Patent ID: 8601265
Filing Date: 2013-12-03
Classification: G06F,H04L

Abstract:
1. A method of improving storage security in a cloud environment comprising: interfacing a secure microcontroller with a storage controller associated with a client device in the cloud environment to authenticate a platform associated with the storage controller; wherein interfacing the secure microcontroller with the storage controller includes: incorporating the secure microcontroller on a motherboard associated with the storage controller; rendering a Basic Input/Output System (BIOS) on the storage controller to be aware of a hardware associated with the secure microcontroller; and communicating with the authentication server through an application configured to be aware of the hardware associated with the secure microcontroller during registration and authentication of the storage controller, the application being configured to communicate with the secure microcontroller and the BIOS on the storage controller through an appropriate device driver; and registering the storage controller with an authentication server configured to be set up in the cloud environment; authenticating the storage controller based on a communication protocol between the client device, the authentication server and the storage controller; and obtaining, at the client device, a signature data of the storage controller following the authentication thereof, the signature data being configured to be stored in the secure microcontroller interfaced with the storage controller; wherein the signature data of the storage controller includes a list of hashes of at least one of a version of the BIOS on the storage controller, a storage operating system version executing on the storage controller, a physical hardware identification attribute of the storage controller and a configuration information associated with the storage controller; and wherein registering the storage controller with the authentication server includes: transmitting a nonce as a challenge message from the storage controller to the authentication server; transmitting, from the authentication server to the storage controller, the signature data of the authentication server, the nonce received from the storage controller and a second nonce encrypted using a private key at the authentication server upon receipt of the challenge message from the storage controller; decrypting the message from the authentication server at the storage controller using a public portion of a key shared therebetween; transmitting, in a message, the signature data of the storage controller to the authentication server and the second nonce encrypted using a private key at the storage controller when the message from the authentication server includes the nonce transmitted from the storage controller as the challenge message, and when the authentication server is authenticated based on the signature data thereof; decrypting, at the authentication server, the message from the storage controller including the signature data thereof using the public portion of the key; and transmitting a confirmation message from the authentication server to the storage controller indicating that the storage controller is trusted when the second nonce is matched in the decrypted message, and when the signature data of the storage controller is matched in a database associated with the authentication server.