Secure disk access control
View Patent ↗A request is received from a security tool, the request relating to an event involving data records in a storage device. An application programming interface (API) is used to interface with secure storage functionality of the storage device, the secure storage functionality enabling a set of secure storage operations. A security operation is caused to be performed at the storage device involving the data records based at least in part on the request. In one aspect, the set of secure storage operations can include a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation.
1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:
receive, at a disk access security agent, a request from a security tool, the request relating to an event involving data records in a particular one of a plurality of storage devices, wherein each of the plurality of storage devices possesses local secure storage functionality and the disk access security agent has protected access to a common application programming interface (API) to interface with any one of the plurality of storage devices and invoke, through the common API, any one of a set of secure storage operations to be performed locally at the respective storage device, wherein the set of secure storage operations are defined through the common API;
use the common API to interface with secure storage functionality of the particular storage device to invoke a particular one of the set of secure storage operations at the particular storage device based at least in part on the request, wherein the set of secure storage operations comprises a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation,
wherein the copy-on-write operation comprises identifying an attempted write operation of a particular one of the data records and, prior to allowing the attempted write operation, copying data of the one or more data records to a copy-on-write backup location, and
wherein the save-attempted-write operation comprises disallowing an attempted write operation on a first record, causing the write operation to be instead performed on a save-attempted-write (SAW) record, and causing a response to be generated to a read-back request of the particular data record with a false data read incorporating contents of the written-to SAW record.
2. The non-transitory machine accessible storage medium of claim 1 , wherein the API facilitates the set of secure storage operations for any one of a host-based secure storage capability, a chipset-based secure storage capability, and the firmware-based secure storage capability.
3. The non-transitory machine accessible storage medium of claim 1 , wherein the particular secure storage operation includes a direct read of a particular one of the data records, the instructions further cause the machine to communicate content of the particular data obtained through the direct read to the security tool, and the particular data record is to be rewritten through an instance of the direct write operation.
4. The non-transitory machine accessible storage medium of claim 1 , wherein the particular secure storage operation comprises an instance of the copy-on-write operation.
5. The non-transitory machine accessible storage medium of claim 4 , wherein causing the particular secure storage operation further comprises causing the particular data record, following the attempted write operation, to be remediated by replacing data of the written-to particular data record with data of the copy-on-write backup.
6. The non-transitory machine accessible storage medium of claim 5 , wherein the data of the written-to particular data record is replaced with the data of the copy-on-write backup through a direct write operation.
7. The non-transitory machine accessible storage medium of claim 1 , wherein the particular secure storage operation further comprises causing the attempted write operation to be allowed after saving the attempted write operation, and using contents of the SAW record to allow the attempted write operation.
8. The non-transitory machine accessible storage medium of claim 1 , wherein the set of secure storage operations includes a false data read operation.
9. The non-transitory machine accessible storage medium of claim 1 , wherein the set of secure storage operations includes a data range lockdown operation.
10. The non-transitory machine accessible storage medium of claim 1 , wherein the instructions when executed on the machine, further cause the machine to receive feedback data from the secure storage device via the API, wherein the feedback data describes results of the particular secure storage operation.
11. The non-transitory machine accessible storage medium of claim 10 , wherein the feedback data is to be included in a callback.
12. The non-transitory machine accessible storage medium of claim 10 , wherein the feedback is to be included in a log generated by the secure storage platform.
13. A method comprising:
receiving, at a disk access security agent, a request from a security tool, the request relating to an event involving data records in a particular one of a plurality of storage devices, wherein each of the plurality of storage devices possesses local secure storage functionality and the disk access security agent has protected access to a common application programming interface (API) to interface with any one of the plurality of storage devices and invoke, through the common API, any one of a set of secure storage operations to be performed locally at the respective storage device, wherein the set of secure storage operations are defined through the common API; and
using the common API to interface with secure storage functionality of the particular storage device to invoke a particular one of the set of secure storage operations at the particular storage device based at least in part on the request, wherein the set of secure storage operations comprises a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation,
wherein the copy-on-write operation comprises identifying an attempted write operation of a particular one of the data records and, prior to allowing the attempted write operation, copying data of the one or more data records to a copy-on-write backup location, and
wherein the save-attempted-write operation comprises disallowing an attempted write operation on a first record, causing the write operation to be instead performed on a save-attempted-write (SAW) record, and causing a response to be generated to a read-back request of the particular data record with a false data read incorporating contents of the written-to SAW record.
14. A system comprising:
a processor device;
a secure storage-enabled storage device including logic to perform a set of secure storage operations at records of the storage device, wherein the set of secure storage operations comprises a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation;
a common application programming interface (API) to interface with any one of the plurality of storage devices and define a set of secure storage operations;
a disk access security agent, when executed by the processor device to:
receive a request from a security tool, the request relating to an event involving data records in a particular one of a plurality of secure storage-enabled storage devices, wherein the disk access security agent has protected access to the common API; and
use the common API to interface with secure storage functionality of the particular storage device to invoke a particular one of the set of secure storage operations at the particular storage device based at least in part on the request,
wherein the copy-on-write operation comprises identifying an attempted write operation of a particular one of the data records and, prior to allowing the attempted write operation, copying data of the one or more data records to a copy-on-write backup location, and
wherein the save-attempted-write operation comprises disallowing an attempted write operation on a first record, causing the write operation to be instead performed on a save-attempted-write (SAW) record, and causing a response to be generated to a read-back request of the particular data record with a false data read incorporating contents of the written-to SAW record.
15. The system of claim 14 , wherein the set of secure storage operations further comprise an allow write operation, and a block write operation.
16. The system of claim 15 , wherein the set of secure storage operations further comprise a false data read operation and a false write success operation.