KR20180107775A - Data security system using encryption - Google Patents

Abstract

A data security system and method of operation thereof includes a data security transceiver or receiver; An authentication subsystem operatively coupled to the data security transceiver or receiver; And a storage subsystem coupled to the authentication subsystem.

Description

Data security system using encryption

Cross-reference to related application (s)

This application claims the benefit of U.S. Provisional Patent Application No. 60 / 975,814, filed on September 27, 2007, the subject of which is incorporated herein by reference. This application is a continuation-in-part of PCT / US2008 / Priority is claimed on co-pending U.S. Provisional Patent Application No. 12 / 680,742, filed March 29, 2010, the continuation-in-part of U.S. Patent Application No. 07 / 077,780, filed on January 4, 2016, do.

This application is a continuation of US patent application entitled " DATA SECURITY SYSTEM WITH ENCRYPTION "by Lev M. Bolotin and Simon B. Johnson. The related application is assigned to ClevX, LLC and is identified by attorney docket number 502-018P-PCT-US.C1. The subject matter of which is incorporated herein by reference.

Technical field

The present invention relates generally to electronic devices, and more particularly to memory devices.

Security is an important issue in almost every aspect of computer use. Storage media such as hard disk drives connected to computers contain valuable information that is vulnerable to data theft. A lot of money and effort is being put into protecting personal, corporate and government security information.

As portable memory storage devices have become smaller, easier to lose, more ubiquitous, cheaper, and larger in memory capacity, they have introduced unique security problems. It is currently being used in a wide range of applications including general purpose serial bus flash and micro drives, cell phones, camcorders, digital cameras, iPODs, MP3 / 4 players, smart phones, palm and laptop computers, ) Tokens, and the like - usually a mass storage device (MSD).

More specifically, millions of MSDs are being used for backup, transmission, intermediate storage, and primary storage, where information can be easily downloaded from a computer and taken away. The main purpose of all MSDs is to store and retrieve "portable content" data and information associated with a specific owner, not a specific computer.

The most common means of providing repository security is to authenticate the user with a password that is entered into the computer. The password is validated against the MSD stored value. If a match occurs, the drive will open. Or the password itself is used as the encryption key to encrypt / decrypt the data stored in the MSD.

For drives that support on-the-fly encryption, encryption keys are often stored on the media in encrypted form. Because the encryption key is stored on the media, it is readily available to those who want to bypass the standard interface and read the media directly. Therefore, the password is used as a key for encrypting the encryption key.

For self-certified drives, their authentication subsystem is responsible for maintaining security. There is no dependency on the host computer to which it is connected. Thus, the password can not (or need to be) transmitted from the host to unlock the MSD. In fact, the encryption key no longer needs to be stored on the media. The authentication subsystem serves as means for managing the encryption key.

Therefore, there is still a need to improve security. It is important to find answers to these questions in light of the ever-increasing commercial competitive pressures as well as consumer expectations for meaningful product differentiation in the marketplace, reduced opportunities. The need to reduce costs, improve efficiency and performance, and respond to competitive pressures adds to the urgent need to address these challenges.

Solutions to these problems have long been sought, but prior art developments have not taught or suggested any solutions, and solutions to these problems have not been available to the artisan in the art for a long time.

The invention provides a method comprising: providing a data security system application to a mobile device for connectivity with the data security system; Initiating a data security system application; And maintaining connectivity between the mobile device and the data security system.

The invention provides a data security system comprising: a data security transceiver or receiver; An authentication subsystem operatively coupled to the data security transceiver or receiver; And a storage subsystem coupled to the authentication subsystem.

Certain embodiments of the present invention have other aspects than the above-mentioned aspects or alternatives to the above-mentioned aspects. The aspects will become apparent to those skilled in the art by reading the following detailed description when taken in conjunction with the accompanying drawings.

1 is a schematic diagram of a data security system in accordance with an embodiment of the present invention.
Figure 2 shows an authentication key delivery method used with a data security system.
Figure 3 shows different systems in which a user interacts with a data security system.
Figure 4 illustrates how a user interacts with a data security system using a host computer system.
5 is a data security method that utilizes user verification in a data security system.
6 is an exemplary data security communication system.
7 is an administrator sequencing diagram illustrating a sequence of operations between a mobile device and a data security system.
Figure 8 is an unlock sequence diagram in which the mobile device is an authentication factor.
9 is an unlock sequence diagram illustrating unlocking using a PIN entry from a mobile device.
Figure 10 is an unlock sequence diagram illustrating unlocking using PIN entry and user ID / location / time verification via the server / console.
11 is a reset sequencing diagram illustrating resetting a data security system using a server / console.
12 is an unlock sequence diagram illustrating unlocking a data security system using a server / console.
Figure 13 is a password change sequence diagram of a user using a server / console.

The following embodiments are described in sufficient detail to enable those skilled in the art to make and use the invention. It should be understood that other embodiments will be apparent based on the present disclosure, and that system, process, or mechanical changes may be made without departing from the scope of the present invention.

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, that the present invention may be practiced without these specific details. In order to avoid obscuring the present invention, some known circuits, system configurations, and processing steps are not disclosed in detail.

Likewise, the drawings illustrating embodiments of the system are semi-diagrammatic and not scale, and in particular some of the dimensions are for clarity of presentation and are exaggerated in the drawings. Where multiple embodiments having some features in common are disclosed and described for clarity and ease of illustration, description, and understanding thereof, similar and identical features will generally be described with similar or identical reference numerals. Similarly, although the drawings generally show similar orientations for ease of explanation, these depictions in the drawings are mostly arbitrary. In general, the present invention can be operated in all directions.

The term "system" as used herein is referred to and defined as a method of the present invention and a device of the present invention in accordance with the context in which the term is used. As used herein, the term "method" is referred to and defined as operating steps of the devices.

For convenience and not limitation, the term "data" is defined as information that can be generated by a computer or stored on a computer. The term "data security system" is defined to mean any portable memory device including a storage medium. The term "storage medium" as used herein is referred to and defined as any solid state, NAND flash and / or magnetic data recording system. The term "locked" refers to the data security system when the storage medium is not accessible and the term "unlocked " refers to the data security system when the storage medium is accessible.

There are generally two ways of preventing storage device changes:

1. Apply the epoxy to the components - the epoxy resin applied to the printed circuit board can make it difficult to disassemble the storage device without destroying the storage medium.

2. Encrypt memory data - the data is encrypted when it is written to the storage medium and the encryption key is needed to decrypt the data.

Referring now to Figure 1, a schematic diagram of a data security system 100 in accordance with an embodiment of the present invention is shown. The data security system 100 is comprised of an external communication channel 102, an authentication subsystem 104 and a storage subsystem 106.

The storage subsystem 106 is an electronic circuit that includes an interface controller 108, an encryption engine 110, and a storage medium 112. The storage medium 112 may be an internal or external hard disk drive, a USB flash drive, a solid state drive, a hybrid drive, a memory card, a tape cartridge and an optical disk (e.g., a Blu-ray disk, a digital versatile disk a digital versatile disk or DVD, and a compact disk or CD). The storage medium 112 may include a data protection appliances, an archival storage system, and a cloud-based data storage system. The cloud storage system may be implemented using a plug-in (or "plug-in") application or extension software installed in a host computer or a browser application on a RF or optical or other system connected to the host computer via a wired or wireless network, such as the World Wide Web Lt; / RTI >

The interface controller 108 includes electronic components such as a microcontroller with an encryption engine 110 of software or hardware while the encryption engine 110 may be within a separate controller of the storage subsystem 106. [

The authentication subsystem 104 includes an authentication controller 114, such as a microcontroller, which may have its own non-volatile memory, such as electrically erasable programmable read-only memory (EEPROM) It is an electronic circuit.

The external communication channel 102 provides a means for exchanging data with the host computer system 120. A Universal Serial Bus (USB) is one of the most common means of connecting the data security system 100 to the host computer system 120. Other examples of external communication channels 102 include Firewire, Wireless USB, Serial ATA (SATA), High Definition Multimedia Interface (HDMI), Recommended Standard 232 RS-232) and radio frequency wireless networks.

The interface controller 108 may convert the USB packet data into data that can be written to the storage medium 112 of the USB flash drive.

The encryption engine 110 is implemented as part of the interface controller 108 and receives clear text and / or data (information) from the host computer system 120 and provides it to the MSD or storage medium 112 . The encryption engine 110 also translates the encrypted information from the storage medium 112 and decrypts it to clear information about the host computer system 120. The cryptographic engine 110 may also include a cryptographic controller and communication with cryptographic capabilities to encrypt / decrypt data on the fly, as well as to manage communication protocols, memory, and other operating conditions; And may be two controller subsystems with communication / security controllers.

The encryption key 116 is required to encrypt / decrypt the information by the encryption engine 110. The encryption key 116 is used in an algorithm (e.g., 256-bit Advanced Encryption Standard (AES) encryption) that encrypts / decrypts data by an encryption algorithm to make the data unreadable or readable . The encryption key 116 may be stored internally or externally in the authentication controller 114.

The encryption key 116 is transmitted to the encryption engine 110 by the authentication subsystem 104 when the user 122 having the identification number or key is verified against the authentication key 118.

The use of authentication key 118 and encryption key 116 reveals that portable memory storage devices of various embodiments of the present invention can provide a very high level of security that was not previously available in such devices lost.

When the data security system 100 is locked, the authentication key 118 remains inside the authentication subsystem 104 and can not be read from the outside. One way to hide the authentication key 118 is to store it in the authentication controller 114 of the authentication subsystem 104. Establishing the secure fuse of the authentication controller 114 makes it impossible for the authentication controller 114 to access the authentication key 118 once the user 122 is verified if it does not permit the search. Many microcontrollers are equipped with security fuses that prevent access to arbitrary internal memory when disconnected. This is a known and widely used security feature. Such a microcontroller may be used in the authentication controller 114. Authentication controller 114 may be a microcontroller or a microprocessor.

The authentication key 118 may be used as in some of the following capabilities:

1. It can be used as an encryption key 116 for directly encrypting / decrypting information.

2. It can be used as a key to recover the encryption key 116 stored in the data security system 100 that can be accessed by the interface controller 108.

3. Can be used for direct comparison by the interface controller 108 to activate the external communication channel 102.

Referring now to FIG. 2, a diagram of an authentication key delivery method for use with data security system 100 is shown. In this figure, the authentication key 118 and the encryption key 116 are one and the same. The encryption engine 110 uses the authentication key 118 as the encryption key 116.

The user 122 must interact with the authentication subsystem 104 by providing the user identification 202, number or key to the authentication subsystem 104. [ The authentication subsystem 104 authenticates the user 122 to the authentication key 118. The authentication subsystem 104 sends the authentication key 118 to the interface controller 108 as an encryption key 116. [

The encryption engine 110 in the interface controller 108 uses the authentication key 118 to convert the clear information along the channel 206 into the encrypted information and the encrypted information into the clear information. Any attempt to read the encrypted information from the storage medium 112 without the encryption key 116 results in the generation of information that is generally not usable by any computer.

Referring now to FIG. 3, a diagram of different systems in which user 122 interacts with data security system 300 is shown. The interaction may be by a combination of communications 301, which may be by physical contact from a cell phone, a smart phone, a smart clock, a wearable household appliance or other wireless device, a wired connection or a wireless connection.

In one authentication system, the mobile transceiver 302 is used to transmit the user identification 304 to the data secure transceiver 306 of the authentication subsystem 310. For illustrative purposes, transceivers are used for bidirectional communication flexibility, but a transmitter-receiver combination for unidirectional communication may also be used. The authentication subsystem 310 includes an authentication controller 114 that is coupled to an interface controller 108 of the storage subsystem 106. The user identification 304 is provided to the data secure transceiver 306 in the authentication subsystem 310 by the mobile transceiver 302 from outside the storage subsystem 106 of the data security system 300. The wireless communication may be a wireless fidelity (WiFi), a Bluetooth (BT), a Bluetooth smart, a Near Field Communication (NFC), a Global Positioning System (GPS) ), Optical, cellular communication (e.g., Long-Term Evolution (LTE), Long-Term Evolution Advanced (LTE-A)), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Universal Mobile Telecommunications System (UMTS), Wireless Broadband (WiBro) Global System for Mobile Communications (GSM), etc.).

The authentication subsystem 310 authenticates the user 122 to the authentication key 118 by authenticating the code transmitted from the mobile transceiver 302 to the authentication key 118. The authentication subsystem 310 then sends the encryption key 116 to the interface controller 108 via the communication combination 301.

The encryption engine 110 then uses the encryption key 116 to convert the clear information to encrypted information along the channel 206 and to convert the encrypted information to clear information. Any attempt to read the encrypted information from the storage medium 112 without the encryption key 116 results in the generation of information that is not generally available by the host computer system 120. [

In an optional second authentication mechanism, the authentication subsystem 310 allows the user 122 to authenticate himself or herself as an authorized user using the biometric sensor 320, which provides the biometric input 322, Prove user 122 for key 118. Types of biometric identification include fingerprints, iris scans, voice imprints, and the like.

In an optional third authentication mechanism, the authentication subsystem 310 allows the user 122 to authenticate himself or herself as an authorized user using the electromechanical input mechanism 330, which provides the unique code 332, Prove user 122 for key 118. The unique code 332 may include a numeric, alphanumeric, or alphabetic code, such as a PIN. The electromechanical input mechanism 330 is within the authentication subsystem 310. The electromechanical input mechanism 330 receives the unique code 332 from the user 122 from outside the data security system 300. The unique code 332 is provided from the outside of the storage subsystem 106 of the data security system 300 to the electromechanical input mechanism 330 in the authentication subsystem 310.

Whichever method is used to verify the user 122, the authentication key 118 and encryption key 116 remain hidden until the user 122 is authenticated.

4, there is shown a diagram of how a user 122 may interact with a data security system 400 using a host computer system 120. In one embodiment,

The host computer system 120 is provided with a host application 402. The host application 402 is software or firmware that communicates via the external communication channel 102 of the data security system 400.

The host application 402 may include internal component serial numbers (e.g., hard drives) associated with its environment, a media access control (MAC) address of the network card, a user's login name, such as a network Internet Protocol (IP) address, an ID generated by the data security system and stored in the host, an ID generated by the data security system, and stored in the network. The host identifier 406 is used by the authentication subsystem 408 of the data security system 400.

When the authentication subsystem 408 validates the user 122 against the authentication key 118 by verifying the host identifier 406, the data security system 400 will be unlocked.

For example, the user 122 connects to the data security system 400 that is locked in the host computer system 120. The host application 402 sends the MAC address of the network card to the data security system 400. The data security system 400 recognizes this MAC address as legitimate and unlocks it without having the user 122 of FIG. 1 enter the user identification. This is an implementation that does not require any interaction with the user 122. In this case, proven is the host computer system 120 and its associated environment.

The data security system 400 includes: providing an authentication key 118 stored in an authentication subsystem 104; Providing verification of the host computer system 120 by the authentication subsystem 104; Providing an encryption key (116) to the storage subsystem (106) by an authentication subsystem (104); And providing access to the storage medium 112 by the storage subsystem 106 by decrypting the storage medium content.

The data security system further includes an authentication subsystem 104 for the interpretation of the biometric input and the verification of the user 122.

The data security system further includes directly using the authentication key 118 as the encryption key 116. [

The data security system further includes decrypting and retrieving the encryption key (116) used to decrypt the internal content using the authentication key (118).

The data security system further includes an authentication subsystem 104 for the interpretation of the signal input and the verification of the transmission unit.

The data security system further includes an authentication subsystem 104 for the interpretation of the manually entered input and the verification of the user 122.

The data security system further includes an authentication subsystem 104 for interpreting the inputs transmitted by the host resident software application for verification of the host computer system 120. [

The data security system is external to the interface controller 108 but further comprises an encryption engine 110 connected to the external communication channel 102 for the purpose of converting the clear data into encrypted data to unlock the data security system 100 .

Referring now to FIG. 5, a data security method 500 is shown that utilizes user verification in a data security system 100. The data security method 500 includes the steps of verifying a user for an authentication key at block 502; Retrieving an encryption key using the authentication key at block 504; And enabling unencrypted communication between the host computer system and the storage medium via the storage subsystem using the authentication key at block 506. [

Referring now to FIG. 6, an exemplary data secure communication system 600 is shown. Exemplary data secure communication system 600 includes a mobile device 610, a data security system 620, a host computer 630 and a server / console 640. Mobile device 610 and server / console 640 are connected by a wired or wireless connection through a cloud 650, which may be an Internet cloud. The mobile device 610 and the data security system 620 are connected by a communication combination 301.

The communication combination 301 of the exemplary data security communication system 600 includes a data security system 620 that is coupled to the data security system 620 by a mobile device 610 having an antenna 614 in wireless communication with the antenna 622 of the data security transceiver 624 Mobile transceiver 612.

In one embodiment, the mobile device 610 may be a smart phone. In mobile device 610, mobile transceiver 612 may be coupled to conventional mobile device components and data security system application 618, and the data security system application may provide information to be used with data security system 620 do.

The data security transceiver 624 is coupled to a security controller 626 that may include identification, passwords, profiles, or information that includes information on different mobile devices that can access the data security system 620. The security controller 626 is coupled to an authentication subsystem 310, a storage subsystem 106 (which may have encryption to encrypt data in some embodiments), and subsystems similar to the external communication channel 102.

The external communication channel 102 is connectable to a host computer 630 that allows access to data in the storage subsystem 106 under certain circumstances.

One implementation of the data security system 620 may eliminate the biometric sensor 320 and the electromechanical input mechanism 330 of FIG. 3 with only a wireless link to the mobile device 610, such as a smart phone. It has been found that this implementation makes the data security system 620 safer and more useful.

The data security system application 618 may allow the mobile device 610 to discover all data security systems in the vicinity of the mobile device 610 and determine their status (lock / unlock / blank, paired / I will show them.

The data security system application 618 allows the mobile device 610 to connect / pair, lock, unlock, change names and passwords, and reset all data on the data security system 620.

The data security system application 618 may allow the mobile device 610 to set an inactivity auto-lock to automatically lock the data security system 620 after a predetermined period of inactivity, A proximity auto-lock may be set to allow the mobile device 610 to initiate a data security < RTI ID = 0.0 > system (e. G., When the mobile device 610 is not within a predetermined proximity for a predetermined period (to improve reliability and prevent signal de- bouncing) 620) will be locked.

The data security system application 618 may be configured so that the mobile device 610 stores the password and the touch ID and the Apple Watch (both Touch ID and Apple Watch are both referred to herein as examples, Mode), so that the data security system 620 can be unlocked without re-entering the password on the mobile device < RTI ID = 0.0 > have

The data security system application 618 allows the configured mobile device 610 to operate only with a specific mobile device such as the mobile device 610 so that the data security system 620 can be used to communicate with other mobile devices Lt; / RTI >

The data security system application 618 allows the mobile device 610 to set the data security system 620 to be read-only

The data security system application 618 enables the mobile device 610 to operate in a user mode or an administrator mode (the administrator mode overrides user settings) and to use the server / console 640. The server / console 640 is a combination of a console and a computer for inputting information to the computer.

The server / console 640 includes a user management database 642 that includes additional information that can be transmitted to the mobile device 610 via the cloud 650 to provide additional functionality to the mobile device 610 do.

The user management database 642 allows the server / console 640 to create and identify users using a user ID (user name and password), to block / unlock the data security system 620 Provide remote assistance.

The user management database 642 allows the server / console 640 to remotely reset or unlock the data security system 620.

The user management database 642 allows the server / console 640 to remotely change the PIN of the data security system user.

The user management database 642 allows the server / console 640 to restrict / unlock the data security system 620 from specific locations (using virtual fencing).

The user management database 642 allows the server / console 640 to limit / unlock the data security system 620 at specified time periods and at different time periods.

The user management database 642 enables the server / console 640 to restrict unlocking of the data security system 620 from outside such as a designated team / organization / network.

Referring now to FIG. 7, an administrator sequencing diagram is shown illustrating a sequence of operations between a mobile device 610 and a data security system 620.

The connectivity 700 between the data security system 620 and the mobile device 610 is established first by mutual discovery of other devices or systems, pairing of devices and systems, and connection of devices and systems. Connectivity 700 is secured using a shared secret and then the shared secret is used to secure (encrypt) communications between data security system 620 and mobile device 610 for all future communication sessions do. The standard encryption algorithm is run on the data security system 620 and is approved by global security standards, both of which are selected to be efficient.

Connectivity 700 may be maintained either by data security system application 618 or security controller 628 or by both as long as data security system 620 and mobile device 610 are within a predetermined distance of each other do. Also, if the predetermined distance is exceeded, the connectivity 700 is maintained for a predetermined period of time after the data security system 620 is locked.

After the connection of the mobile device 610 and the data security system 620, a data security system administrator application start operation 702 occurs at the mobile device 610. The administrator then sets a password in an administrator password operation 704. In addition, after the connection of the mobile device 610 and the data security system 620, the data security system 620, in a data security system connected, powered and discoverable operation 706, Is connected to the host computer 630 of FIG. 6, and is received by the host computer 630 to be discovered.

After the administrator password operation 704, the mobile device 610 sends a set administrator password and unlock signal 708 to the data security system 620. The administrator password and unlock setting signal 708 causes an administrator password set and an administrator password set and data security system unlocked operation 716 to occur in the data security system 620.

When the administrator password setting and data security system unlock operation 716 is complete, a confirmation: data security system unlocked signal 712 is sent to the mobile device 610, Confirmation: operation 714 of the data security system unlocked as administrator operation is executed as an administrator. Confirmation: As an administrator, the data security system unlock operation 714 causes other set restrictions action 716 to be performed using the mobile device 610. Other constraints setting operations 716 may cause a set administrator restrictions signal 718 to be sent to the data security system 620 and a confirmation: (720) is returned to the mobile device (610). Thereafter, the mobile device 610 and the data security system 620 are in a state in which communication is completely ready for operation.

Significant interactions with the data security system 620 are important because it is possible to communicate with the data security system 620 without physical contact with the data security system 620, It is required to accompany a data security system unique identifier that is provided with the system 620 packaging and is readily available to the owner of the data security system 620.

This unique identifier (unique ID) is required when making a request that may affect user data, such as unlocking or resetting the data security system 620. [ Attempts to perform these operations without an exact identifier are ignored and made non-destructive. The unique identifier may require the user to have physical control rights to the data security system 620 and that the connectivity 700 may be used by a previously matched device such as the mobile device 610 and the data security system 620 And to identify the data security system 620 to the mobile device 610 in a manner that requires verification of what has been established between the systems. Once the device is paired, the shared secret is used to create the communication secret.

Matching implies that mobile devices and data security systems have a unique and defined relationship that is established and maintained at some point in the past.

The unique identifier allows the user to grant some control over the data security system when the user has physical control of the data security system.

To increase the security of communication with the data security system 620 when the mobile device 610 is a smart phone, a user may choose to activate features such as a feature referred to herein as 1Phone. This feature limits important user interaction with the data security system 620 to only one mobile device 610. This is accomplished by replacing the data security system unique identifier described above with a random identifier that is securely shared between the data security system 620 and the mobile device 610. Thus, for example, when a user unlocks the data security system 620, instead of presenting a data security system unique identifier, a 1Phone identifier MUST be given instead. In fact, this makes the user's mobile device 610 a second authentication factor for using the data security system 620, in addition to the PIN or password. By way of example, a mated user telephone selected as "1 Phone" can be used without a PIN and as a user authentication single factor and / or in combination with any other user authentication factors. If this feature (1 Phone) is selected, the data security system 620 can not be opened with any other telephones, except when the unlocking of the manager has been previously activated.

It will be appreciated that other embodiments may be made that require the administrator's password in the data security system 620 to use the 1Phone feature. Other embodiments may require that the server / console 640 be able to recover the data security system 620 in the event that 1Phone data is lost on the mobile device 610.

The user may activate the proximity auto lock feature for the data security system 620. [ During the communication session, the data secure transceiver 624 of FIG. 6 reports the signal strength measurements of the mobile device 610 to the data security system 620. The data security system application 618 on the mobile device 610 sends both a source signal power level and a proximity threshold to the data security system 620. [

Because the signal strength varies due to environmental conditions around the transceivers, the data security system 620 mathematically smoothens the signal strength measurements to reduce the likelihood of false positives. When the data security system 620 detects that the received signal power has fallen below a defined threshold for a predetermined period, it immediately locks the data security system 620 and prevents access to the storage subsystem 106 of FIG. 6 something to do.

The data security system 620 includes three different modes: a user mode in which the functionality of the data security system 620 is determined by the user; An administrator may set an administrator password and force some restrictions on the data security system 620 (e.g., automatic locking after a predetermined period of inactivity, read-only, 1Phone) and the restrictions may be removed by the user No administrator mode; And in the server mode where the administrator role is set when the server / console 640 can remotely reset the data security system 620, change the user password, or correctly unlock the data security system 620 .

Referring now to FIG. 8, there is shown an unlock sequence diagram where the mobile device 610 is an authentication factor. This diagram illustrates the automatic unlocking process of the data security system 620 initiated by the data security system application 618 from the mobile device 610, which is a particular mobile device. The user may initially use only one mobile device that is paired with the data security system 620. [ If the paired mobile device 610 is lost, the data security system 620 can not be unlocked (unless the administrator password has been previously set, as shown in FIG. 7).

Similar to FIG. 7, however, a data security system application started operation 800 occurs after connectivity 700 is established. The mobile device 610 sends an unlock required with the mobile device ID signal 802 to the data security system 620 after the data security system connection, . A data security system unlocked operation 804 occurs and acknowledgment: the data security system unlock signal 712 is transmitted from the data security system 620. Confirmation: After the data security system unlocked operation 806, the mobile device 610 and the data security system 620 are in a state in which the communication is completely ready for operation.

If a PIN (Personal Identification Number) is not set, the paired mobile device is used as a 1-authentication factor.

Referring now to FIG. 9, there is shown an unlock sequence diagram illustrating unlocking using a PIN entry from a mobile device 610. FIG. This diagram illustrates the process of unlocking the data security system 620 by entering a PIN in the data security system application 618 of the mobile device 610. [ The data security system 620 can not be unlocked without entering the correct PIN.

Similar to FIGS. 7 and 8, but after a data security system application start operation 800, an enter username / password operation 900 occurs. After the username / password entry operation 900, the mobile device 610 sends a verify user ID signal 902 to the server / console 640. The server / console 640 then issues a username / password valid decision 904.

When the user name / password validity determination 904 verifies the user, a valid user signal 906 is sent to the mobile device 610 to allow the user to enter the PIN of the mobile device 610 (908) to enter the correct PIN. The mobile device 610 then sends a verify unlock signal 910 to determine if the correct PIN has been entered in the server / console 640.

The server / console 640 issues a user authorized decision 912 and determines whether the user is authorized to use a particular data security system, such as the authorized data security system 620. If so, an unlock allowed signal 914 is sent to the mobile device 610 and the mobile device sends an unlock request signal 916 to the data security system 620.

The data security system unlock operation 804 is performed and the verification data security system unlock signal 712 is transmitted to the mobile device 610 and the verification at the mobile device: the data security system unlock operation 806 is performed do.

Referring now to FIG. 10, there is shown an unlock sequence diagram illustrating unlocking using PIN input and user ID / location / time verification via server / console 640. FIG. This diagram illustrates the process of entering a PIN to the data security system application 618 from the mobile device 610 and entering the authentication to the server / console 640 server using the user ID (username / password) Illustrates the most secure process of unlocking the data security system 620 by verifying the virtual fence permissions to unlock the data security system 620 in a particular time span. The data security system 620 can not be unlocked without entering a PIN, user name and password, and without the mobile device 610 being present at a specific (predefined) location and at a specific (predefined) time .

Similar to FIGS. 7-9, an unlocked data security system operation 1000 is performed at the server / console 640 so that a particular data security system, such as data security system 620, Allows you to set the desired conditions to operate. For example, the conditions may be within a certain geographic area and / or within a certain time frame.

At mobile device 610, a current condition determination is made, such as in location and / or current time acquisition 1002. This operation is performed to determine where the mobile device 610 is and / or the current time at which the mobile device 610 is located. Other current conditions around the mobile device 610 are also determined and sent to the server / console 640 by a verify unlock signal 1004, and conditions met determination at the server / A decision 1006 is made.

When the desired conditions are met, an unlock allowed signal 1008 is sent to the mobile device 610 where the PIN input operation 908 is performed. After the PIN is entered, a verify unlock signal 1010 is transmitted along with the PIN and the identifier of the data security system 620 closest in operation to the mobile device 610. The unlock verification signal 1010 is received by the server / console 640 and the data security system allowed decision 1012 determines that the authorized user is allowed to unlock the specified data security system Down. Server / console 640 verifies that this "particular" user is authorized to use the specified data security system.

After determining that the correct information has been provided, the server / console 640 will provide an unlock allowed signal 914 to the mobile device 610 and the mobile device will send an unlock request signal 916 ). The unlock request signal 916 causes the data security system 620 to operate.

Referring now to FIG. 11, there is shown a reset sequencing diagram illustrating the use of the server / console 640 to reset the data security system 620. FIG. This diagram illustrates the ability to remotely reset the data security system 620 via the server / console 640. The data security system 620 can only receive commands over the wireless connection from the mobile device 610 only. However, by setting a "reset" flag on the server / console 640 for a particular data security system (using S / N), the data security system application 618 running on the mobile device & And will query console 640 for any flags / pending requests in user management database 642. When the user connects to the data security system 620, the data security system application 618 on the mobile device 610 will execute a pending "reset" After a successful reset (all user data and credentials are lost), the server / console 640 will remove the reset flag so that it will not be executed the next time the mobile device 610 is connected to a particular data security system .

Similar to Figures 7 to 10, the mobile device 610 sends an any command waiting signal 1100 to the server / console 640 in response to an effective user signal 906 to initiate a command reset reset command < / RTI > A perform reset signal 1104 may be sent to the mobile device 610 when a command reset is present.

The mobile device 610 will send a reset security system signal 1106 to the data security system 620 to initiate a data security system reset operation 1108. [ Upon completion of the data security system reset operation 1108, the data security system 620 sends a confirmation: data security system reset signal 1110 to the mobile device 610 to confirm: (Data security system reset) operation 1112 to the operating state. Mobile device 610 and data security system 620 are then in a state in which communication with the resetted data security system 620 is fully operational.

Referring now to FIG. 12, there is shown an unlocking sequencing diagram that illustrates unlocking the data security system 620 using the server / console 640. This diagram illustrates the ability to remotely unlock the data security system 620 via the server / console 640. The data security system 620 can receive commands from the mobile device 610 over the wireless connection only. However, by setting the "manager unlock" flag on the server / console 640 for a particular data security system (using S / N), the data security system application 618 running on the mobile device 610 can send an arbitrary Server / console 640 for the flags / open requests of the server / console 640. When the user connects to the data security system 620, the data security system application 618 on the mobile device 610 will execute the pending "manager unlock" command. After the administrator successfully unlocks, the user's data is not compromised, but the user's password is removed (the data security system 620 can not be unlocked by the user). The server / console 640 will remove the reset flag for the data security system 620 so it will not be executed the next time the mobile device 610 is connected to the data security system 620. [

Similar to Figs. 7-11, after receiving any command wait signal 1100, the server / console 640 performs unlock 1200 when there is a command to unlock with the administrator's password. An unlock with administrator's password signal 1202 is sent to the mobile device 610 and the mobile device sends an unlock with administrator's password signal 1204 to the data security system & (620) to initiate a data security system unlock operation (804). Thereafter, the mobile device 610 and the data security system 620 are in a state in which communication is fully ready for operation.

Referring now to FIG. 13, a password change sequencing diagram of a user using the server / console 640 is shown. This diagram illustrates the ability to remotely change the user's password for the data security system 620 through the server / console 640. [ By setting the "change user's password" flag on the server / console 640 for a particular data security system (using S / N), the data security system 620 can only establish a wireless connection from the mobile device 610 The data security system application 618 running on the mobile device 610 will query the server / console 640 for any flags / outstanding requests. When the user connects to his or her data security system 620, the data security system application 618 on the mobile device 610 will execute the pending "change password of user" command. After a successful unlock and password change, the user's data is not compromised and the data security system 620 can be unlocked with the user's new password. The server / console 640 will remove the "change password for user" flag for this data security system 620 so it will not be executed the next time the mobile device 610 is connected to a particular data security system .

Similar to FIGS. 7-12, the server / console 640 responds to an optional command wait signal 1100 by issuing a change password decision 1300. When there has been a password change at the server / console 640, a change user password signal 1302 is sent to the mobile device 610 and the mobile device sends a change user password signal 1304, To the data security system (620). Thereafter, the mobile device 610 and the data security system 620 are in a state in which communication is fully ready to operate with a new password.

A method of operating a data security system includes: providing a data security system application to a mobile device for connectivity with the data security system; Initiating a data security system application; And maintaining connectivity between the mobile device and the data security system.

The maintaining connectivity in the method as described above maintains connectivity when the data security system is within a predetermined proximity to the mobile device.

Maintaining connectivity in the manner described above maintains connectivity when the data security system is within a predetermined proximity to the mobile device for a predetermined period of time.

Establishing connectivity in the manner described above includes utilizing bi-directional communication between the data security system and the mobile device.

Establishing connectivity in the manner described above includes utilizing unidirectional communication between the data security system and the mobile device.

The method as described above further comprises communication between a mobile device having a data security system application and a server including a user management database.

 The method as described above further comprises providing security information to the security controller of the data security system.

The method as described above includes: providing an identification of a designated data security system to a server; Providing a specific identification to the data security system; And unlocking the data security system when the identification of the designated data security system is the same as the specific identification of the data security system.

In a method as described above, providing a data security system application to a mobile device provides an application of a data security system administrator, the method comprising: setting a password for an administrator on the mobile device; Transmitting an administrator's password from the mobile device to the data security system; And setting the administrator's password in the data security system and unlocking the data security system.

The method as described above includes: providing an unlock request from a mobile device to a data security system with a mobile device identification; And receiving an unlock request from the data security system and unlocking the data security system.

The method as described above includes the steps of: inputting a user name or password to the mobile device; After receiving the user name or password from the mobile device, determining when the user name or password is valid at the server; Communicating from the server to the mobile device when the username or password is valid; And communicating from the mobile device to the data security system when the user name or password is valid for unlocking the data security system.

The method as described above includes the steps of: inputting a user name or password to the mobile device; After receiving the user name or password from the mobile device, determining when the user name or password is valid at the server; Communicating from the server to the mobile device when the username or password is valid; Determining when the identification number is valid at the server after receiving the identification number from the mobile device; And unlocking the data security system via the mobile device when the server determines that the identification number is valid.

 The method as described above includes the steps of: providing a server with a valid location of the mobile device; Determining when the mobile device is in a valid location in the server; And unlocking the data security system via the mobile device when the server determines that the mobile device is in a valid location.

The method as described above includes the steps of: providing the server with the current time of operation for the data security system at the mobile device; Determining when the mobile device is in the current time at the server; And unlocking the data security system via the mobile device when the server determines that the mobile device has the current time.

The method as described above includes the steps of: providing a command at the server; Providing a command from a server to a mobile device in response to a command wait signal from the mobile device; And performing a command on the data security system via the mobile device when the command is provided from the server.

The method as described above may further comprise: providing a password change command at the server; Providing a password change command from a server to a mobile device in response to a password change signal from the mobile device; And unlocking the data security system with the changed password in the data security system.

The method as described above further comprises the step of connecting the data security system to the host computer for powering and making the data security system discoverable by the host computer.

The data security system is: a data security transceiver or receiver; An authentication subsystem operatively coupled to the data security transceiver or receiver; And a storage subsystem coupled to the authentication subsystem.

The system as described above further comprises a security controller coupled to the data security transceiver or receiver and to the authentication subsystem.

The system as described above further comprises a mobile device having a data security system application operative with the security controller to maintain connectivity when the data security system is within a predetermined proximity to the mobile device.

The system as described above further comprises a mobile device having a data security system application operative with the security controller to maintain connectivity when the data security system is within a predetermined proximity to the mobile device for a predetermined period of time.

The system as described above further includes the mobile device having a mobile transceiver or receiver to utilize bi-directional communication between the data security system and the mobile device to maintain connectivity.

The system as described above further includes the mobile device having a mobile transceiver or receiver to use unidirectional communication between the data security system and the mobile device to maintain connectivity.

The system as described above further comprises a wired or wireless connection between the mobile device with the data security system application and the server including the user management database.

In the system as described above, the data security system includes an external communication channel for connection to the host computer.

While the present invention has been described in connection with certain preferred modes, it should be understood that many alternatives, modifications, and variations will be apparent to those of ordinary skill in the art in light of the foregoing description. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the scope of the appended claims. All matters described herein or shown in the accompanying drawings are to be interpreted in an illustrative and non-limiting sense.

Claims (25)

A method of operating a data security system,
Providing a data security system application to a mobile device for connectivity with the data security system;
Initiating the data security system application; And
Maintaining connectivity of the mobile device and the data security system;
The method comprising the steps of: 2. The method of claim 1, wherein maintaining connectivity includes maintaining the connectivity when the data security system is within a predetermined proximity to the mobile device. 2. The method of claim 1, wherein maintaining connectivity includes maintaining the connectivity when the data security system is within a predetermined proximity to the mobile device for a predetermined period of time. 2. The method of claim 1, wherein establishing connectivity comprises utilizing bi-directional communication between the data security system and the mobile device. 2. The method of claim 1, wherein establishing connectivity comprises using unidirectional communication between the data security system and the mobile device. The method of claim 1, further comprising communicating between the mobile device having the data security system application and a server including a user management database. The method of claim 1, further comprising providing security information to a security controller of the data security system. The method according to claim 1,
Providing an identification of a designated data security system to a server;
Providing a specific identification to the data security system; And
When said identification of said designated data security system is identical to said specific identification of said data security system, unlocking said data security system
Further comprising the steps of: The method of claim 1, wherein providing the data security system application to a mobile device comprises providing an application of a data security system administrator,
Setting a password of an administrator in the mobile device;
Transmitting the password of the manager from the mobile device to the data security system; And
Setting the password of the administrator in the data security system and unlocking the data security system
Further comprising the steps of: The method according to claim 1,
Providing an unlock request from the mobile device to the data security system with a mobile device identification; And
Receiving the unlock request in the data security system and unlocking the data security system
Further comprising the steps of: The method according to claim 1,
Inputting a user name or a password to the mobile device;
After receiving the user name or password from the mobile device, determining when the user name or password is valid at the server;
Communicating from the server to the mobile device when the username or password is valid; And
Communicating from the mobile device to the data security system when the user name or password is valid for unlocking the data security system
Further comprising the steps of: The method according to claim 1,
Inputting a user name or a password to the mobile device;
After receiving the user name or password from the mobile device, determining when the user name or password is valid at the server;
Communicating from the server to the mobile device when the username or password is valid;
Determining from the server when the identification number is valid after receiving the identification number from the mobile device; And
Unlocking the data security system via the mobile device when the server determines that the identification number is valid
Further comprising the steps of: The method according to claim 1,
Providing a valid location of the mobile device to a server;
Determining when the mobile device is in the valid location at the server; And
Unlocking the data security system via the mobile device when the server determines that the mobile device is in the valid location
Further comprising the steps of: The method according to claim 1,
Providing the server with a current time of operation for the data security system at the mobile device;
Determining when the mobile device is in the current time at the server; And
Unlocking the data security system via the mobile device when the server determines that the mobile device has the current time
Further comprising the steps of: The method according to claim 1,
Providing a command at the server,
Providing the command from the server to the mobile device in response to a command wait signal from the mobile device; And
Performing the command on the data security system via the mobile device when the command is provided from the server
Further comprising the steps of: The method according to claim 1,
Providing a password change command at the server;
Providing the password change command from the server to the mobile device in response to a password change signal from the mobile device; And
Unlocking the data security system with the changed password in the data security system
Further comprising the steps of: 2. The method of claim 1, further comprising the step of connecting the data security system to a host computer for power supply to be discoverable by the host computer. As a data security system,
Data security transceiver or receiver;
An authentication subsystem operatively coupled to the data secure transceiver or receiver; And
The storage subsystem connected to the authentication subsystem
The data security system. 19. The data security system of claim 18, further comprising a security controller coupled to the data security transceiver or receiver and to the authentication subsystem. 19. The system of claim 18, further comprising a mobile device having a data security system application operable with the security controller to maintain connectivity when the data security system is within a predetermined proximity to the mobile device. system. 19. The system of claim 18, further comprising a mobile device having a data security system application operable with the security controller to maintain connectivity when the data security system is within a predetermined proximity to the mobile device for a predetermined period of time Data security system. 19. The system of claim 18, further comprising using a bi-directional communication between the data security system and the mobile device, the mobile device having a mobile transceiver or receiver to maintain connectivity. 19. The data security system of claim 18, further comprising using a one-way communication between the data security system and the mobile device, the mobile device having a mobile transceiver or receiver to maintain connectivity. 19. The system of claim 18, further comprising wired or wireless connection communication between a mobile device having a data security system application and a server including a user management database. 19. The system of claim 18, wherein the data security system comprises an external communication channel for connection to a host computer.

Images