System and method for protecting and securing storage devices using below-operating system trapping
View Patent ↗In one embodiment, a system for securing a storage device includes an electronic device comprising a processor, a storage device communicatively coupled to the processor, and a security agent. The security agent is configured to execute at a level below all of the operating systems of the electronic device, intercept a request to access the storage device, identify a requesting entity responsible for initiating the request, and utilize one or more security rules to determine if the request from the requesting entity is authorized. In some embodiments, the security agent is configured to determine whether the request involves a protected area of the storage device. If the request involves a protected area of the storage device, the security agent may be configured to allow the request if the requesting entity is authorized to access the protected area of the storage device.
1. A system for securing a storage device, comprising:
an electronic device comprising a processor;
the storage device communicatively coupled to the processor; and
a security agent configured to:
execute at a level below all operating systems on the electronic device accessing the storage device;
intercept a request to access the storage device;
identify a requesting entity responsible for initiating the request;
utilize one or more security rules to determine whether the request from the requesting entity is authorized; and
utilize the one or more security rules to determine whether the request involves a protected area of the storage device, the protected area of the storage device comprising one or more sectors of the storage device, the protected area of the storage device identified by the sectors of the storage device.
2. The system of claim 1 , wherein the request involves a protected area of the storage device wherein the request involves a master boot record, master file table, operating system file, or device driver.
3. The system of claim 1 , wherein the security agent is further configured to deny the request wherein the request involves a protected area of the storage device.
4. The system of claim 1 , wherein based on whether the request involves a protected area of the storage device, the security agent is further configured to allow the request if the requesting entity based on whether authorized to access the protected area.
5. The system of claim 1 , wherein the one or more security rules specify protected areas of the storage device.
6. The system of claim 5 , wherein the one or more security rules specify one or more entities authorized to access the protected areas of the storage device.
7. The system of claim 5 , wherein the one or more security rules specify access permissions for the protected areas.
8. The system of claim 1 , wherein the security agent is further configured to:
retrieve a backup copy of at least a portion of data on the storage device; and
write the backup copy to the storage device.
9. The system of claim 1 , wherein the security agent is further configured to intercept a request to access the storage device only after a security threat is detected.
10. The system of claim 1 , further comprising a protection server coupled to the security agent, the protection server configured to provide security rules to the security agent.
11. The system of claim 1 , wherein:
the storage device comprises a file system for storing one or more files; and
the security agent is further configured to map data from a file on the file system to one or more sectors on the storage device where the data resides.
12. The system of claim 1 , wherein the request includes an interrupt.
13. The system of claim 1 :
further comprising a virtual machine monitor configured to virtualize access of all the operating systems to the storage device; and
wherein the security agent is executing in the virtual machine monitor.
14. The system of claim 1 , wherein:
the processor comprises microcode; and
the security agent is executing in the microcode.
15. The system of claim 1 , further comprising:
a memory;
firmware residing in the memory and executed by the processor; and
wherein the storage device comprises the memory and processor.
16. A method for securing a storage device, comprising:
intercepting, at a level below all operating systems of an electronic device accessing the storage device, a request to access the storage device associated with the electronic device, the request originating from the operational level of one of one or more operating systems of the electronic device;
identifying a requesting entity responsible for initiating the request;
utilizing one or more security rules to determine whether the request from the requesting entity is authorized; and
utilizing the one or more security rules to determine whether the request involves a protected area of the storage device, the protected area of the storage device comprising one or more sectors of the storage device, the protected area of the storage device identified by the sectors of the storage device.
17. The method of claim 16 , wherein the request involves a protected area of the storage device based on whether the request involves a master boot record, master file table, operating system file, or device driver.
18. The method of claim 16 , further comprising denying the request based on whether the request involves a protected area of the storage device.
19. The method of claim 16 , wherein based on whether it is determined that the request involves a protected area of the storage device, the method further comprises allowing the request based on whether the requesting entity is authorized to access the protected area.
20. The method of claim 16 , wherein the one or more security rules specify protected areas of the storage device.
21. The method of claim 20 , wherein the one or more security rules specify one or more entities authorized to access the protected areas of the storage device.
22. The method of claim 20 , wherein the one or more security rules specify access permissions for the protected areas.
23. The method of claim 16 , further comprising:
retrieving a backup copy of at least a portion of data on the storage device; and
writing the backup copy to the storage device.
24. The method of claim 16 , further comprising intercepting a request to access the storage device only after a security threat is detected.
25. The method of claim 16 , further comprising receiving the one or more security rules from a protection server.
26. The method of claim 16 , further comprising mapping data from a file on a file system to one or more sectors on the storage device where the data resides.
27. The method of claim 16 , wherein intercepting the request comprises intercepting an interrupt.
28. The method of claim 16 , wherein the intercepting of the request is conducted in a virtual machine monitor.
29. The method of claim 16 , wherein the intercepting of the request is conducted by a security agent executing in microcode of a processor of the electronic device.
30. The method of claim 16 , wherein the intercepting of the request is conducted by a security agent executing in firmware of the storage device.
31. A non-transitory computer-readable medium encoded with logic, the logic, when executed by a processor, configured to:
intercept, at a level below all operating systems of an electronic device accessing a storage device, a request to access the storage device associated with the electronic device, the request originating from the operational level of one of one or more operating systems of the electronic device;
identify a requesting entity responsible for initiating the request;
utilize one or more security rules to determine whether the request from the requesting entity is authorized; and
utilize the one or more security rules to determine whether the request involves a protected area of the storage device, the protected area of the storage device comprises one or more sectors of the storage device, the protected area of the storage device identified by the sectors of the storage device.
32. The computer-readable medium of claim 31 , wherein the request involves a protected area of the storage device based on whether the request involves a master boot record, master file table, operating system file, or device driver.
33. The computer-readable medium of claim 31 , further comprising denying the request based on whether the request involves a protected area of the storage device.
34. The computer-readable medium of claim 31 , wherein based on whether it is determined that the request involves a protected area of the storage device, the processor is further configured to allow the request based on whether the requesting entity is authorized to access the protected area.
35. The computer-readable medium of claim 31 , wherein the one or more security rules specify protected areas of the storage device.
36. The computer-readable medium of claim 35 , wherein the one or more security rules specify one or more entities authorized to access the protected areas of the storage device.
37. The computer-readable medium of claim 35 , wherein the one or more security rules specify access permissions for the protected areas.
38. The computer-readable medium of claim 31 , wherein the processor is further configured to:
retrieve a backup copy of at least a portion of data on the storage device; and
write the backup copy to the storage device.
39. The computer-readable medium of claim 31 , wherein the processor is further configured to intercept a request to access the storage device only after a security threat is detected.
40. The computer-readable medium of claim 31 , wherein the processor is further configured to receive the one or more security rules from a protection server.
41. The computer-readable medium of claim 31 , wherein the processor is further configured to map data from a file on a file system to one or more sectors on the storage device where the data resides.
42. The computer-readable medium of claim 31 , wherein configuring the processor to intercept the request includes configuring the processor to intercept an interrupt.
43. The computer-readable medium of claim 31 , wherein configuring the processor to intercept the request includes configuring the processor to intercept the request in a virtual machine monitor.
44. The computer-readable medium of claim 31 , wherein configuring the processor to intercept the request includes configuring the processor to execute a security agent in microcode of the processor.
45. The computer-readable medium of claim 31 , wherein configuring the processor to intercept the request includes configuring the processor to execute a security agent in firmware of the storage device.