Spyrus, Inc.

Gregory W Dalcher

Gregg Daniel Weissman

Mark James Sutherland

James E Zmuda

Jay H Hoffmeier

Hon Tran

Michael T Guttman

A method provides a protected region of a data storage device associated with a computational device, where data in the protected region is primarily protected by preventing access without proper access authorization. The method comprises the steps of providing, in an unprotected region of the data storage device, a first operating system and associated operating system data; monitoring operating system data accessed by the computational device until a predetermined functionality becomes available; storing, in the protected region, the monitored operating system data; providing, in the protected region, a second operating system; transferring control of the computational device from the first operating system to the second operating system; storing data in the protected region; and preventing access to the stored data in the protected region without access authorization. In a further embodiment of the method, the second operating system optionally provides a second level of security by preventing decryption of data stored in the protected region without decryption authorization.

Protected volume on a data storage device with dual operating systems and configurable access and encryption controls

The invention establishes a protected volume on a data storage device associated with a computational device by allowing an operating system of the computational device to boot up to a point (the volume conversion crossover point) at which predetermined functionality of the operating system becomes available, then establishing the protected volume. A copy of the operating system data (cleartext operating system data) that is accessed during boot up prior to the volume conversion crossover point (which can be known by monitoring and recording access to operating system data during boot-up) is stored in an unprotected region of the data storage device. A copy of the cleartext operating system data is also stored in the protected volume. After the protected volume is established, the computational device is reset, causing the operating system to boot up again. During each boot-up of the operating system after the protected volume has been established, the cleartext operating system data is used until the volume conversion crossover point, at which time operation of the computational device converts to a secure mode (if authorized) in which data stored on the data storage device can be accessed from the protected volume (including the copy of the cleartext operating system data that is stored in the protected volume).

Providing a protected volume on a data storage device

The invention mediates use of a computer resource by multiple events that seek to use the computer resource at the same time. In particular, the invention mediates such use by events that seek to use the computer resource at times that are not known until access to the computer resource is sought. Advantageously, the invention enables mediation of the use of a computer resource when typical operating system functionality provided for that purpose is ineffective. The invention allows work initiated by an event granted access to a resource to be completed by a different, interrupting event.

Growing community of inventors

Placerville, CA, United States of America

Gregory W Dalcher