Authorization for transient storage devices with multiple authentication silos
In a transient storage device (TSD) with multiple authentication silos, a host computing device connected to the TSD is configured by the TSD to discover and act upon various types of authentication information in the silos. One or more logical combinations of authentication silos are switched to the authenticated state to grant access to an associated storage area. A particular ordering of authentication silos may be required to achieve a valid combination of authenticated silos. Ordering may be suggested by configuration information in the TSD. Ordering may also be based upon whether or not user input is required for authenticating a given authentication silo, the environment of use of the TSD, or a hierarchy from most trusted to least trusted authentication silo. With this information, the host proceeds with the most efficient authentication sequence leading to a grant of access to the storage area.
1. A tangible computer-readable storage device storing computer-executable instructions for performing a computer process, the instructions comprising operations to:
coordinate a first authentication requirement for a first authentication silo corresponding to a storage area and a second authentication requirement for a second authentication silo corresponding to the storage area to create a logical expression comprising one or more authentication silo combinations, the logical expression specifying the first authentication silo and the second authentication silo, the logical expression based upon configurable settings for the first authentication silo and the second authentication silo within one or more extension fields of at least one of a manufacturer certificate or a provisioning certificate;
determine whether one or more authentication states of the first authentication silo and the second authentication silo result in a valid authentication silo combination of the logical expression for access to the storage area; and
authorize access by a host device to the storage area based upon determining the valid authentication silo combination.
2. The tangible computer-readable storage device of claim 1 , the instructions comprising a creation operation to create the first authentication silo and the second authentication silo.
3. The tangible computer-readable storage device of claim 2 , the creation operation comprising operations to:
set values for configurable settings of the storage area in one or more extension fields of an authentication certificate; and
install the authentication certificate on the storage device.
4. The tangible computer-readable storage device of claim 1 , the coordination operation comprising operations to:
determine whether authentication of at least one authentication silo utilizes user input; and
solicit user input to meet an authentication requirement.
5. The tangible computer-readable storage device of claim 1 , the coordination operation comprising operations to interrogate an authentication certificate.
6. The tangible computer-readable storage device of claim 1 ,
the coordination operation comprising operations to discover whether a combination of authentication states is specified by an authentication silo combination within the logical expression; and
the determination operation comprising operations to calculate whether the combination is met.
7. The tangible computer-readable storage device of claim 6 , the calculation operation comprising operations to calculate a MaxTerm/MinTerm value of the authentication states.
8. A method comprising:
coordinating a first authentication requirement for a first authentication silo corresponding to a storage area and a second authentication requirement for a second authentication silo corresponding to the storage area to create a logical expression comprising one or more authentication silo combinations, the logical expression specifying the first authentication silo and the second authentication silo, the logical expression based upon configurable settings for the first authentication silo and the second authentication silo within one or more extension fields of at least one of a manufacturer certificate or a provisioning certificate;
determining whether one or more authentication states of the first authentication silo and the second authentication silo result in a valid authentication silo combination of the logical expression for access to the storage area; and
authorizing access by a host device to the storage area based upon determining the valid authentication silo combination, the method implemented by a processing unit.
9. The method of claim 8 , comprising creating the first authentication silo and the second authentication silo.
10. The method of claim 9 , the creating comprising:
setting values for configurable settings of the storage area in one or more extension fields of an authentication certificate; and
installing the authentication certificate on the storage device.
11. The method of claim 8 , the coordinating comprising:
determining whether authentication of at least one authentication silo utilizes user input; and
soliciting user input to meet an authentication requirement.
12. The method of claim 8 , the coordinating comprising interrogating an authentication certificate.
13. The method of claim 8 ,
the coordinating comprising discovering whether a combination of authentication states is specified by an authentication silo combination within the logical expression; and
the determining comprising calculating whether the combination is met.
14. The method of claim 13 , the calculating comprising calculating a MaxTerm/MinTerm value of the authentication states.
15. A system comprising:
one or more processing units; and
memory storing computer-executable instructions that when executed by at least one of the one or more processing units perform operations to:
coordinate a first authentication requirement for a first authentication silo corresponding to a storage area and a second authentication requirement for a second authentication silo corresponding to the storage area to create a logical expression comprising one or more authentication silo combinations, the logical expression specifying the first authentication silo and the second authentication silo, the logical expression based upon configurable settings for the first authentication silo and the second authentication silo within one or more extension fields of at least one of a manufacturer certificate or a provisioning certificate;
determine whether one or more authentication states of the first authentication silo and the second authentication silo result in a valid authentication silo combination of the logical expression for access to the storage area; and
authorize access by a host device to the storage area based upon determining the valid authentication silo combination.
16. The system of claim 15 , the instructions comprising a creation operation to create the first authentication silo and the second authentication silo.
17. The system of claim 16 , the creation operation comprising operations to:
set values for configurable settings of the storage area in one or more extension fields of an authentication certificate; and
install the authentication certificate on the storage device.
18. The system of claim 15 , the coordination operation comprising operations to:
determine whether authentication of at least one authentication silo utilizes user input; and
solicit user input to meet an authentication requirement.
19. The system of claim 15 , the coordination operation comprising operations to interrogate an authentication certificate.
20. The system of claim 15 ,
the coordination operation comprising operations to discover whether a combination of authentication states is specified by an authentication silo combination within the logical expression; and
the determination operation comprising operations to calculate whether the combination is met.