Root of trust assisted access control of secure encrypted drives
A system for data protection includes a computing device comprising a processor, a Hardware Root of Trust (HRoT) module and a storage device. The HRoT device is configured to: validate integrity of the computing device; authenticate the computing device to communicate with the storage device; and take over control of storage device access and behaviour whenever suspicious or unauthorized data access from local or remote computing devices is detected. The HRoT device is further configured to, in response to detecting a security risk to at least one of the computing device and the storage device, block communication of the storage device.
1. A system for data protection, the system comprising:
a computing device comprising a processor, a Hardware Root of Trust (HRoT) device, and a storage device,
wherein the HRoT device is configured to inject a Software Root of Trust (RoT) instance configured to run on the processor and send an alert signal to the HRoT device in response to detecting a security attack to at least one of the computing device and the storage device, the SRoT instance being different than the HRoT, and wherein the HRoT device and the SRoT instance operate to:
validate integrity of the computing device;
authenticate the computing device to communicate with the storage device; and
take over control of the storage device in response to detecting a security risk to at least one of the computing device and the storage device.
2. The system of claim 1 , wherein the HRoT device validates integrity of the computing device by validating one or more of a firmware of the computing device, a firmware of operating system running on the computing device, and a kernel space of the operating system.
3. The system of claim 1 , wherein the HRoT device provides a Trusted Execution Environment (TEE).
4. The system of claim 3 , wherein the HRoT device loads and executes a security monitoring application in the TEE.
5. The system of claim 1 , wherein the HRoT device, in response to detecting a security risk to at least one of the computing device and the storage device, blocks communication of the storage device.
6. The system of claim 1 , wherein the storage device comprises a Secure Encrypted Drive (SED).
7. The system of claim 1 , wherein the HRoT device controls data hosted on a cloud-based storage service, NAS, and/or SAN storage.
8. The system of claim 1 , wherein the security risk comprises a suspicious or unauthorized data access from a remote device or from inside of the computing device.
9. A method of protecting data, comprising:
employing a computing device comprising a processor, a Hardware Root of Trust (HRoT) device, and a storage device,
wherein the HRoT device is configured to inject a Software Root of Trust (RoT) instance configured to run on the processor and send an alert signal to the HRoT device in response to detecting a security attack to at least one of the computing device and the storage device, the SRoT instance being different than the HRoT, and wherein the HRoT device and the SRoT instance are operable to perform a process comprising:
validating integrity of the computing device;
authenticating the computing device to communicate with the storage device; and
taking over control of the storage device in response to detecting a security risk to at least one of the computing device and the storage device.
10. The method of claim 9 , wherein the HRoT device validates integrity of the computing device by validating one or more of a firmware of the computing device, a firmware of operating system running on the computing device, and a kernel space of the operating system.
11. The method of claim 9 , wherein the HRoT device provides a Trusted Execution Environment (TEE).
12. The method of claim 11 , wherein the HRoT device loads and executes a security monitoring application in the TEE.
13. The method of claim 9 , wherein the HRoT device, in response to detecting a security risk to at least one of the computing device and the storage device, blocks communication of the storage device.
14. The method of claim 9 , wherein the HRoT device controls data hosted on a cloud-based storage service, NAS, and/or SAN storage.
15. The method of claim 9 , wherein the security risk comprises a suspicious or unauthorized data access from a remote device or from inside of the computing device.