Controlled storage device access

A computer system for securely accessing a hardware storage device connected thereto, the hardware storage device having a unique hardware identifier and the computer system comprising:

• a processor including at least two modes of operation including an unrestricted mode of operation and a restricted mode of operation;
• wherein, in the restricted mode of operation, the processor is subject to hardware enforced restrictions, and wherein, the processor is configured to execute, in an unrestricted mode of the processor, a software agent adapted to receive a unique hardware identifier of the storage device and to authenticate the storage device using the unique hardware identifier;
• in response to the authentication, the agent accessing a secure data key for encrypting and decrypting data on the storage device, the secure data key being identified with reference to the unique hardware identifier of the storage device;
• the computer system being configured to encrypt and decrypt data on the storage device using the secure data key;
• wherein the agent is securely communicatively connected to an authorisation system, the authorisation system securely storing the secure data key, and the agent receives the secure data key from the authorisation system;
• wherein the data key is accessible, via the authorisation system, only to trusted agents executing in the unrestricted mode of the processor such that software executing in the restricted mode of operation of the processor stores and retrieves data on the storage device only via the agent using an interface of the agent through which all data storage and retrieval by the software executing in the restricted mode of the processor must pass;
• and
• wherein the agent is securely communicatively connected to the authorisation system which is remote from the computer system, the authorisation system securely storing the secure data key, and the agent receives the secure data key from the authorisation system which is remote from the computer system.

A non-transitory computer-readable storage medium storing a computer program element comprising a computer program code to, when loaded into a computer system and executed thereon, cause the computer to perform the following steps:

• providing at least two modes of operation in a processor including an unrestricted mode of operation and a restricted mode of operation;
• wherein in the restricted mode of operation, the processor is subject to hardware enforced restrictions;
• receiving, in a software agent executed by the processor of the computer system, a unique hardware identifier of a hardware storage device;
• authenticating the storage device using the unique hardware identifier,
• providing execution, by the agent, in the unrestricted mode of operation of the processor such that the agent is a trusted software component;
• in response to the authentication, accessing, by the agent, a secure data key for encrypting and decrypting data on the storage device, the secure data key being identified with reference to the unique hardware identifier of the storage device;
• encrypting and decrypting data on the storage device using the secure data key;
• wherein the agent is securely communicatively connected to an authorisation system, the authorisation system securely storing the secure data key, and the agent receives the secure data key from the authorisation system;
• wherein the data key is accessible, via the authorisation system, only to trusted agents executing in the unrestricted mode of the processor such that software executing in the restricted mode of operation of the processor stores and retrieves data on the storage device only via the agent using an interface of the agent through which all data storage and retrieval by the software executing in the restricted mode of the processor must pass;
• and
• wherein the agent is securely communicatively connected to the authorization system which is remote from the computer system, the authorization system securely storing the secure data key, and the agent receives the secure data key from the authorization system which is remote from the computer system.