Trusted Agent Storage Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing portability and exchangeability of hardware storage devices pose security risks, as they can transfer infections and unauthorized data access, and existing solutions either compromise security or restrict the convenience of these devices.
Innovation Solution
A method involving an agent software component that authenticates hardware storage devices using a unique identifier, encrypts data with a secure key accessible only in an unrestricted processor mode, and communicates with an authorization system to manage access permissions, ensuring secure data storage and transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If exchangeable hardware storage devices are allowed to be mounted and accessed freely, then data transfer convenience and user accessibility are improved, but security risks including infections, unauthorized data access, and data loss increase
Solution Approach 1:
The patent introduces a file system layer as an intermediary between user applications and the hardware storage device. This file system implements authentication mechanisms and access control policies, acting as a mediator that allows convenient data transfer while filtering out security risks. The file system validates devices before mounting and enforces policies that prevent unauthorized access and infection propagation.
Solution Approach 2:
The patent implements preliminary authentication and policy enforcement before the storage device is mounted and made accessible to applications. The system authenticates the device, retrieves applicable policies, and configures the file system with these policies in advance. This preliminary action ensures that security measures are in place before any data transfer occurs, preventing both convenience loss and security breaches.
2Object-affected harmful factors
If storage devices are authenticated and access is controlled through policies, then security against unauthorized access and infections is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent implements a self-service authentication mechanism where the file system automatically authenticates storage devices and retrieves policies without requiring manual user intervention. The system autonomously manages the authentication process, policy retrieval, and enforcement configuration. This self-service approach reduces complexity by eliminating manual security management steps while maintaining robust access control.
Solution Approach 2:
The patent creates a universal file system layer that handles multiple security functions including authentication, policy retrieval, policy enforcement, and infection prevention through a single integrated mechanism. This multi-functional approach reduces overall system complexity by consolidating what could be separate complex systems into one unified file system that performs all security-related operations.
3Object-affected harmful factors
If scanning for infections is performed before mounting storage devices, then protection against malware and viruses is improved, but the mounting process is delayed and user convenience is reduced
Solution Approach 1:
The patent performs infection scanning as a preliminary action during the authentication phase, before the device is mounted. The file system authenticates the device and scans for infections in advance, so that by the time mounting is requested, the device is already verified as safe. This preliminary scanning eliminates the need for separate scanning delays during mounting operations.
Solution Approach 2:
The patent merges the infection scanning function with the authentication process. Instead of treating scanning as a separate step that adds delay, the scan is combined with the authentication and policy retrieval operations. This merging allows the system to perform security checks as part of the normal device connection workflow without adding additional time delays.
Data Source
AI summary
A method for securely accessing a hardware storage device connected to a computer system, the hardware storage device having a unique hardware identifier and the computer system including a processor, the method comprising: an agent software component receiving the identifier of the storage device to authenticate the storage device, wherein the agent executes in an unrestricted mode of operation of the processor such that the agent is a trusted software component; in response to the authentication, the agent accessing a secure data key for encrypting and decrypting data on the storage device, wherein the data key is accessible only to trusted agents executing in the unrestricted mode of the processor such that software executing in a user mode of the processor stores and retrieves data on the storage device only via the agent.