Patent Application
20090150631
The invention relates generally to protecting to private and confidential information. More particularly, the invention relates to a self-protecting storage device that prevents unauthorized access to information stored on the device.
Protecting sensitive information has become more important as the number of electronic devices such as cell phones, digital cameras, personal digital assistants (PDAs) and personal computers (PCs) continues to increase. Information in the form of data and instructions are stored, for example, in random access memory (RAM) on an electronic device and can include valuable processing techniques or algorithms (e.g., software applications) which can be used to access or process sensitive data. If the device is obtained by an unauthorized user, reverse engineering procedures can sometimes be used to extract the information and to allow the unauthorized user to access other sensitive data. The portability of many electronic devices makes sensitive data stored on the devices particularly susceptible to unauthorized access. For example, personal information stored in a cell phone is at risk when the cell phone is lost or misplaced. The continued migration of personal and payment information into such devices magnifies the problem.
Several techniques are commercially available to protect data saved in flash memory storage devices (e.g., a universal serial bus (“USB”) storage device), namely: (i) the encryption of the stored data, (ii) the creation of a password protection mechanism in the device, and (iii) the addition of a biometric fingerprint reader on the device. While highly effective against weak attack methods, encryption can often be defeated by a determined attacker. Likewise, passwords and fingerprinting provide only modest protection and there have been numerous reports depicting the defeat of password and biometric protected USB drives. Some techniques for bypassing password protection require hardware modifications while other techniques rely on modifications to software device drivers. In the case of fingerprint drives, there are reports of successful circumvention of fingerprint security in a variety of devices, including one report of successful access based on modifications to the software binary so that the drive bypasses the fingerprint scan.
Key problems with the existing protection mechanisms for flash memory devices arise because the protection is enforced using software and hardware that is easily accessible to the attacker, and because the information protection mechanisms do not have an ongoing and sustained process to look for an intrusion event.
What is needed is a method for protecting data and instructions stored in memory devices that overcomes the problems described above.
In one aspect, the invention features a self-protecting storage device. The storage device includes a data storage module and a verification module. The verification module communicates with the data storage module and is adapted to receive access commands from a host system. The verification module is configured to detect a watermark inserted into the access commands by the host system and to determine if the watermark is associated with an authorized attempt to access the data storage module. The verification module enables access to the data storage module if the watermark is determined to be associated with an authorized attempt. In some embodiments, the watermark is a digital signature, a verification code, a predefined relationship between the access commands or the watermark comprises encrypted block addresses included in the access commands.
In another aspect, the invention features a method for accessing a protected storage device. A plurality of commands to access the protected storage device is generated and a watermark is inserted into the access commands. The access commands with the inserted watermark are sent to the protected storage device. Access to the protected storage device is provided if the watermark is determined to be associated with an authorized attempt to access the protected storage device.
The above and further advantages of this invention may be better understood by referring to the following description in conjunction with the accompanying drawings, in which like numerals indicate like structural elements and features in the various figures. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the invention.
A self-protecting storage device according to the invention can be used without the need for changes or modification to systems that use the device. The storage device can be used to protect sensitive information so that if the device lost or misplaced, unauthorized attempts to access information stored on the device are not successful. Using a self-protecting storage device in a mobile electronics device such as a cell phone or digital camera, or in fixed or portable storage devices such as a computer hard drive, USB drive or network drive, provides protection of personal or sensitive information contained on the storage device if the host device is lost or stolen. Self-protection is implemented by adding a watermark to the access commands (e.g., input/output (“I/O”) requests) sent by the host system to the storage device as functionally depicted in
Watermarking can be accomplished in a variety of ways. For example, a digital signature or code can be added to each access command. Alternatively, a watermark can be created by utilizing a predetermined pattern of access or by establishing a specific relationship between the access commands sent to the storage device.
In some embodiments, a specific pattern of access to the self-protecting storage device is matched with an encoding strategy to present a pattern that the storage device can verify. Access patterns to blocks in storage devices of computer systems are well behaved and follow patterns that can be monitored and matched. In general the access patterns are sequential progressions of increasing block addresses that are common across most file systems including file system definition, reformatting, and active use. For example, the block address can be repeatedly incremented by a value of one. In order to make access patterns non-obvious, the self-protecting storage device is configured to obfuscate the access patterns into recognizable but non-obvious patterns known only to the self-protecting storage device and the host systems authorized to access the information in the storage device.
In a preferred embodiment, an encryption scheme is used to encrypt the block addresses of the access commands exchanged between the accessing (host) system and the self-protecting storage device as functionally depicted in
The self-protecting storage device continuously monitors and controls access to the stored information, and controls the ability to store information on the device. In one embodiment, the method used by the self-protecting storage device is implemented within the small computer system interface (SCSI) layer in a block device protocol stack. Consequently, the method is easily utilized in other block storage devices such as integrated drive electronics (IDE) drives, serial advanced technology attachment (SATA) drives, SCSI hard drives, network access storage devices, and other flash storage devices (e.g., compact flash and secure digital (SD) flash devices). Furthermore, because each self-protecting storage device has a unique encryption key, access can be controlled specifically and individually to each unique self-protecting storage device. Methods to share keys between devices can be a configuration time option. Other configurations are possible and may be preferred based on user interests and requirements. For example, a self-protecting storage device can operate with multiple encryption keys so that access is granted and revoked dynamically to individual computer systems. Thus individual system access to the self-protecting storage device can be strictly controlled. Access control policies are updated or revised after determining that the host device or system has been lost, or that a security or employment status change to a user of a specific host device or system has occurred.
Many hard disks, USB storage devices and other computer storage units operate as block storage devices that use SCSI commands to encode direct memory access (DMA) read and write requests. For example, a USB storage device typically includes two main components: a flash storage chip and a micro-controller to interface with a host system.
Once received at the storage device 14, the USB transactions are decoded (step 150) and the block addresses in the access commands are decrypted (step 160) by a decryption module 22. The decrypted block addresses are examined by a verification module 26 to see if they sufficiently match (step 170) a predetermined expected pattern of block addresses for an authorized user. For example, the decrypted block addresses may be compared to the predetermined pattern. Subsequently, if the decrypted block addresses are sufficiently matched to the predetermined pattern, the verification module 26 permits access (step 180) to the protected data in a data storage module (e.g., flash storage chip) 30 to effect the I/O transactions according to the encoded SCSI commands.
If a proper match is not determined, the self-protecting storage device 14 can initiate execution of one or more predetermined functions. For example, a predetermined function can include:
In one embodiment, the self-protecting storage device 14 reports its maximum DMA read/write length to the host system 10. Thus the amount of data accessible on an individual read/write request can be limited, for example, to one block. Consequently, the number of host requests against which pattern matching is performed is increased and therefore the level of security is also increased.
In another embodiment, the comparison of the decrypted block addresses to the predetermined referencing pattern of block addresses is performed as a trust building match process. A saturating counter is used to track the level of trust between the host system 10 and the self-protecting storage device 14. A value generated by the saturating counter indicates the degree to which the decrypted block addresses match the predetermined pattern of block addresses. When the block addresses associated with the received read/write requests are serially progressing, a value of the saturating counter is increased. When block addresses that do not correspond to the serial progression are received, the value of the saturating counter is decreased. Thus higher levels of trust are represented by greater values. The verification module 26 uses the value of the saturating counter to determine which requests are authorized and which requests are unauthorized.
Although self-protection is described above primarily according to a matching of block addresses in received requests to a predetermined (e.g., expected) pattern of block addresses, the invention contemplates that matching can also be based on other attributes of access commands. Such attributes can be, by way of example, a cryptographic signature or a special code added to I/O requests, the relations of the read and write requests, the lengths of DMA transfers, a hidden key field in the access requests, or other referencing patterns and behaviors.
In embodiments described above, the self-protecting storage device stores information at the decrypted block addresses. In an alternative embodiment, the self-protecting storage device does not decrypt block address in write requests. Instead, the information is written to the storage device using the encrypted block addresses and decryption is used to verify that the proper access pattern has occurred. Consequently, a further increase in the level of protection for stored information is achieved.
The encryption keys for a self-protecting storage device can be distributed in a variety of ways. For example, the keys can be managed manually, automatically from a database through secure communications such as a virtual private network (VPN), using special key fobs or through other mechanisms known in the art. Optionally, the keys are captured during connection to a VPN and used remotely for disconnected used while the user is “on travel.” In another option particularly suitable for portable and mobile devices, encryption keys are time-limited or use-limited.
A self-protecting storage device can operate with multiple encryption keys so that access can be granted and revoked dynamically to add or remove access to and from individual computer systems. The ability to award or revoke access to the storage device to individual host systems enables stricter access control policies to be used. Advantageously, a control policy can be revised if the loss or theft of a computer is determined, or when a change in the security or employment status of a user occurs.
It is not a requirement that the encryption key be stored on the host system. Instead, the encryption key can be provided as a “disconnected key” 34 that can be carried by a user in a disconnected device as shown in
In another variation, a self-protecting storage device can be configured to allow unprotected write access and protected read access. Thus the storage device can support covert digital recording (e.g., video recording and/or audio recording) using a generic recording device; however, the reading of the recorded data from the storage device can only be achieved by providing the correct encryption key. Thus the recording device does not require any information regarding how to gain read access to the storage device. In a further variation, the self-protecting storage device can be configured to include false recording data so that an unauthorized access (e.g., “unkeyed access”) attempt to read data from the storage device results in retrieval of false information.
The self-protecting storage device can also be used to protect information in obsolete systems. For example, many companies have difficulty disposing of computers and electronics devices while ensuring that company secrets and confidential information are erased from the associated storage devices. Use of self-protecting storage devices that are configured with unique keys provided by the computers and electronics devices limits access so that the storage device is only useful while it remains with its matched computer or electronics device. For example, a hard drive may be removed from a computer for use in a different computer. Using the removed hard drive in a different host computer causes the self-protecting hard drive to erase or otherwise protect its stored data upon determination of the unauthorized access attempt, thereby protecting any confidential information previously stored on the hard drive.
Finally, self-protecting storage devices provide a means by which certain types of intellectual property can be protected. For example, an MP3 player equipped with a self-protecting storage device can use a unique CPU identifier as its encryption key. Blocks of MP3 data are stored in files on the MP3 player at encrypted addresses corresponding to the key. Thus the MP3 data files are obfuscated in a manner unique to the MP3 player. This technique permits MP3 data files to be distributed to an MP3 player in a manner that is distinct and unique for the particular MP3 player. Copying the MP3 files to another MP3 player is ineffective as the other player uses a different encryption key. Thus music vendors can distribute copy protected MP3 files. Protection of software programs and information against unauthorized copying and access can be achieved in a similar manner.
While the invention has been shown and described with reference to specific embodiments, it should be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.
This application claims the benefit of the filing dates of co-pending U.S. Provisional Application Ser. No. 60/992,751, filed Dec. 6, 2007, titled “Self-Protecting Storage” and co-pending U.S. Provisional Application Ser. No. 61/103,314, filed Oct. 7, 2008, titled “Secure Anti-Tamper Storage Device,” the entireties of which provisional applications are incorporated by reference herein.
| Number | Date | Country | |
|---|---|---|---|
| 60992751 | Dec 2007 | US | |
| 61103314 | Oct 2008 | US |
