Patent Application
20200168016
This patent application claims priority to China Patent Application No. 201811396803.8 filed on Nov. 22, 2018 for Morgan Wu, the entire contents of which are incorporated herein by reference for all purposes.
The subject matter disclosed herein to a data security apparatus and method and in particular, to a computing apparatus and method for securing access to the computing apparatus.
Conventional data storage device secured in a housing in a computing system includes a Self-Encryption Drive (SED) for encrypting the data to prevent unauthorized access in situations where the housing is intruded. No solution is available in known data security apparatuses and methods which is capable of determining access grant to authorized user. It is therefore desirable to provide a data security apparatus which is capable of assessing a nature of attempted access to the data storage device based on predetermined criteria and determine access grant or denial accordingly.
An apparatus for data security apparatus is disclosed. A method and computer program product also perform the functions of the apparatus. In one aspect, the present disclosure provides a computing apparatus comprising a housing, a data storage device disposed in the housing, a cover movably coupled to the housing to secure the data storage device in the housing, and a controller coupled to the data storage device. The controller is configured to grant access to the data storage device upon detecting an authorized attempt of opening the cover and to deny access to the data storage device upon detecting an unauthorized attempt of opening the cover.
In another aspect, the present disclosure provides a method for securing access to a computing device. The method includes detecting an attempt of opening a cover of the computing apparatus having a data storage device disposed therein, and determining a nature of the attempt. Upon the nature being determined as an authorized attempt, access to the data storage device is granted. Upon the nature being determined as an unauthorized attempt, access to the data storage device is denied.
A more particular description of the embodiments briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings. Understanding that these drawings depict only some embodiments and are not therefore to be considered to be limiting of scope, the embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings, in which:
It will be readily understood that the components of the embodiments, as generally described and illustrated in the figures herein, may be arranged and designed in a wide variety of different configurations in addition to the described example embodiments. Thus, the following more detailed description of the example embodiments, as represented in conjunction with the figures, is not intended to limit the scope of the embodiments, as claimed, but is merely representative of example embodiments.
Reference throughout this specification to “one embodiment”, “another embodiment” or “an embodiment” (or the like) means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearance of the phrases “in one embodiment” or “in an embodiment” or the like in various places throughout this specification are not necessarily all referring to the same embodiment.
Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments. One skilled in the relevant art will recognize, that the various embodiments be practiced without one or more of the specific details, or with other methods, components, materials, etc. In other instances, some or all known structures, materials, or operations may not be shown or described in detail to avoid obfuscation.
Aspects of the embodiments are described below with reference to schematic flowchart diagrams and/or schematic block diagrams of methods, apparatuses, systems, and program products according to embodiments. It will be understood that one or more blocks of the schematic flowchart diagrams and/or schematic block diagrams, and combinations of blocks in the schematic flowchart diagrams and/or schematic block diagrams, can be implemented by code. This code may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the schematic flowchart diagrams and/or schematic block diagrams block or blocks.
The code may also be stored in a storage device that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the storage device produce an article of manufacture including instructions which implement the function/act specified in the schematic flowchart diagrams and/or schematic block diagrams block or blocks.
The code may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the code which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
The schematic flowchart diagrams and/or schematic block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of apparatuses, systems, methods and program products according to various embodiments. In this regard, each block in the schematic flowchart diagrams and/or schematic block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions of the code for implementing the specified logical function(s).
It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the Figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. Other steps and methods may be conceived that are equivalent in function, logic, or effect to one or more blocks, or portions thereof, of the illustrated Figures.
Although various arrow types and line types may be employed in the flowchart and/or block diagrams, they are understood not to limit the scope of the corresponding embodiments. Indeed, some arrows or other connectors may be used to indicate only the logical flow of the depicted embodiment. For instance, an arrow may indicate a waiting or monitoring period of unspecified duration between enumerated steps of the depicted embodiment. It will also be noted that each block of the block diagrams and/or flowchart diagrams, and combinations of blocks in the block diagrams and/or flowchart diagrams, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and code.
As used herein, a list with a conjunction of “and/or” includes any single item in the list or a combination of items in the list. For example, a list of A, B and/or C includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C or a combination of A, B and C. As used herein, a list using the terminology “one or more of” includes any single item in the list or a combination of items in the list. For example, one or more of A, B and C includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C or a combination of A, B and C. As used herein, a list using the terminology “one of includes one and only one of any single item in the list. For example, “one of A, B and C” includes only A, only B or only C and excludes combinations of A, B and C. As used herein, “a member selected from the group consisting of A, B, and C,” includes one and only one of A, B, or C, and excludes combinations of A, B, and C.” As used herein, “a member selected from the group consisting of A, B, and C and combinations thereof” includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C or a combination of A, B and C.
As shown in
The controller 130, in some embodiments, is an electronic device integrated to the data storage device 120. In other embodiments, the controller 130 is a separate component disposed in the housing 110 and electrically coupled to the data storage device 120. The controller 130 is configured to grant access to the data storage device 120 by decrypting the data in the data storage device 120, upon detecting an authorized attempt of opening the cover 140, and to deny access to the data storage device 120 by encrypting the data in the data storage device 120, upon detecting an unauthorized attempt of opening the cover 140.
The data security apparatus 100, in some embodiments, includes a lock 150 coupled to the housing 110 and the cover 140, to lock the cover 140 to the housing 110. In some embodiments, the controller 130 is configured such that, upon the lock 150 being unlocked by a key 152, the controller 130 is configured to determine that the key 152 unlocking the lock 150 is an authorized attempt to open the cover 140, which is an operation following a Standard Operation Procedure (SOP). Upon determining the attempt is of an authorized nature, the controller 130 is configured to grant access to the data storage device 120, by decrypting the data in the data storage device 120. Conversely, in other embodiments, if the cover 140 is opened without the key 152 unlocking the lock 150, the controller 130 is configured to determine that the cover 140 is opened without following the SOP, i.e. under an unauthorized attempt, and accordingly the controller 130 is configured to deny access to the data storage device 120, by encrypting the data in the data storage device 120.
The data security apparatus 100, in some embodiments, includes a first switch 160 coupled to the lock 150 and the controller 130. As shown in
As shown in
As shown in Table 1, scenario 1 (SN-1) indicates a situation where no attempt of opening the cover is performed. The first switch 160 and the second switch 180 are both valued “1” i.e. corresponding to “cover locked” and “cover closed” status. The data in the data storage device 120 remains encrypted. In a situation where the cover 140 is forced-open without a key 152 unlocking the cover, as illustrated in Table 1 under “SN-2”, the first switch 160 remains at value “1” indicating a “cover locked” status. In the meantime, the second switch 180 changes the value to “0” indicating that the cover 140 is open. Upon receipt of the value/status of both the first switch 160 with a value of “1” and the second switch 180 with a value of “0,” the controller 130 is configured to determine that the cover is open under an unauthorized attempt and accordingly, the controller 130 is configured to act to deny access to the data storage device 120.
In a situation where the cover is unlocked by a key 152, as illustrated under “SN-3” in Table 1, the first switch 160 changes the value to “0” indicating that the lock 150 is unlocked by the key 152, and sends a first signal 168 to the controller 130. Upon receipt of the first signal 168 from the first switch 160, the controller 130 is configured to determine that an authorized attempt of opening the cover takes place, and to grant access to the data storage device 120 by decrypting the data in the data storage device 120.
The situation under “SN-4” in Table 1 advances further from “SN-3” in that, with the key 152 unlocking the lock 150 and with the cover 140 being opened, so that the second switch 180 changes to a value of “0”, and sends a second signal 188 to the controller 130. In combination with the first signal 168 received from the first switch 160, the controller 130 is configured to determine that the cover-opening attempt is authorized and that the cover is opened both under SOP, and is configured to grant and enable access to the data in the data storage device 120.
According to another embodiment, as shown in
As alternatives of an NFC reader 170, other types of identification devices may be used to couple to the controller 130 and to perform similar operations for user identification. For example, the NFC reader 170 may be replaced with a key pad for password entry, a socket for receiving a dongle, a camera for capturing a barcode/QR code, a fingerprint reader for fingerprint scanning, etc.
In the embodiment shown in
As shown in Table 2, in scenario 1 (SN-1), no attempt of opening the cover is performed. The NFC reader 170, the first switch 160 and the second switch 180 are all valued “1” i.e. corresponding to a “No NFC card presented”, “cover locked” and “cover closed” situation. The data in the data storage device 120 remains encrypted. In a situation where the cover is forced-open without a correct NFC card 172 presented or without a key 152 unlocking the cover, as illustrated in Table 2 under “SN-2”, the NFC reader 170 and the first switch 160 remain at value “1” indicating a “cover locked” status. Under SN-3, the cover is unlocked by a key 152 which changes the first switch 160 value to “0.” Under SN-4, a correct NFC card 172 is presented by which the NFC reader value changes to “0.” SN-2, SN-3 and SN-4 do not satisfy criteria of the controller 130 for an authorized attempt, as at least one of the NFC reader value and the first switch 160 value remains as “1.” Accordingly, regardless of whether the second switch 180 has a value as “1” or “0,” no data access will be granted under SN-2, SN-3 and SN-4.
In a situation where both a correct NFC card 172 is presented and a key 152 unlocks the cover 140, as shown under SN-5, the controller 130 is configured to determine the authorized attempt has been met, and is configured to grant access to the data in the data storage device 120.
The situation under “SN-6” in Table 6 advances further from “SN-5” in that, with the corrected NFC card 172 presented, the key 152 unlocking the lock 150 and with the cover opened, the second switch 180 changes the value to “0”, and sends a second signal 188 to the controller 130. In combination with the acceptance signal 178 received from the NFC reader 170 and the first signal 168 received from the first switch 160, the controller 130 is configured to determine the cover-opening attempt being authorized and cover being opened under SOP, and is configured to grant and enable access to the data in the data storage device 120.
According to yet another embodiment, as shown in
The data security apparatus 200 includes a second switch 280 coupled to the cover 240. The second switch 280 may be a limit switch configured to detect the positional relationship between the cover 240 and the housing 210. Movement of the cover 240 from the closed position at least partially toward the open position will trigger the second switch 280 to generate a second signal transmitted to the controller 230. In combination with the acceptance signal 178 received from the NFC reader 270, the controller 230 performs determination of the nature of attempt of opening the cover, as illustrated in Table 3 below:
As illustrated in Table 3, in scenario 1 (SN-1), no attempt of opening the cover is performed. The NFC reader 270 and the second switch 280 are both valued “1” i.e. corresponding to a “no NFC card presented” and “cover closed” situation. The data in the data storage device 220 remains encrypted. In a situation where the cover is forced-open without an NFC card or a correct NFC card 272 presented, as illustrated in Table 1 under “SN-2”, the NFC reader 270 remains at value “1.” In the meantime, the second switch 280 changes the value to “0” indicating the cover is opened. Upon receipt of the value/status of both the NFC reader 270 with a value of “1” and the second switch 280 with a value of “0,” the controller 230 is configured to determine that the cover 240 is opened under an unauthorized attempt and accordingly, the controller 230 denies access to the data in the data storage device 220.
In a situation where an authorized NFC card 272 is presented, as illustrated under “SN-3”, the NFC reader 270 changes the value to “0” indicating an authorized user's attempt, and sends an acceptance signal to the controller 230. Upon receipt of the acceptance signal from the NFC reader 270, the controller 230 is configured to determine that an authorized attempt of opening the cover 240 takes place, and is configured to grant access to the data in the data storage device 220.
The situation under “SN-4” in Table 3 advances further from “SN-3” in that, with the authorized NFC card 272 presented and the cover 240 opened, the second switch 280 changes the value to “0”, and send a second signal to the controller 230. In combination with the acceptance signal received from the second switch 280, the controller 230 is configured to determine that both the cover-opening attempt is authorized and that the cover 240 is opened under SOP, and is configured to grant and enable access to the data in the data storage device 220.
According to a further embodiment, as shown in
The data security apparatus 300 includes a lock 350 coupled to the housing 310 and the cover 340, to lock the cover 340 to the housing 310, and an identification device e.g. an NFC reader 370 coupled to the controller 330.
A first switch 360 is coupled to the lock 350 and the controller 330. A key 352 unlocking the lock 350 triggers the first switch 360 to generate a first signal 368 which is transmitted to the controller 330. The first signal 368 received by the controller 330 is determined to satisfy a first authorized attempt of opening the cover 340.
Upon detecting the presence of an authorized NFC card 372, the NFC reader 370 send an acceptance signal 378 to the controller 330. The acceptance signal 378 received by the controller 330 is determined to satisfy a second authorized attempt of opening the cover 340.
The controller 330 is configured to grant access to the data storage device 320 upon receipt of both the first signal 368 from the first switch 360 corresponding to a key 352 unlocking the lock 350, and the acceptance signal 378 from the NFC reader 370 corresponding to the presence of an authorized card. Conversely, if any one or both of the first signal 368 and the acceptance signal 378 is not received, the controller 330 is configured to determine an unauthorized attempt of opening the cover, and is configured to deny access to the data in the data storage device 320.
According to a further embodiment, as shown in
The sensor 490 is configured to detect a movement of the housing 410 from a reference location e.g. a data center 90 in which the data security apparatus 400 is deployed. Upon the sensor 490 detecting a movement of the housing 410, e.g. a movement beyond a predetermined distance 490, the sensor 490 is configured to send a third signal 498 to the controller 430. Upon receipt of the third signal 498, the controller 430 is configured to determine that an abnormal situation has taken place, e.g. the data security apparatus 400 being moved away from the data center 90, and is configured to deny access to the data storage device 420 by encrypting the data in the data storage device 420.
The sensor 490 may be a location sensor capable of detecting a position of the housing 410 relative to the location reference 90. Alternatively, the sensor 490 may be a motion sensor such as an accelerometer configured to detect a movement of the housing 410, and to derive a movement distance of the housing 410 based on the acceleration detected.
The embodiment shown in
As used herein, the singular “a” and “an” may be construed as including the plural “one or more” unless clearly indicated otherwise. This disclosure has been presented for purposes of illustration and description but is not intended to be exhaustive or limiting. Many modifications and variations will be apparent to those of ordinary skill in the art. The example embodiments were chosen and described in order to explain principles and practical applications, and to enable others of ordinary skill in the art to understand the disclosure for various embodiments with various modifications as are suited to the particular use contemplated.
Thus, although illustrative example embodiments have been described herein with reference to the accompanying figures, it is to be understood that this description is not limiting and that various other changes and modifications may be effected therein by one skilled in the art without departing from the scope or spirit of the disclosure.
| Number | Date | Country | Kind |
|---|---|---|---|
| 201811396803.8 | Nov 2018 | CN | national |
