Abstract: A computer-implemented method is presented for session-based and secure access control to a data storage system, comprising: detecting an activation signal for initiating access to the data storage system; and at least one write session to write write session-related data to the data storage system. Each of the at least one write sessions comprises: in response to detecting the activation signal, selectively assigning a storage subarea to this write session; receiving or generating the data to be written in the context of the write session; protecting the data from later unauthorized access using an access protection assigned individually to the write session; and outputting the access-protected data in order to write it to the storage subarea of the data storage system that is selectively assigned to the write session, or to cause this to be done.

Abstract: A method for secure access control to a data storage system for a host apparatus by means of an access control device, the method comprising: as part of a first mode of operation of the access control device, receiving user data from the host apparatus and transmitting it in unmodified or modified form to the data storage system for local storage; exchanging a first cryptographic secret with a computer system to enable encryption of data by the access control device in dependence on the first cryptographic secret; receiving a data read request for at least a portion of the user data stored in the data storage system; in response to the data read request, transitioning the access control device to a second mode of operation in which the access control device is configured to perform read access but not write or delete access to the data storage system; and in the second operating mode, retrieving user data requested according to the data read request from the data storage system, encrypting them using the firs