Client authentication and data management system

US 8,468,591 B2
Filed: 10/15/2007
Issued: 06/18/2013
Est. Priority Date: 10/13/2006
Status: Active Grant

- Alert
- Pin

Associated Cases

Associated Defendants

First Claim

Patent Images

1. A system for protecting computing devices and associated secure data stored in at least one secure data storage component from unauthorized access by controlling whether such computing devices are permitted to boot their respective operating systems, the system comprising:

at least one protected computing device configured for communication through a network with a storage controller to access the secure data, the protected computing device having an operating system and a virtual machine, the virtual machine configured to be launched during boot of the protected computing device but prior to launch of the operating;

an authentication server configured for authenticating the protected computing device for access to the secure data; and

a virtual machine manager associated with the virtual machine, the virtual machine manager configured to be launched during boot of the protected computing device, the virtual machine manager configured to cause the authentication server to authenticate the protected computing device, the virtual machine manager configured to make a decision whether to allow the protected computing device to either launch or not launch the operating system based upon whether the protected computing device is either authenticated or not, respectively, by the authentication server, the virtual machine manager configured to control the protected computing device to either launch or not launch the operating system based upon the decision.

View all claims

1 Assignment

Timeline View

Assignment View

Litigations

0 Petitions

Reexamination

Accused Products

Abstract

Methods and systems for performing an authenticated boot (310); performing a continuous data protection (350); performing automatic protection and optionally a consolidation; and performing other defenses and protection of a protected computing device (110a, 110b, 110c) (such as a computer system) are provided. The aspects include integrating security mechanisms (which may include a “call home” function (330), role and rule-based policies (225), validating technologies, encryption and decryption technologies, data compression technologies, protected and segmented boot technologies, and virtualization technologies. Booting and operating (either fully or in a restricted manner) are permitted only under a control of a specified role-set, rule-set, and/or a controlling supervisory process or server system(s). The methods and systems make advantageous use of hypervisors (220) and other virtual machine monitors or managers.

25 Citations

View as Search Results

58 Claims

1. A system for protecting computing devices and associated secure data stored in at least one secure data storage component from unauthorized access by controlling whether such computing devices are permitted to boot their respective operating systems, the system comprising:
- at least one protected computing device configured for communication through a network with a storage controller to access the secure data, the protected computing device having an operating system and a virtual machine, the virtual machine configured to be launched during boot of the protected computing device but prior to launch of the operating;
  
  an authentication server configured for authenticating the protected computing device for access to the secure data; and
  
  a virtual machine manager associated with the virtual machine, the virtual machine manager configured to be launched during boot of the protected computing device, the virtual machine manager configured to cause the authentication server to authenticate the protected computing device, the virtual machine manager configured to make a decision whether to allow the protected computing device to either launch or not launch the operating system based upon whether the protected computing device is either authenticated or not, respectively, by the authentication server, the virtual machine manager configured to control the protected computing device to either launch or not launch the operating system based upon the decision.
- View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17)
- - 2. The system of claim 1, further comprising a control console configured for access to and exerting control over devices connected to the network, the devices including the at least one protected computing device and the authentication server, and wherein the control console is operable within the protected computing device.
  - 3. The system of claim 1, further comprising a control console configured for access to and exerting control over devices connected to the network, the devices including the at least one protected computing device and the authentication server, and wherein the control console is operable within the authentication server.
  - 4. The system of claim 1, further comprising a control console configured for access to and exerting control over devices connected to the network, the devices including the at least one protected computing device and the authentication server, and wherein the control console is operable within a console device separate from the protected computing device.
  - 5. The system of claim 1, further comprising a control console configured for access to and exerting control over devices connected to the network, the devices including the at least one protected computing device and the authentication server, and wherein the control console is operable within a console device separate from the authentication server.
  - 6. The system of claim 1, wherein the virtual machine is implemented in software of the at least one protected computing device.
  - 7. The system of claim 1, wherein the virtual machine is implemented in hardware of the at least one protected computing device.
  - 8. The system of claim 1, wherein the virtual machine manager is a hypervisor.
  - 9. The system of claim 1, wherein the virtual machine manager is further configured to permit the protected computing device to partially boot in a limited mode.
  - 10. The system of claim 1, wherein the virtual machine manager is further configured to shut down the protected computing device upon failure to authenticate the protected computing device.
  - 11. The system of claim 1, wherein the virtual machine manager is further configured to cause the protected computing device to enter a specified state upon failure to authenticate the protected computing device, the specified state restricting the protected computing device from accessing, in whole or in part:
    - (a) a memory associated with the protected computing device or a remote memory that can be accessed by the protected computing device, (b) a storage area associated with the protected computing device or a remote storage area that can be accessed by the protected computing device, (c) an input/output function associated with the protected computing device or a remote input/output function that can be accessed by the protected device.
  - 12. The system of claim 1, wherein the virtual machine and/or the virtual machine manager is further configured for authenticating the authentication server to the protected computing device.
  - 13. The system of claim 1, wherein the virtual machine and/or the virtual machine manager is further configured for sending data to and receiving data from the secure data storage component.
  - 14. The system of claim 13, wherein the virtual machine and/or the virtual machine manager is further configured to communicate with the storage controller at a predetermined interval to monitor for changes in the secure data in use on the protected computing device.
  - 15. The system of claim 14, wherein the virtual machine and/or the virtual machine manager is further configured to monitor for validity of the secure data in use on the protected computing device.
  - 16. The system of claim 15, wherein the virtual machine manager is further configured to cause the protected computing device to enter a specified state upon a determination that the secure data or the previously granted authorization is no longer valid, the specified state restricting the protected computing device from accessing, in whole or in part:
    - (a) a memory associated with the protected computing device or a remote memory that can be accessed by the protected computing device, (b) a storage area associated with the protected computing device or a remote storage area that can be accessed by the protected computing device, (c) an input/output function associated with the protected computing device or a remote input/output function that can be accessed by the protected device.
  - 17. The system of claim 1, wherein the virtual machine and/or the virtual machine manager is further configured to back up the secure data to the secure data storage component.

18. A method for protecting computing devices from unauthorized access by protecting whether and to what extent such computing devices are permitted to boot their respective operating systems, the method comprising:
- initiating a boot command of a protected computing device, wherein the boot command is configured to initiate the launch of an operating system;
  
  intercepting the boot command to prevent the operating system from launching;
  
  launching a virtual machine manager prior to the operating system launch;
  
  at the virtual machine, authenticating the protected computing device with an authentication server;
  
  receiving at the virtual machine, a response from the authentication server, the response indicating the authentication status of the protected computing device;
  
  determining with the virtual machine manager whether or not and to what extent to permit the protected computing device to boot the operating system based upon the authentication status; and
  
  permitting the protected computing device to boot the operating system based upon the authentication status and causing the protected computing device to enter a specified state based on the authentication status of the protected computing device, the specified state restricting the protected computing device from accessing, in whole or in part;
  
  (a) a memory associated with the protected computing device or a remote memory that can be accessed by the protected computing device, (b) a storage area associated with the protected computing device or a remote storage area that can be accessed by the protected computing device, (c) an input/output function associated with the protected computing device or a remote input/output function that can be accessed by the protected device.
- View Dependent Claims (19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
- - 19. The method of claim 18, wherein the virtual machine manager is a hypervisor.
  - 20. The method of claim 18, further comprising halting the boot of the protected computing device upon determination the authentication status of the protected computing device indicates failure to authenticate.
  - 21. The method of claim 18, further comprising shutting down the protected computing device upon determination the authentication status of the protected computing device indicates failure to authenticate.
  - 22. The method of claim 18, further comprising the virtual machine and/or virtual machine manager receiving a request for authentication from the authentication server.
  - 23. The method of claim 22, further comprising the virtual machine and/or virtual machine manager providing a response authentication to the authentication server.
  - 24. The method of claim 18, further comprising the protected computing device sending data to or receiving secure data from a secure data storage component, wherein a storage controller provides access to the secure data storage component.
  - 25. The method of claim 24, further comprising the virtual machine and/or virtual machine manager communicating with the storage controller at a predetermined interval to monitor for changes in the secure data on the protected computing device.
  - 26. The method of claim 25, further comprising the virtual machine and/or virtual machine manager monitoring for validity the secure data on the protected computing device.
  - 27. The method of claim 26, further comprising the virtual machine and/or virtual machine manager causing the protected computing device to enter a specified state upon a determination that the secure data is no longer valid.
  - 28. The method of claim 24, further comprising the virtual machine and/or virtual machine manager backing up the secure data to the secure data storage component.

29. A system for centralized network control of computing devices, the system comprising:
- a plurality of protected computing devices configured for communication through a network, each protected computing device further configured for using a virtual machine, the virtual machine designed to permit the protected computing device to perform one of the following boot operations;
  
  boot its operating system, not boot its operating system, or boot its operating system but limit its memory access, storage access, or input/output capability;
  
  a virtual machine manager configured to exercise control over each of the protected computing devices and the virtual machine, the virtual machine manager being in communication with the virtual machine associated with each protected computing device through the network, the virtual manager designed to cause the computing device and an authentication server to authenticate each other; and
  
  the virtual machine manager configured to determine the permitted boot operation.
- View Dependent Claims (30, 31, 32, 33, 34, 35, 36, 37, 38)
- - 30. The system of claim 29, further comprising the virtual machine manager exercising any input/output (I/O) control over each of the protected computing devices.
  - 31. The system of claim 29, wherein the virtual machine and/or virtual machine manager is installed on one of the protected computing devices.
  - 32. The system of claim 29, wherein the virtual machine manager is a hypervisor.
  - 33. The system of claim 32, wherein the hypervisor and/or virtual machine is implemented in software on at least one of the plurality of protected computing devices.
  - 34. The system of claim 32, wherein the hypervisor and/or virtual machine is implemented in hardware on at least one of the plurality of protected computing devices.
  - 35. The system of claim 29, wherein the virtual machine and/or virtual machine manager is configured to enable network access control for each of the protected computing devices.
  - 36. The system of claim 29, further comprising at least one protected partition within at least one protected computing device.
  - 37. The system of claim 36, wherein the virtual machine and/or virtual machine manager is configured to enable encryption services for each at least one protected partition.
  - 38. The system of claim 36, wherein the virtual machine and/or virtual machine manager is configured to enable decryption services for each at least one protected partition.

39. A method for centralized network control of computing devices, the method comprising:
- configuring one or more protected computing devices for communication through a network; and
  
  a hardware or software control element configured to exercise control over each of the protected computing devices wherein the control element is a virtual machine manager associated with a virtual machine;
  
  wherein the virtual machine manager is configured to cause the one or more protected computing devices to be authenticated by an authentication server, the virtual machine manager configured to make a decision whether and to what extent to allow the one or more protected computing devices to launch its operating system based upon an authentication status provided by the authentication server, the virtual machine manager configured to control the one or more protected computing devices to perform one of the following boot operations;
  
  boot its operating system, not boot its operating system, or boot its operating system but limit its memory access, storage access, or input/output capability.
- View Dependent Claims (40, 41, 42, 43, 44, 45, 46, 47)
- - 40. The method of claim 39, wherein the control element exercises input/output (I/O) control over at least one of the protected computing devices.
  - 41. The method of claim 39, wherein the virtual machine and/or virtual machine manager is installed on at least one of the protected computing devices.
  - 42. The method of claim 39, wherein the virtual machine manager is a hypervisor.
  - 43. The method of claim 42, wherein the hypervisor and/or virtual machine is implemented in software on at least one of the plurality of protected computing devices.
  - 44. The method of claim 42, wherein the hypervisor and/or virtual machine is implemented in hardware on at least one of the plurality of protected computing devices.
  - 45. The method of claim 39, wherein the virtual machine and/or virtual machine manager provides network access control for each of the protected computing devices.
  - 46. The method of claim 39, wherein the virtual machine and/or virtual machine manager provides encryption services for at least one protected partition within at least one protected computing device.
  - 47. The method of claim 39, wherein the virtual machine and/or virtual machine manager provides decryption services for at least one protected partition within at least one protected computing device.

48. A data processing system for protecting client devices and associated secure data from unauthorized access, the system comprising:
- a plurality of protected client devices configured for accessing secure data through a network, each protected client device further configured for using a virtual machine, the virtual machine designed to permit the protected client device to perform one of the following boot operations;
  
  boot its operating system, not boot its operating system, or boot its operating system but limit its memory access capability, storage access capability, and/or input/output capability;
  
  at least one authentication server configured for providing authentication to the protected client devices; and
  
  a plurality of virtual machine managers, each virtual machine manager corresponding to one of the protected client devices and virtual machines, each virtual machine manager configured to be launched during boot of the corresponding one of the protected client devices prior to launch of its operating system, each virtual machine manager configured to cause the corresponding one of the protected client devices to be authenticated by the at least one authentication server, and each virtual machine manager configured to determine the permitted boot operation.
- View Dependent Claims (49, 50, 51, 52, 53, 54, 55, 56, 57, 58)
- - 49. The system of claim 48, wherein the network is configured for permanent connectivity.
  - 50. The system of claim 48, wherein the network is configured for temporary or intermittent connectivity.
  - 51. The system of claim 48, wherein the authentication server is configured to allocate at least one resource corresponding to a first protected client device for use by at least one other protected client device, the at least one resource including one or more of memory, storage space, network, input/output control, and processor bandwidth.
  - 52. The system of claim 48, wherein each virtual machine manager is a hypervisor.
  - 53. The system of claim 52, wherein a first hypervisor corresponding to a first protected client device, is configured for communication with at least one other hypervisor corresponding to other protected client devices.
  - 54. The system of claim 53, wherein the first hypervisor is configured for allocating at least one resource corresponding to a first protected client device for use by at least one other protected client device, the at least one resource selected from:
    - memory, storage space, network, input/output control, and processor bandwidth.
  - 55. The system of claim 53, wherein the first hypervisor is configured for allocating at least one resource corresponding to a second protected client device for use by at least one other protected client device, the at least one resource selected from:
    - memory, storage space, network, input/output control, and processor bandwidth.
  - 56. The system of claim 52, wherein a plurality of hypervisors, each hypervisor corresponding to a specified protected client device from among the plurality of protected client devices, are configured for communication with at least one other hypervisor corresponding to other protected client devices from among the plurality of protected client devices.
  - 57. The system of claim 56, wherein each hypervisor is configured for allocating at least one resource corresponding to the specified protected client device for use by at least one other protected client device, the at least one resource including one or more of memory, storage space, network, input/output control, and processor bandwidth.
  - 58. The system of claim 56, wherein each hypervisor is configured for allocating at least one resource corresponding to a second specified protected client device for use by at least one other protected client device, the at least one resource including one or more of memory, storage space, network, input/output control, and processor bandwidth.

Specification

Resources

Litigation Campaign Assessment

Litigation Data

Current Assignee
Computer Protection IP, LLC
Original Assignee
Computer Protection IP, LLC
Inventors
Silverstone, Ariel
Primary Examiner(s)
Barron, Jr., Gilberto
Assistant Examiner(s)
ALMEIDA, DEVIN E

Application Number

US12/514,222
Publication Number

US 20100037296A1
Time in Patent Office

2,073 Days
Field of Search

726/2, 726/3
US Class Current

726/16
CPC Class Codes

G06F 2009/45587   Isolation or security of vi...

G06F 21/44   Program or device authentic...

G06F 21/53   by executing in a restricte...

G06F 21/554   involving event detection a...

G06F 21/575   Secure boot

G06F 21/602   Providing cryptographic fac...

G06F 2221/033   Test or assess software

G06F 9/45558   Hypervisor-specific managem...

H04L 63/08   for authentication of entit...

H04L 63/20   for managing network securi...

Client authentication and data management system

First Claim

1 Assignment

Litigations

0 Petitions

Reexamination

Accused Products

Abstract

25 Citations

58 Claims

Specification

Solutions

Use Cases

Quick Links

Client authentication and data management system

First Claim

1 Assignment

Subscription Required

Subscription Required

Litigations

0 Petitions

Subscription Required

Reexamination

Accused Products

Subscription Required

Abstract

25 Citations

58 Claims

Specification

Subscription Required

Solutions

Use Cases

Quick Links