DE102014104640A1 - Device for access-protected storage of passwords and other data - Google Patents

Abstract

The invention relates to a device (1) for storing data, in particular passwords, user names and files, the device (1) having at least one data processing unit (3), an internal memory (4) for storing the data, a display and an input medium, in particular in the form of a touch display (2), characterized in that the device (1) has at least one interface (8, 9) for connection to a mobile memory (10), wherein the device (1) stores the data to be stored only then stored in encrypted form in the internal memory (4) and on the mobile memory (10) if a mobile memory (10, 11) is connected via the interface (8, 9).

Description

The present invention relates to a device for storing data, in particular passwords, user names and files, the device having at least one data processing unit, an internal memory for storing the data, an external mobile memory, a display and an input medium, in particular in the form of a touch display, having.

The number of passwords used in everyday life is increasing continuously - be it PIN numbers for debit cards, access passwords for PC, smartphone & Co. or online accounts, for example on Facebook and Amazon.

According to a study commissioned by WEB.DE in 2013, more than half of all German Internet users are afraid of password theft. Nevertheless, around one third of respondents use "easy to remember" passwords when dialing their passwords, while only 2.1% choose passwords that meet the requirements for a secure password. More than three quarters of respondents use the same password for multiple services. Remembering different - as safe as possible more complex - passwords presents a challenge for the user. So-called password managers are gaining in importance, where most passwords are stored in an application and protected with a master password. Here, the possible spying of master passwords (for example by hacker attacks or by filing in virtual clouds) represents a significant security gap. The majority of respondents continue to rely on the traditional "note notes" or the "in mind" mostly simple passwords.

The DE 20 2013 005 677 U1 describes a device for the encrypted storage of passwords and sensitive data in a memory. The device has a data processing unit, as well as several interfaces through which the device can be accessed by other data processing equipment, such as computers, mobile phones, etc. Precisely because of the interfaces used, the device can be attacked by malware. If the attack is successful, then the data believed to be secure can be read out. A similar working device is off EP 2306361 A1 previously known.

The object of the present invention is to provide a device which itself can not be attacked from the outside by means of malware and can not be read out in an adulterated manner, wherein the stored data can nevertheless be transferred or retrieved securely to other data processing devices.

This object is achieved with a device having the features of claim 1. Further advantageous embodiments of this device result from the features of claims 2 to 15.

The invention is characterized in that the device only provides a physical interface for a mobile, i. has external memory. The exchange of data with other computers or digital devices is thus possible only via the mobile memory. By radio, the device according to the invention can not communicate with other data processing devices. If a USB interface is provided to connect the mobile memory, it is ensured that only USB memory sticks can be connected via the USB interface. The connection of a data processing device, such as e.g. a computer on the USB interface is inhibited by the software. If the device is also to be protected against attack via the USB interface, the device can also be configured without a USB interface, so that the device then only has a card reader or memory card slot. An attack on the device according to the invention can thus take place only via the mobile memory, wherein the software installed on the device, in particular firmware, is correspondingly secured against an attack by malware which has been stored on the mobile memory. In addition, it is also possible that only certain file types, e.g. PDF format from which device can be read or received, provided this is provided by a foreign data processing device, e.g. a PC on which mobile memory has been written. The device can store the passwords, sensitive data, documents, etc. e.g. using a proprietary file type, encrypting the data securely.

According to the invention, the device can store encrypted data in its internal memory only when the master password has been entered by the user and, in addition, the mobile memory has been connected to the device, so that data on the mobile memory can be read and written. The data is always stored on both the internal and the mobile memory. The data on the internal memory and the mobile memory are encrypted using the master password and / or an additional password. U.a. the AES-256 method. In addition, the encrypted data can be protected against manipulation. Here u.a. the hash procedure. Of course, it is possible that other encryption methods are used in the device according to the invention.

With the device according to the invention, users are offered an alternative which enables a simple and secure management of highly sensitive data, in particular of passwords, user names and documents on a local terminal.

• • Sicher vor unerlaubten Zugriffen durch Verzicht auf externe Funkschnittstellen wie Bluetooth, WLAN und/oder Mobilfunk („always off“).
• • Datenübertragung ist nur durch physikalischen Transfer der Speicherkarte oder eines USB-Speichersticks möglich
• • Robustes Gehäuse zum Schutz gegen Staub, Feuchtigkeit und physischen Gewalteinwirkungen
• • Einfache Handhabung, da die Eingabe, Speicherung und Verwaltung von Daten und Dokumenten direkt am Endgerät erfolgt, d.h. ohne Verbindung z.B. mit einem PC. Die Eingabe, Anzeige und Verwaltung von Passwörtern, Benutzernamen, etc. erfolgt über einen in das Endgerät integrierten Touchscreen.
• • Individualisierbar auf persönliche Sicherheitsbedürfnisse, z.B. durch Datenlöschung bei unerlaubtem Zugriff.

The device may have a smartphone-sized housing and may be characterized in particular by the following features:

• • Secure against unauthorized access by omitting external radio interfaces such as Bluetooth, WLAN and / or mobile radio ("always off").
• • Data transmission is only possible by physically transferring the memory card or a USB memory stick
• • Robust case for protection against dust, moisture and physical impact
• • Easy to use, since the input, storage and management of data and documents is done directly at the end device, ie without connection eg with a PC. The input, display and administration of passwords, user names, etc. is done via a built-in touch screen.
• • Customizable to personal security needs, eg by data deletion in case of unauthorized access.

The device according to the invention will be explained in more detail with reference to drawings.

Show it:

1 : Device according to the invention with mobile storage media;

2 : Menu display of the device according to the invention according to 1 ,

The 1 shows a device according to the invention 1 with a housing 1a , The housing 1a has a touch display on its flat front 2 for viewing and data entry. In the case 1a is also the data processing unit 3 , which includes a CPU, as well as an internal data memory 4 arranged. The CPU controls the data display and the data input by means of the touch display 2 , the data processing and saving the data in the internal memory 4 , The CPU can also use the interfaces 8th . 9 for the mobile storage media 10 . 11 manage. However, it is also possible for separate interface controllers to transfer the data communication, such as reading and writing, to the mobile memory (s) 10 . 11 take.

The device has no radio interfaces for communication with other data processing devices, such as computers, smartphones, etc. It is merely intended that by removing the external mobile memory from the device and inserting it into a port to a foreign data processing device, e.g. PC, data can be transferred using the master password.

The storage of the data entered by the user always takes place both on the internal memory 4 as well as on the external mobile storage 10 . 11 , A storage of user data is only possible if a writable memory card, eg SD card 10 , in the card reader 8th the device 1 or a USB memory stick 11 in the USB port 9 inserted or inserted. The file name is automatically taken from the device 1 performed. The last X file versions are always stored on the external and internal storage, which keeps track of the data history. The storage of the user data is done using a data key that reflects the state of the art, eg AES-256. In addition, the encrypted data is protected against manipulation, eg by hashing.

Unless the device 1 is started, the user must first enter in a first step, the user-defined master password, so he gets access to the stored data. This master password is only known to the user and will - like all user data - both on the internal memory 4 as well as on the external mobile storage 10 . 11 the device 1 stored for authentication of the user.

• • Anzahl erlaubter Master-Passwortversuche;
• • Dauer der Eingabesperre nach maximaler Anzahl fehlerhafter Versuche;
• • Löschung der gespeicherten Daten nach X fehlerhaften Versuchen;
• • Löschung der gespeicherten Daten nach X Tagen ohne erlaubtem Zugriff.

To protect against unauthorized access to the data stored in the terminal, the user can individually set his security settings, eg:

• • number of allowed master password attempts;
• • duration of the input lock after the maximum number of failed attempts;
• • deletion of stored data after X failed attempts;
• • Deletion of stored data after X days without allowed access.

If the mobile storage was stolen from the authorized user or lost by the user, the stored data may be stored in the internal storage 4 not without entering the master password on a new mobile storage 10 . 11 be stored. The data on the external mobile storage 10 . 11 can only be read out or used on an external computer if the master password is also entered here again. Power is supplied via a micro-USB cable and is decoupled from the sensitive area of the terminal. Reading out the stored data via the power supply cable 12 can not.

Based on 2 Exemplary individual functions of the device according to the invention are explained:

a) Commissioning / setting the master password

Before first use by the user becomes the external mobile storage 10 . 11 formatted. This ensures that no spyware or similar. was stored on the external memory. In addition, the device stores a decryption application that can later be read and executed on an external data processing device, in particular a computer, so that it can be stored on the mobile memory 10 . 11 encrypted stored data from the computer are readable. After switching on the device for the first time 1 the user comes to the main menu and is asked to set a master password. The master password must meet the requirements for a secure password, ie at least 8th Characters and a combination of special characters, numbers and letters (optional lowercase and / or uppercase letters). The user will be through the device 1 Proposals for a secure password submitted (password generator function). The system checks the password selected by the user against known hacking attacks ("hacker lists").

If the requirements are not met, the master password will not be accepted. If needed, the user will be presented with tips for choosing and remembering a secure password. The selected password must be confirmed by repeated input. Every X days, users are prompted to enter their master password to remember and train regularly.

At the request of the user, he can be asked by an acoustic signal to enter the master password, if he selects this "Watch" option under "Settings". The storage of user data and documents is not possible before setting the master password. These functions can be viewed via the menu but can not be used.

For the user-selectable settings, e.g. the security settings under g), a default setting is stored.

b) Input and storage of passwords and data via the touch screen

• – Bezeichnung
• – URL
• – Benutzername
• – Password
• – 2. Identifier
• – Anmerkungen

Under the menu item "Passwords" the user has the possibility to store passwords and other important data. First, the list of already saved passwords appears. By clicking on the "pencil symbol" new passwords can be added. For this a number of predefined input fields are available, eg:

• - Description
• - URL
• - User name
• - Password
• - 2. Identifier
• - Remarks

The user will be proposed by the device proposals for a secure password submitted (password generator function). By selecting the input fields via the touch screen, the keyboard appears analogous to the logic known from smartphones, but special characters and numeric characters are displayed directly, so that no keyboards are required. The user will receive a notice with justification, if the password he chooses does not meet the requirements for a secure password (save the password nevertheless possible). The system checks the password selected by the user against known hacking attacks ("hacker lists").

c) Save documents in PDF format

The solution also offers the possibility of storing important documents (eg birth certificates, confidential business documents, etc.) in PDF format on the terminal. Since no external interfaces are provided by radio, the import / export of documents takes place via the external mobile memory 10 . 11 , eg a removable memory card or a USB memory stick. The storage takes place automatically in PDF format and is saved directly on the internal memory 4 and the external memory 10 . 11 encrypted. Under the menu item "Documents", the user can view the list of stored documents and delete individual documents as needed. The view of the document via the terminal is possible.

d) Management of passwords and data

Under the menu item "Passwords", the user sees the list of saved passwords or other data, eg sorted according to the name given by the user. By clicking on a password, all stored data appears. The user has the choice to delete or edit the entry. By selecting a specific input field, the user can make changes in this field. For each entry, a date stamp of the last change is stored, indicating entries that have not been changed since a certain period of time. The management of the passwords at another terminal, eg by removing the external mobile memory 10 . 11 and Use in PC, is not provided. However, the display of the passwords on the PC is possible.

e) Loss of the master password

If the user forgets his master password, he has the opportunity to reset the terminal (under the menu item "Settings"). In this case, the device is reset to factory settings and the user selects a new master password. Access to the data stored to date can not be done with the new master password. However, the previously stored data will remain in a separate file, unless the user has set an automatic deletion after x months in his security settings. If the user later restores his old master password (after he has already set a new master password and has made a save under it), he has the choice of a) deleting the original storage, b) the new file or c) to synchronize the "old" data with the new file. If there are passwords with the same name, a number is added to the newer password (in the sense of a version control).

Optionally, the deposit of security issues in the event of master password loss should be provided. Here, the user could set a new master password after correctly answering security questions and access the stored data as usual.

f) transmission of the stored data to a new terminal

The user has the option of storing the stored data on a new device 1 to transfer (eg damage to the housing or due to design preferences). For this purpose, the introduction of the external mobile memory is sufficient 10 . 11 , eg a memory card, into the new device 1 , The access to the stored data is as before via the master password. The new device 1 after entering the master password transmits the user data of the external mobile memory 10 . 11 on the internal memory 4 ,

g) Attempted data misuse and other properties

The user himself determines a) how many access attempts should be allowed and b) how to proceed when the maximum access attempts are exceeded (duration of the entry lock, deletion of the stored data). In addition, the user can specify whether the data should be automatically deleted after a self-determined time without permitted use. This is done in the device 1 a special power source that serves only for this purpose, deposited, for example, a separate battery, separate capacitor, or similar. If all data has been deleted, the user is prompted - in the same way as for commissioning - to define a new master password.

The optional camera integrated into the device can be used to photograph documents side by side. The pages are merged into a PDF document and stored encrypted. This saves the way via PC and scanner or camera and also the data transfer via external mobile storage 10 . 11 , The camera is beneficial for close range and for documents up A4 Designed and works better in this area most cell phone cameras.

The optional integration of a microphone and a speaker in the housing, audio files can be recorded and stored encrypted. The input of the audio files is performed by those on the device 1 stored software. In the recording, identification characteristics of the recipient (first name, last name, contact data), the subject of the recording as well as the audio file itself are recorded. Optionally, the identity of the recipient can be verified by entering another person. This verification is then also stored encrypted.

Optionally, in addition, a second memory card as an additional back-up in case of damage to the first external mobile memory 10 . 11 created and managed.

Extended access protection is provided by biometric recognition systems used in addition to the master password for legitimacy, e.g. Fingerprint sensor and / or iris scan of the eye possible.

It is of course possible that the camera 7 also elsewhere, eg at the back of the case 1 is arranged. In addition, a flash can be integrated, as it is already often used in today's mobile phones. As mobile memory cards all today common formats eg SD, SDHC, SDXC can be used. Is alternatively or additionally a USB Slot 9 installed, so can usb flash drives 11 in version 2.0, 3.0 or higher.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 202013005677 U1 [0004]
• EP 2306361 A1 [0004]

Cited non-patent literature

• DIN A4 [0034]

Claims (15)

Contraption ( 1 ) for storing data, in particular passwords, user names and files, the device ( 1 ) at least one data processing unit ( 3 ), an internal memory ( 4 ) for storing the data, a display and an input medium, in particular in the form of a touch display ( 2 ), characterized in that the device ( 1 ) at least one interface ( 8th . 9 ) for connection to a mobile memory ( 10 ), the device ( 1 ) the data to be stored only in the internal memory ( 4 ) and on the mobile storage ( 10 ) encrypts stored when using the interface ( 8th . 9 ) a mobile memory ( 10 . 11 ) connected. Contraption ( 1 ) according to claim 1, characterized in that the interface ( 8th ) comprises a card reader into which an external mobile memory ( 10 ), eg a data memory card can be inserted and / or that the interface ( 9 ) is a USB interface to which a USB memory stick ( 11 ) or another USB memory can be connected. Contraption ( 1 ) according to claim 1 or 2, characterized in that the device ( 1 ) is protected by means of a master password, such that only after the input of the correct master password in the device ( 1 stored data and / or in the internal and external mobile memory ( 10 . 11 ) Data can be stored. Contraption ( 1 ) according to claim 3, characterized in that the device ( 1 ) on the mobile memory ( 10 . 11 ) is encrypted by means of an encryption algorithm, whereby the decryption on the external mobile memory ( 10 . 11 ) stored data by means of another data processing device, eg PC, the master password is required. Contraption ( 1 ) according to one of claims 1 to 4, characterized in that the device ( 1 ) before initial writing of the external mobile memory ( 10 . 11 ) formatted it so that no foreign data or programs on the mobile memory ( 10 . 11 ) are more available. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device only allows secure master passwords having a minimum length of 8 characters, wherein the master password is a combination of numbers, special characters and / or letters, in particular retail and / or Capital letters, must be and in particular a test against known hackers resist. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device ( 1 ) only on the external mobile storage ( 10 . 11 ) stored data, in particular in the form of files, encrypted on command by means of an encryption algorithm and the encrypted data always on both the internal memory ( 4 ) as well as on the external mobile memory ( 10 . 11 ) stores. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device ( 1 ) detects and / or checks whether the connected mobile memory ( 10 . 11 ) of her or another device according to the invention ( 1 ) has been formatted and only in these cases, the transfer of the on the mobile memory ( 10 . 11 stored data in the internal memory ( 4 ). Contraption ( 1 ) according to one of the preceding claims, characterized in that the device ( 1 ) a camera ( 7 ), by means of which images can be received, which encrypted using the master password by means of an encryption algorithm and both in the internal memory ( 4 ) as well as in the external mobile memory ( 10 . 11 ) are storable. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device is a microphone ( 7a ), so that the device ( 1 ) Can record audio signals encrypted using the master password by means of an encryption algorithm and both in the internal memory ( 4 ) as well as in the mobile memory ( 10 . 11 ) are storable. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device comprises a loudspeaker for the acoustic output of data. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device ( 1 ) has a housing, wherein in case of unauthorized opening of the housing, a device arranged in the housing, the data of the internal memory ( 4 ) makes it illegible. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device ( 1 ) has a built-in password generator, if desired, a secure password on the display ( 2 ) can be displayed. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device ( 1 ) has a housing in which the card reader ( 8th ) and / or a female Plug connection ( 9 ) is arranged so that the external mobile memory ( 10 ), in particular a memory card, into the housing of the device ( 1 ), in particular completely, insertable or a USB data storage ( 11 ) is connectable. Contraption ( 1 ) according to one of the preceding claims, characterized in that the device always stores the data both on the internal memory ( 4 ) and the external mobile memory ( 10 ) stores, this being done in particular at the same time.

Images