Host validation mechanism for preserving integrity of portable storage data

1. A computer implemented method for validating a host computer from a portable storage device, the method comprising the steps of:

detecting that the portable storage device is communicatively coupled to the host computer, the portable storage device comprising a secure partition with data, credentials and an access policy, and wherein the host computer is unable to access the data on the secure partition until authorized;

the portable storage device interrogating a Trusted Platform Module (TPM) of the host computer to authorize the host computer, wherein the TPM comprises a secure crypto-processor chip, and wherein authorizing the host computer comprises:

the portable storage device interrogating remote attestation of the TPM to identify a current configuration of the host computer and verify whether the host computer is approved for access based on the current configuration;

the portable storage device verifying whether the host computer to which the portable storage device is communicatively coupled is approved for access based on the credentials in the secure partition;

determining a level of access for the host computer based on the access policy in the secure partition; and

providing the level of access to the host computer for data stored in the secure partition of the portable storage device responsive to the host computer authorization and access level determination.

2. The method of claim 1 wherein identifying, by the portable storage device, the host computer to which the portable storage device is communicatively coupled further comprises:

using remote attestation, by the portable storage device, to identify the host computer.

3. The method of claim 1 wherein identifying, by the portable storage device, the host computer to which the portable storage device is communicatively coupled further comprises:

identifying, by the portable storage device, a current configuration of the host computer.

4. The method of claim 1 wherein verifying, by the portable storage device, whether the host computer to which the portable storage device is communicatively coupled is approved to access data stored on the portable storage device further comprises:

comparing, by the portable storage device, an identifier of the host computer to which the portable storage device is communicatively coupled to a plurality of stored identifiers of host computers approved for accessing data stored on the portable storage device.

5. The method of claim 1 wherein verifying, by the portable storage device, whether the host computer to which the portable storage device is communicatively coupled is approved to access data stored on the portable storage device further comprises:

comparing, by the portable storage device, an identifier of the host computer to which the portable storage device is communicatively coupled and a current configuration of said host computer to a plurality of stored identifiers of host computer configurations approved for accessing data stored on the portable storage device.

6. The method of claim 1 wherein verifying, by the portable storage device, whether the host computer to which the portable storage device is communicatively coupled is approved to access data stored on the portable storage device further comprises:

determining, by the portable storage device, that the host computer to which the portable storage device is communicatively coupled is not currently approved to access data stored on the portable storage device;

determining, by the portable storage device, a current configuration of said host computer; and

verifying, by the portable storage device, whether the host computer is approved to access data stored on the portable storage device in response to the current configuration of said host computer.

7. The method of claim 1 wherein providing to the host computer, by the portable storage device, a level of access to data stored on the portable storage device, the level of access being determined in response to the verifying step system further comprises:

reading, by the portable storage device, a stored access policy, specifying a level of access to data stored on the portable storage device to be provided to the verified host computer; and

providing to the verified host computer, by the portable storage device, a level of access to data stored on the portable storage device as indicated by the access policy.

8. The method of claim 1 wherein providing to the host computer, by the portable storage device, a level of access to data stored on the portable storage device, the level of access being determined in response to the verifying step system further comprises:

denying the host computer, by the portable storage device, access to data stored on the portable storage device.

9. The method of claim 1 further comprising:

using, by the portable storage device, a Universal Serial Bus protocol to communicate with the host computer.

10. A portable storage device configured to validate host computers for accessing data stored on the portable storage device, the portable storage device comprising:

a processing unit;

computer memory;

an interface configured to communicatively couple the portable storage device to a computer system;

a host identifying module running in the computer memory of the portable storage device, to detect that the portable storage device is communicatively coupled to the host computer, the portable storage device comprising a secure partition with data, credentials and an access policy, and wherein the host computer is unable to access the data on the secure partition until authorized, the portable storage device to interrogate a Trusted Platform Module (TPM) of the host computer to authorize the host computer, wherein the TPM comprises a secure crypto-processor chip, the host identifying module interrogating remote attestation of the TPM to identify a current configuration of the host computer and verify whether the host computer is approved for access based on the current configuration;

a credentials verifying module running in the computer memory of the portable storage device, to verify whether the host computer to which the portable storage device is communicatively coupled is approved for access based on the credentials in the secure partition; and

an access determining module running in the computer memory of the portable storage device, to determine a level of access for the host computer based on the access policy in the secure partition, and the level of access to the host computer for data stored in the secure partition the portable storage device responsive to the host computer authorization and access level determination.

11. The portable storage device of claim 10 wherein the host identifying module is further configured to:

use remote attestation to identify the host computer to which the portable storage device is communicatively coupled.

12. The portable storage device of claim 10 wherein the host identifying module is further configured to:

identify a current configuration of the host computer to which the portable storage device is communicatively coupled.

13. The portable storage device of claim 10 wherein the credentials verifying module is further configured to:

compare an identifier of the host computer to which the portable storage device is communicatively coupled to a plurality of stored identifiers of host computers approved for accessing data stored on the portable storage device.

14. The portable storage device of claim 10 wherein the credentials verifying module is further configured to:

compare an identifier of the host computer to which the portable storage device is communicatively coupled and a current configuration of said host computer to a plurality of stored identifiers of host computer configurations approved for accessing data stored on the portable storage device.

15. The portable storage device of claim 10 wherein the access determining module is further configured to:

provide the host computer at least some access to data stored on the portable storage device.

16. The portable storage device of claim 10 wherein the access determining module is further configured to:

deny the host computer access to data stored on the portable storage device.

17. At least one non-transitory computer readable storage medium storing a computer program product for validating a host computer from a portable storage device, the computer program product comprising program code for:

detecting that the portable storage device is communicatively coupled to the host computer, the portable storage device comprising a secure partition with data, credentials and an access policy, and wherein the host computer is unable to access the data on the secure partition until authorized;

the portable storage device interrogating a Trusted Platform Module (TPM) of the host computer to authorize the host computer, wherein the TPM comprises a secure crypto-processor chip, and wherein authorizing the host computer comprises;

the portable storage device interrogating remote attestation of the TPM to identify a current configuration of the host computer and verify whether the host computer is approved for access based on the current configuration;

the portable storage device verifying whether the host computer to which the portable storage device is communicatively coupled is approved for access based on the credentials in the secure partition;

determining a level of access for the host computer based on the access policy in the secure partition; and

providing the level of access to the host computer for data stored in the secure partition of the portable storage device responsive to the host computer authorization and access level determination.

18. The computer program product of claim 17 wherein the program code for identifying, from the portable storage device, the host computer to which the portable storage device is communicatively coupled further comprises:

program code for identifying, from the portable storage device, a current configuration of the host computer.