device; and
take over control of the storage device in response to detecting a security risk to at least one of the computing device and the storage device.

2 . The system of claim 1 , wherein the HRoT device validates integrity of the computing device by validating one or more of a firmware of the computing device, a firmware of operating system running on the computing device, and a kernel space of the operating system.

3 . The system of claim 1 , wherein the computing device further comprises Software Root of Trust (RoT) instance running on the processor.

4 . The system of claim 1 , wherein the HRoT device provides a Trusted Execution Environment (TEE).

5 . The system of claim 4 , wherein the HRoT device loads and executes a security monitoring application in the TEE.

6 . The system of claim 1 , wherein the HRoT device, in response to detecting a security risk to at least one of the computing device and the storage device, blocks communication of the storage device.

7 . The system of claim 3 , wherein the RoT sends an alert signal to the HRoT device in response to detecting a security attack to at least one of the computing device and the storage device.

8 . The system of claim 1 , wherein the storage device comprises a Secure Encrypted Drive (SED).

9 . The system of claim 1 , wherein the HRoT device controls data hosted on a cloud-based storage service, NAS, and/or SAN storage.

10 . The system of claim 1 , wherein the security risk comprises a suspicious or unauthorized data access from a remote device or from inside of the computing device.

11 . A method of protecting data, comprising:
employing a computing device comprising a processor, a Hardware Root of Trust (HRoT) device and a storage device, wherein the HRoT device performs the steps of:
validating integrity of the computing device;
authenticating the computing device to communicate with the storage device; and
taking over control of the storage device in response to detecting a security risk to at least one of the computing device and the storage device.

12 . The method of claim 11 , wherein the HRoT device validates integrity of the computing device by validating one or more of a firmware of the computing device, a firmware of operating system running on the computing device, and a kernel space of the operating system.

13 . The method of claim 11 , wherein the computing device further comprises Software Root of Trust (RoT) instance running on the processor.

14 . The method of claim 11 , wherein the HRoT device provides a Trusted Execution Environment (TEE).

15 . The method of claim 14 , wherein the HRoT device loads and executes a security monitoring application in the TEE.

16 . The method of claim 11 , wherein the HRoT device, in response to detecting a security risk to at least one of the computing device and the storage device, blocks communication of the storage device.

17 . The method of claim 13 , wherein the RoT sends an alert signal to the HRoT device in response to detecting a security attack to at least one of the computing device and the storage device.

18 . The method of claim 11 , wherein the HRoT device controls data hosted on a cloud-based storage service, NAS, and/or SAN storage.

19 . The method of claim 11 , wherein the security risk comprises a suspicious or unauthorized data access from a remote device or from inside of the computing device.

20 . A system for data protection, the system comprising:
a computing means for validating integrity of a computing device, authenticating the computing device to communicate with the storage device; and taking over control of the storage device in response to detecting a security risk to at least one of the computing device and the storage device.

Assignees

• Raytheon Co

Inventors

• Staab Torsten
• Palmer Nathan T

Classifications

• G06F3/0622 Primary

  in relation to access · CPC title

• G06F3/0637

  Permissions · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title