Regulating access using information regarding a host machine of a portable storage drive

Patent metadata

Field	Value
Publication number	US-9507964-B2
Application number	US-201113327013-A
Country	US
Kind code	B2
Filing date	Dec 15, 2011
Priority date	Dec 1, 2011
Publication date	Nov 29, 2016
Grant date	Nov 29, 2016

Abstract

Described herein are techniques for regulating access to a remote resource using two-factor authentication based on information regarding a host machine of a portable storage drive that stores an operating system that is booted by the host machine. The information regarding the host machine of a portable storage drive may be used as a second factor in a two-factor authentication. Such information regarding the host machine may include, in some embodiments, information retrieved from a secure storage of the host machine, such as from a cryptoprocessor of the host machine. The information may include an identifier for the host machine or may be a user credential pre-provisioned to the host machine to be used in two-factor authentication.

First claim

What is claimed is:

1. An apparatus comprising a portable storage device configured to boot a host machine, the host machine comprising storage storing boot firmware and a host identifier, a processor, a cryptoprocessor, and at least one interface to enable the host machine to communicate with the portable storage device, the portable storage device comprising:
an operating system stored in an encrypted portion of the portable storage device;
an encrypted list of host identifiers;
at least one unencrypted boot sector storing unencrypted computer-executable instructions configured to, when the portable storage device is used as a boot volume for the host machine, be loaded by the firmware from the unencrypted boot sector to the host machine during the single boot of the host machine to enable the host machine to execute the loaded computer-executable instructions during the single boot of the host machine, wherein the computer-executable instructions, when executed by at least one processor of the host machine for the single boot of the host machine, are configured to, when executed by the host machine:
obtain the host identifier from the host machine;
determine whether the host identifier is included in the encrypted list of host identifiers; and
enable decrypting of the operating system, by the cryptoprocessor of the host, from the encrypted portion for booting by the host machine for the single boot of the host machine only when the host identifier is determined to be in the encrypted list of host identifiers, wherein only hosts identified in the encrypted list of host identifiers are permitted to decrypt and boot the operating system based on the encrypted list, the operating system hosting applications to be operated by a user of the host machine while the operating system is executing.

2. The apparatus of claim 1 , wherein decrypting the operating system is further dependent on securing a user credential with key information stored on the portable storage information.

3. The apparatus of claim 1 , wherein the host identifier is stored in encrypted storage of the cryptoprocessor.

4. A method of controlling booting of an operating system encrypted on a portable storage device, the method comprising:
initiating a boot of a host machine and in response the host machine reading an unencrypted boot sector of the portable storage device storing an unencrypted executable component, and in response to reading the unencrypted boot sector loading the executable component from the portable storage device into memory of the host machine;
during the boot, obtaining, by the execution of the executable component loaded from the unencrypted boot sector into the memory of the host machine, a host identifier of the host machine, the host identifier comprising a key that is also stored in the cryptoprocessor of the host;
during the boot, accessing, by continued execution of the executable component, a list of host identifiers stored on the portable storage device;
during the boot, determining, by the continued execution of the executable component, whether the obtained host identifier is included in the accessed list of host identifiers, the executable component allowing, during the boot, decryption, by the host machine, and booting by the host machine, of an encrypted operating system on the portable storage device only if the obtained host identifier is determined to be included in the accessed list of host identifiers, wherein the operating system is decrypted by the cryptoprocessor of the host machine.

5. A method according to claim 4 , wherein the cryptoprocessor comprises a trusted platform module, the trusted platform module comprising a secure storage storing the list of host identifiers.

6. A method according to claim 5 , wherein the host identifier is stored in the secure storage.

7. An apparatus according to claim 1 , wherein the portable storage device comprises a virtual hard disk.

8. An apparatus according to claim 1 , wherein the host machine comprises a virtual machine.

9. An apparatus according to claim 8 , wherein the portable storage device further comprises a virtual hard disk.

10. An apparatus according to claim 1 , wherein the computer-executable instructions are further configured to evaluate stored characteristics of a boot sequence of the host machine to determine that the single boot of the host machine is proceeding securely.

11. An apparatus according to claim 1 , wherein the portable storage device is configured to connect to the host machine through a local bus of the computing device.

12. An apparatus according to claim 11 , wherein the local bus comprises a Universal Serial Bus.

13. An apparatus according to claim 1 , wherein the unencrypted boot sector comprises a boot record used by the firmware to load the operating system.

14. A method according to claim 4 , wherein information in the unencrypted boot sector indicates to the firmware that the executable component needs to be loaded.

15. A method according to claim 4 , wherein the firmware reads data stored in the unencrypted boot sector and based thereon determines that the portable storage device stores the operating system in a secure manner.

16. A method according to claim 4 , wherein the executable component is configured to determine that the host machine does not have permission to access an encrypted portion of portable storage and based thereon generate a prompt useable by a user of the host machine to enter a credential that will authorize the host machine to access the secured encrypted portion of the portable storage drive.

17. A method according to claim 4 , wherein the encrypted operating system is stored on an encrypted portion of the portable storage device.

18. A method according to claim 17 , wherein the encrypted portion further stores a key used by the cryptoprocessor to decrypt the operating system.

19. A method according to claim 18 , wherein the executable component loads the key from the portable storage device and provides the key to the cryptoprocessor that the crypto processor uses to decrypt the encrypted portion of the portable storage device.

Assignees

• Adam Preston Derek
• Vinayak Sai
• Ureche Octavian T
• Thom Stefan
• Soni Himanshu
• Voicu Nicolae
• Microsoft Technology Licensing Llc

Inventors

• Adam Preston Derek
• Vinayak Sai
• Ureche Octavian T
• Thom Stefan
• Soni Himanshu
• Voicu Nicolae

Classifications

• G06F2221/2107

  File encryption · CPC title

• G06F2221/2129

  Authenticate client device independently of the user · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• G06F21/73

  by creating or determining hardware identification, e.g. serial numbers · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title