US20080250487A1 - Systems For Firewall Protection Of Mass Storage Devices - Google Patents

Systems For Firewall Protection Of Mass Storage Devices Download PDF

Info

Publication number
US20080250487A1
US20080250487A1 US11/769,757 US76975707A US2008250487A1 US 20080250487 A1 US20080250487 A1 US 20080250487A1 US 76975707 A US76975707 A US 76975707A US 2008250487 A1 US2008250487 A1 US 2008250487A1
Authority
US
United States
Prior art keywords
firewall
urd
host system
storage memory
program code
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US11/769,757
Inventor
Ittai Golde
Alexander Paley
Leonid Shmulevich
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
SanDisk IL Ltd
Original Assignee
SanDisk IL Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US91070807P priority Critical
Application filed by SanDisk IL Ltd filed Critical SanDisk IL Ltd
Priority to US11/769,757 priority patent/US20080250487A1/en
Assigned to SANDISK IL LTD. reassignment SANDISK IL LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: GOLDE, ITTAI, PALEY, ALEXANDER, SHMULEVICH, LEONID
Assigned to SANDISK IL LTD. reassignment SANDISK IL LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: GOLDE, ITTAI, PALEY, ALEXANDER, SHMULEVICH, LEONID
Publication of US20080250487A1 publication Critical patent/US20080250487A1/en
Application status is Abandoned legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/79Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories

Abstract

The present invention discloses a URD including: a non-volatile storage memory having program code, wherein said program code is configured to enable a network protocol for communicating with a host system; and a controller for controlling operations performed on said storage memory. Preferably, the storage memory includes flash memory. A URD including: a host system having a firewall; and a URD having a non-volatile storage memory, wherein said storage memory includes program code, and wherein said program code is configured to enable a network protocol, said URD operationally connected to said host system; wherein said firewall is configured to provide security measures related to said URD. Preferably, the firewall is a software firewall or a hardware firewall.

Description

    RELATED APPLICATIONS
  • This patent application claims priority under 35 U.S.C. §119(e) to U.S. Provisional Application No. 60/910,708, filed Apr. 9, 2007, which is hereby incorporated by reference in its entirety.
  • This patent application is related to U.S. patent application Ser. No. ______ of the same inventors, which is entitled “METHODS FOR FIREWALL PROTECTION OF MASS-STORAGE DEVICES” and filed on the same day as the present application. This patent application, also claiming priority to U.S. Provisional Application No. 60/910,708, is incorporated in its entirety as if fully set forth herein.
  • FIELD AND BACKGROUND OF THE INVENTION
  • The present invention relates to systems for protecting a host system from information-security risks posed by mass-storage devices by routing communication through a network protocol, and by applying a firewall.
  • USB flash drives (UFDs) are well-known devices for providing portable data storage. UFDs are typically configured to be interchangeably connected to multiple computers. Because of this feature, UFDs pose an inherent information-security risk to a host computer. Such a risk necessitates implementation of security measures.
  • The prior art offers a variety of security measures for protecting host computers from risks associated with portable data-storage devices. Examples of such security measures include anti-virus programs and the mTrust solution (available from SanDisk IL Ltd., Kefar Saba, Israel).
  • The prior-art solutions suffer from inherent limitations that reduce their value. The prior art is typically configured to handle only one type of security risk. Anti-virus tools are typically limited to deal only with viruses, while mTrust-type solutions are limited to address risks associated primarily with access control.
  • It would be desirable to have an information-security system for protecting a host system from a broad array of information-security risks posed by a UFD security, while complying with the information-security policy of the host-system user.
  • SUMMARY OF THE INVENTION
  • It is the purpose of the present invention to provide systems for protecting a host system from information-security risks posed by mass-storage devices by routing communication through a network protocol, and by applying a firewall.
  • For the purpose of clarity, several terms which follow are specifically defined for use herein. The term “network protocol” is used herein to refer to a communication protocol from the network layer of an OSI (Open Systems Interconnection) network architecture, and more specifically herein, the internet protocol (IP). The terms “USB removable drive” and “URD” are used herein to refer to a removable drive that has a non-volatile storage memory and a controller. A UFD is a special type of URD in which flash memory is utilized.
  • The term “traffic” is used herein to refer to activity over a communication system during a given period of time. The terms “demilitarized zone” and “DMZ” are used herein to refer to a part of a network that is neither part of the internal network, nor directly part of the internet. The term “firewall” is used herein to refer to a gateway that limits access between networks in accordance with local access-security policies.
  • The present invention teaches systems, and methods for implementing such systems, that reside in a URD, and emulate a network drive for a host system. The network-drive emulation is performed by changing firmware residing in the URD controller, and by enabling the URD as a network device on the Microsoft™ Windows™ operating system (OS). The URD is identified as a network device, and can be accessed by various file-access protocols (e.g. HTTP, FTP, and SMB). The network device is designated by a drive letter or as a file server (as is well-known in the art of computer engineering, and integrated in the Windows OS).
  • Network drives are common devices for protecting using ordinary firewall systems (e.g. McAfee Personal Firewall, available from McAfee Corporation, Sunnyvale, Calif.). Once the host system, equipped with a firewall, detects a storage device as a network storage device, the host system applies all the pertinent rules of the associated firewall, thereby protecting the host system from attacks such as unauthorized access.
  • Therefore, according to the present invention, there is provided for the first time a URD) including: (a) a non-volatile storage memory having program code, wherein said program code is configured to enable a network protocol for communicating with a host system; and (b) a controller for controlling operations performed on said storage memory.
  • Preferably, the storage memory includes flash memory.
  • According to the present invention, there is provided for the first time a URD including: (a) a host system having a firewall; and (b) a URD having a non-volatile storage memory, wherein said storage memory includes program code, and wherein said program code is configured to enable a network protocol, said URD operationally connected to said host system; wherein said firewall is configured to provide security measures related to said URD).
  • Preferably, the firewall is a software firewall or a hardware firewall.
  • These and further embodiments will be apparent from the detailed description and examples that follow.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • The present invention is herein described, by way of example only, with reference to the accompanying drawings, wherein:
  • FIG. 1 is a simplified block diagram of a host system having firewall protection from a mass-storage device, according to preferred embodiments of the present invention;
  • FIG. 2A is a simplified block diagram of a URD, according to the prior art;
  • FIG. 2B is a simplified block diagram of a URD, according to preferred embodiments of the present invention;
  • FIG. 3 is a simplified flowchart of the operation of a host system having firewall protection from a mass-storage device, according to preferred embodiments of the present invention.
  • DESCRIPTION OF THE PREFERRED EMBODIMENTS
  • The present invention relates to systems for protecting a host system from information-security risks posed by mass-storage devices by routing communication through a network protocol, and by applying a firewall. The principles and operation for protecting a host system from information-security risks posed by mass-storage devices, according to the present invention, may be better understood with reference to the accompanying description and the drawings.
  • Referring now to the drawings, FIG. 1 is a simplified block diagram of a host system having firewall protection from a mass-storage device, according to preferred embodiments of the present invention. A host system 20, having three USB connectors 22 is shown in FIG. 1. A USB mouse 24, a USB keyboard 26, and a URD 28 are shown each operationally connected to one connector 22. A network 32 (e.g. a local-area network and the Internet) is accessible via a network connection 34.
  • Host system 20 is equipped with a firewall 36. Firewall 36 can be a software firewall (e.g. MacAfee Personal Firewall), or a hardware firewall (e.g. Cisco PIX Firewall 515E available from Cisco, San Jose, Calif.). The area beyond firewall 36, typically called a DMZ 38, serves to connect host system 20 with the external world. Traffic from the peripherals (i.e. USB mouse 24, USB keyboard 26, and URD 28) flows into a CPU 40. Connection of host system 20 with the external world is typically performed via a network card 42, operationally connected to network connection 34, and ultimately to network 32. The functionality of firewall 36 in protecting host system 20 from unauthorized access is well-known in the art, and is not described herein.
  • An essential feature of the present invention is the connection of a local peripheral 30, typically a URD or other mass-storage device, to DMZ 38 of host system 20. Such a configuration requires that peripheral 30 be recognized by host system 20 as a network device, and not as a mass-storage device (such as URD 28). In such a configuration, systems of the present invention require URD 30 to meet the requirements of the security features of firewall 36, which are strong and well-maintained.
  • To summarize, there are two differences between a URD (e.g. URD 28) connected directly to host system 20, and a URD (e.g. 30) connected to DMZ 38:
      • (1) the communication protocol—URD 28 is a mass-storage class device, while peripheral 30 is a simulated network device; and
      • (2) the level of security of host system 20 from device-related risks—host system 20 does not have any security measures against URD 28, but has full firewall protection against peripheral 30.
  • FIG. 2A is a simplified block diagram of a URD, according to the prior art. A URD 50, having a non-volatile storage memory 52, a flash controller 54, a mass-storage class protocol 56, and a USB connector 58, is shown in FIG. 2A. Data is written and read via USB connector 58, and encoded via mass-storage class protocol 56. Flash controller 54 encodes and decodes the data provided from mass-storage class protocol 56, and writes the data to storage memory 52.
  • FIG. 2B is a simplified block diagram of a URD, according to preferred embodiments of the present invention. A URD 60, having a non-volatile storage memory 62, a flash controller 64, a network protocol 66, and a USB connector 68, is shown in FIG. 213. Data is written and read via USB connector 68, and encoded via network protocol 66. Flash controller 64 encodes and decodes the data provided from network protocol 66, and writes the data to storage memory 62. Clearly, systems according to the present invention enable firewall security measures to be applied to URD 60.
  • FIG. 3 is a simplified flowchart of the operation of a host system having firewall protection from a mass-storage device, according to preferred embodiments of the present invention. A URD is operationally connected to the host system (Step 70). A network protocol of the URD designates the URD as a network device on the host system (Step 72). A firewall residing in the host system detects the URD network device (Step 74). Communication between the URD and the host system is mediated by security measures of the firewall (Step 76). It is noted that the firewall can also be configured to restrict access of a specific application to the URD.
  • While the invention has been described with respect to a limited number of embodiments, it will be appreciated that many variations, modifications, and other applications of the invention may be made.

Claims (5)

1. A URD comprising:
(a) a non-volatile storage memory having program code, wherein said program code is configured to enable a network protocol for communicating with a host system; and
(b) a controller for controlling operations performed on said storage memory.
2. The URD of claim 1, wherein said storage memory includes flash memory.
3. A system comprising:
(a) a host system having a firewall; and
(b) a URD having a non-volatile storage memory, wherein said storage memory includes program code, and wherein said program code is configured to enable a network protocol, said URD operationally connected to said host system;
wherein said firewall is configured to provide security measures related to said URD.
4. The system of claim 3, wherein said firewall is a software firewall.
5. The system of claim 3, wherein said firewall is a hardware firewall.
US11/769,757 2007-04-09 2007-06-28 Systems For Firewall Protection Of Mass Storage Devices Abandoned US20080250487A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US91070807P true 2007-04-09 2007-04-09
US11/769,757 US20080250487A1 (en) 2007-04-09 2007-06-28 Systems For Firewall Protection Of Mass Storage Devices

Applications Claiming Priority (7)

Application Number Priority Date Filing Date Title
US11/769,757 US20080250487A1 (en) 2007-04-09 2007-06-28 Systems For Firewall Protection Of Mass Storage Devices
CN 200880014890 CN101720545A (en) 2007-04-09 2008-04-06 System and methods for using firewall protection with usb storage devices
KR1020097021044A KR20100015439A (en) 2007-04-09 2008-04-06 System and methods for using firewall protection with usb storage devices
PCT/IL2008/000473 WO2008122976A1 (en) 2007-04-09 2008-04-06 System and methods for using firewall protection with usb storage devices
EP20080738177 EP2145444B1 (en) 2007-04-09 2008-04-06 System and methods for using firewall protection with usb storage devices
JP2010502634A JP5204211B2 (en) 2007-04-09 2008-04-06 System and method for using firewall protection on a USB storage device
TW97112662A TW200907788A (en) 2007-04-09 2008-04-08 Systems and methods for firewall protection of mass-storage devices

Publications (1)

Publication Number Publication Date
US20080250487A1 true US20080250487A1 (en) 2008-10-09

Family

ID=39828142

Family Applications (3)

Application Number Title Priority Date Filing Date
US11/769,760 Active 2030-10-10 US8806604B2 (en) 2007-04-09 2007-06-28 Methods for firewall protection of mass-storage devices
US11/769,757 Abandoned US20080250487A1 (en) 2007-04-09 2007-06-28 Systems For Firewall Protection Of Mass Storage Devices
US11/776,627 Abandoned US20080250489A1 (en) 2007-04-09 2007-07-12 Systems For Firewall Protection Of Mass Storage Devices

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US11/769,760 Active 2030-10-10 US8806604B2 (en) 2007-04-09 2007-06-28 Methods for firewall protection of mass-storage devices

Family Applications After (1)

Application Number Title Priority Date Filing Date
US11/776,627 Abandoned US20080250489A1 (en) 2007-04-09 2007-07-12 Systems For Firewall Protection Of Mass Storage Devices

Country Status (7)

Country Link
US (3) US8806604B2 (en)
EP (1) EP2145444B1 (en)
JP (1) JP5204211B2 (en)
KR (1) KR20100015439A (en)
CN (1) CN101720545A (en)
TW (1) TW200907788A (en)
WO (1) WO2008122976A1 (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102752321A (en) * 2012-08-07 2012-10-24 广州微仕科信息技术有限公司 Firewall realization method based on multicore network processor

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6654817B1 (en) * 2000-09-01 2003-11-25 Abocom Systems, Inc. Integral peripheral device of USB local network card and USB modem
US20050083968A1 (en) * 2003-10-17 2005-04-21 Asix Electronics Corporation Ltd. Burst transfer mechanism of network packets having MAC frames over USB bus
US20080082714A1 (en) * 2006-09-29 2008-04-03 Nasa Hq's. Systems, methods and apparatus for flash drive
US7632113B2 (en) * 2003-11-17 2009-12-15 Dpd Patent Trust Ltd. Retractable USB stick

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6088802A (en) 1997-06-04 2000-07-11 Spyrus, Inc. Peripheral device with integrated security functionality
US6907533B2 (en) * 2000-07-14 2005-06-14 Symantec Corporation System and method for computer security using multiple cages
CN1751479A (en) * 2002-12-11 2006-03-22 Para3公司 Communication system, communication terminal comprising virtual network switch and portable electronic device comprising organism recognition unit
JP4308551B2 (en) * 2003-03-06 2009-08-05 株式会社ルネサステクノロジ Memory card and host device
TWM261812U (en) 2003-07-15 2005-04-11 Jeng-Fu Weng Wireless anti-theft lock structure of portable memory
US7213766B2 (en) 2003-11-17 2007-05-08 Dpd Patent Trust Ltd Multi-interface compact personal token apparatus and methods of use
US20050149213A1 (en) * 2004-01-05 2005-07-07 Microsoft Corporation Media file management on a media storage and playback device
US7490350B1 (en) * 2004-03-12 2009-02-10 Sca Technica, Inc. Achieving high assurance connectivity on computing devices and defeating blended hacking attacks
US7523317B2 (en) * 2004-04-29 2009-04-21 International Business Machines Corporation Computer grid access management system
GB2417107A (en) * 2004-06-08 2006-02-15 Pranil Ram Computer apparatus with added functionality
AU2005222507B2 (en) 2004-10-15 2010-10-28 Microsoft Corporation Portable computing environment
US7500024B2 (en) 2005-02-25 2009-03-03 Sandisk Il Ltd. Signaling to a peripheral via irregular read operations

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6654817B1 (en) * 2000-09-01 2003-11-25 Abocom Systems, Inc. Integral peripheral device of USB local network card and USB modem
US20050083968A1 (en) * 2003-10-17 2005-04-21 Asix Electronics Corporation Ltd. Burst transfer mechanism of network packets having MAC frames over USB bus
US7632113B2 (en) * 2003-11-17 2009-12-15 Dpd Patent Trust Ltd. Retractable USB stick
US20080082714A1 (en) * 2006-09-29 2008-04-03 Nasa Hq's. Systems, methods and apparatus for flash drive

Also Published As

Publication number Publication date
KR20100015439A (en) 2010-02-12
TW200907788A (en) 2009-02-16
US20080250488A1 (en) 2008-10-09
JP2010524114A (en) 2010-07-15
US20080250489A1 (en) 2008-10-09
US8806604B2 (en) 2014-08-12
EP2145444A1 (en) 2010-01-20
EP2145444B1 (en) 2014-03-26
WO2008122976B1 (en) 2008-12-24
WO2008122976A1 (en) 2008-10-16
JP5204211B2 (en) 2013-06-05
CN101720545A (en) 2010-06-02

Similar Documents

Publication Publication Date Title
US10120572B2 (en) Computing device with a separate processor provided with management functionality through a separate interface with the interface bus
US7580701B2 (en) Dynamic passing of wireless configuration parameters
US6748541B1 (en) User-computer interaction method for use by a population of flexibly connectable computer systems
US8627476B1 (en) Altering application behavior based on content provider reputation
CN100555298C (en) Method and device for virtulizing personal office environment
CN102420846B (en) Remote access to hosted virtual machines by enterprise users
US8539582B1 (en) Malware containment and security analysis on connection
US8024482B2 (en) Dynamic firewall configuration
EP1248179A1 (en) Selective activation and deactivation of peripheral devices connected to a USB system
CN1585410B (en) Providing SCSI device access over a network
US20090319806A1 (en) Extensible pre-boot authentication
TWI545446B (en) Drive to a common network with use of the method and system
US20080114990A1 (en) Usable and secure portable storage
TWI442240B (en) Universal serial bus-hardware firewall (usb-hf) adaptor
CN101361082B (en) System and method for secure remote desktop access
JP5306679B2 (en) Wormhole device for secure access available to remote resources
TWI389006B (en) Method, apparatus and system for authentication of external storage devices
JP6523463B2 (en) System and method for monitoring a virtual network
US20130318594A1 (en) Internet isolation for avoiding internet security threats
CN103262024B (en) Methods and systems for forcing an application to store data in a secure storage location
US20070240155A1 (en) Portable platform for executing software applications in a virtual environment
CN1260642C (en) Method for transmitting command and data to portable storage device
US9094400B2 (en) Authentication in virtual private networks
RU2365988C2 (en) Provision for protected input into system with highly reliable program execution environment
WO2011060190A1 (en) Apparatus and method for securing and isolating operational nodes in a computer network

Legal Events

Date Code Title Description
AS Assignment

Owner name: SANDISK IL LTD., ISRAEL

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GOLDE, ITTAI;PALEY, ALEXANDER;SHMULEVICH, LEONID;REEL/FRAME:019491/0591

Effective date: 20070624

AS Assignment

Owner name: SANDISK IL LTD., ISRAEL

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GOLDE, ITTAI;PALEY, ALEXANDER;SHMULEVICH, LEONID;REEL/FRAME:020154/0968

Effective date: 20071122

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION