Data access control systems and methods

A method for protecting data on a computing system, the method comprising:

• executing, under a trusted operating system, an access control component that controls access to protected data;
• identifying, by the access control component, an input or output hardware component of the computing system, the input or output hardware component accessible by a guest operating system different from the trusted operating system;
• disabling, by the access control component, the identified input or output hardware component by blocking one or more communications with the identified input or output hardware component to preclude access to the identified input or output hardware component by the guest operating system;
• and
• accessing, by at least one application running under the guest operating system, the protected data, wherein the at least one application is permitted to access the protected data through use of a decryption key.

A computer-readable storage medium that is not a signal per se which stores instructions that, when executed by a computing system, cause the computing system to perform operations for protecting data, the operations comprising:

• executing, under a trusted operating system, an access control component that controls access to protected data;
• identifying, by the access control component, an input or output hardware component of the computing system, the input or output hardware component accessible by a guest operating system different from the trusted operating system;
• disabling, by the access control component, the identified input or output hardware component by blocking one or more communications with the identified input or output hardware component to preclude access to the identified input or output hardware component by the guest operating system;
• and
• accessing, by at least one software application running under the guest operating system, the protected data, wherein the at least one software application is permitted to access the protected data through use of the decryption key received from the access control component.

A computing system comprising:

• one or more processors;
• a memory;
• one or more input or output hardware components;
• and
• an access control component executed under a trusted operating system configured to control access to protected data by:
• identifying an input or output hardware component, of the one or more input or output hardware components, wherein the identified input or output hardware component is accessible by a guest operating system different from the trusted operating system;
• disabling the identified input or output hardware component by blocking one or more communications with the identified input or output hardware component to preclude access to the identified input or output hardware component by the guest operating system;
• and
• accessing, by at least one software application running under the guest operating system, the protected data, wherein the at least one software application is permitted to access the protected data through use of the decryption key received from the access control component.