Granted Patent B2

US 10,162,767 · App. 14/752,914 · Granted Dec 25, 2018

Abstract

Claims (55)

1. At least one non-transitory machine readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:

receive a request from a process to access data in a system;

determine whether the data is in a virtualized protected area of memory in the system, wherein the virtualized protected area of memory is a secure storage area and wherein the data is stored unencrypted; and

responsive to determining that the data is not in a virtualized protected area of memory, allow access to the data; or

responsive to determining that the data is in a virtualized protected area of memory, determine whether the process is a trusted process; and

allow access to the data based on a determination that the data is in the virtualized protected area of memory and the process is a trusted process.

2. The at least one non-transitory machine readable medium of claim 1 , further comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:

determine whether new data should be protected;

store the new data unencrypted in the virtualized protected area of memory in the system based on a determination that the new data should be protected; and

store the new data in an unprotected area of memory in the system based on a determination that the new data should not be protected.

3. The at least one non-transitory machine readable medium of claim 1 , wherein the virtualized protected area of memory is a secured vault.

4. The at least one machine non-transitory readable medium of claim 1 , wherein the virtualized protected area of memory is a cloud vault.

5. The at least one non-transitory machine readable medium of claim 1 , wherein a filter driver controls input and output access to the virtualized protected area of memory.

6. An apparatus comprising:

a hardware processor configured to:

receive a request from a process to access data in a system;

determine whether the data is in a virtualized protected area of memory in the system, wherein the virtualized protected area of memory is a secure storage area and wherein the data is stored unencrypted; and

responsive to determining that the data is not in a virtualized protected area of memory, allow access to the data; or

responsive to determining that the data is in a virtualized protected area of memory, determine whether the process is a trusted process; and

allow access to the data based on a determination that the data is in the virtualized protected area of memory and the process is a trusted process.

7. The apparatus of claim 6 , wherein the hardware processor is further configured to:

determine whether new data should be protected;

store the new data unencrypted in the virtualized protected area of memory in the system based on a determination that the new data should be protected; and

store the new data in an unprotected area of memory in the system based on a determination that the new data should not be protected.

8. The apparatus of claim 6 , wherein the virtualized protected area of memory is a secured vault.

9. The apparatus of claim 6 , wherein the virtualized protected area of memory is a cloud vault.

10. The apparatus of claim 6 , wherein a filter driver controls input and output access to the virtualized protected area of memory.

11. A method comprising:

receiving a request from a process to access data in a system;

determining whether the data is in a virtualized protected area of memory in the system, wherein the virtualized protected area of memory is a secure storage area and wherein the data is stored unencrypted; and

responsive to determining that the data is not in a virtualized protected area of memory, allowing access to the data; or

responsive to determining that the data is in a virtualized protected area of memory, determining whether the process is a trusted process; and

allowing access to the data based on a determination that the data is in the virtualized protected area of memory and the process is a trusted process.

12. The method of claim 11 , further comprising:

determining whether new data should be protected;

storing the new data unencrypted in the virtualized protected area of memory in the system based on a determination that the new data should be protected; and

storing the new data in an unprotected area of memory in the system based on a determination that the new data should not be protected.

13. The method of claim 11 , wherein the virtualized protected area of memory is a secured vault.

14. The method of claim 11 , wherein the virtualized protected area of memory is a cloud vault.

15. The method of claim 11 , further comprising:

denying access to the data based on a determination that the data is in the virtualized protected area of memory and the process is an untrusted process.

16. A system for virtualized trusted secure storage, the system comprising:

a hardware processor configured to:

receive a request from a process to access data in a system;

determine whether the data is in a virtualized protected area of memory in the system, wherein the virtualized protected area of memory is a secure storage area and wherein the data is stored unencrypted; and

responsive to determining that the data is not in a virtualized protected area of memory, allow access to the data; or

responsive to determining that the data is in a virtualized protected area of memory, determine whether the process is a trusted process; and

allow access to the data based on a determination that the data is in the virtualized protected area of memory and the process is a trusted process.

17. The system of claim 16 , wherein the system is further configured to:

determine whether new data should be protected;

store the new data unencrypted in the virtualized protected area of memory in the system based on a determination that the new data should be protected; and

store the new data in an unprotected area of memory in the system based on a determination that the new data should not be protected.

18. The system of claim 16 , wherein the virtualized protected area of memory is a secured vault.

19. The system of claim 16 , wherein the virtualized protected area of memory is a cloud vault.

20. The system of claim 16 , wherein a filter driver controls input and output access to the virtualized protected area of memory.

Assignments (10)

Cited By (9)

US 12,231,464 US 12,267,304 US 12,267,355 US 12,284,206 US 12,299,117 US 12,348,494 US 12,381,890 US 12,519,754 US 12,647,362