US 2011/0258456 A1Published application

Extensible management of self-encrypting storage devices

AssigneeMicrosoft Corporation

InventorGrigory Borisovich Lyakhovitskiy

Life of this patent

Estimating the term…

Loading patent…

Abstract

Security device objects can be utilized to support a stack of components of computer-executable instructions that are directed to managing the security functionality represented by the security device object. In the case of hardware encrypting storage devices, a security device object can represent the self-encrypting capabilities of those devices and the attendant stack can comprise drivers directed to band and key management. A default band management driver can support a band-centric set of input/output controls that can be redirected to the band management driver. It can cache band authentication keys or provide callback mechanisms for key providers to register themselves to provide keys on-demand. Key provider identifiers can be stored on the storage device and utilized to dynamically load, install or upgrade key providers when the band authentication key is required. The band management driver can also prevent the powering-down of the storage device in an unlocked state.

Claims20

Dependent claims

One or more computer-readable media comprising computer-executable instructions for processing band-centric input/output control communications, the computer-executable instructions directed to steps comprising:

creating a security device object representing self-encrypting features of a hardware encrypting storage device;
detecting band-centric input/output control communications directed to an existing storage device object associated with the hardware encrypting storage device;
redirecting the detected band-centric input/output control communications to a first set of computer-executable instructions representing a top of a stack of sets of computer-executable instructions that are vertically arranged above the security device object such that communications proceed from a higher set of computer-executable instructions in the stack to a lower set of computer-executable instructions in the stack;
and
providing command communications to the existing storage device object, the command communications instructing the hardware encrypting storage device to perform actions relevant to the detected band-centric input/output control communications, wherein the provided command communications are generated by the computer-executable instructions in the stack in response to the redirecting the band-centric input/output control communications to the stack.

2 more elements

One or more computer-readable media comprising computer-executable instructions for generating, in response to, and in accordance with, band-centric input/output control communications, control communications comprising one or more cryptographic keys relevant to one or more bands affected by the band-centric input/output control communications, the computer-executable instructions directed to steps comprising:

registering a set of supported band-centric input/output controls to be redirected to the computer-executable instructions;
receiving a redirected band-centric input/output control communication, comprising at least one of the set of supported band-centric input/output controls,
identifying at least one band of a hardware encrypting storage device affected by the redirected band-centric input/output control communication;
generating, in response to, and in accordance with, the redirected band-centric input/output control communications, one or more control communications comprising at least one cryptographic key relevant to the identified at least one band;
and
providing the one or more control communications to a security device object representing self-encrypting features of the hardware encrypting storage device.

3 more elements

A computing device comprising:

a first set of computer-executable instructions directed to steps comprising:
creating a security device object representing self-encrypting features of a hardware encrypting storage device;
detecting band-centric input/output control communications directed to an existing storage device object associated with a hardware encrypting storage device;
and redirecting the detected band-centric input/output control communications to a second set of computer-executable instructions associated with the security device object;
and
the second set of computer-executable instructions, which are directed to steps comprising:
registering a set of supported band-centric input/output controls to be redirected to the second set of computer-executable instructions, wherein the redirecting the detected band-centric input/output control communications is only performed if the detected band-centric input/output control communications are among the set of supported band-centric input/output controls;
identifying at least one band of the hardware encrypting storage device affected by the redirected band-centric input/output control communication;
generating, in response to, and in accordance with, the redirected band-centric input/output control communications, one or more control communications comprising at least one cryptographic key relevant to the identified at least one band;
and providing the one or more control communications to the security device object.

7 more elements

Dependencies are inferred from the claim text.