DE102017123113A1 - Device for storing passwords - Google Patents

Abstract

The invention relates to a device for storing passwords with a processor 3, a non-volatile memory 5, an input device 11 for manual operation and an output device 15, a first reader 7 for wireless identification of an ID chip 17, the device 1 as portable device is formed and the device 1 is designed as a self-sufficient device.

Description

The invention relates to a device for storing passwords. Such passwords are used, for example, for operating data processing systems to enable access to the data processing system and / or programs or applications running thereon.

The requirements for passwords or passwords considered safe have increased in recent years both in length of the password and in terms of the at least contained characters (special characters, numbers, uppercase and lowercase letters, etc.).

Accordingly, the demands on the memory ability of operators have increased, since people often remember difficult to more complicated passwords. In addition, different possible passwords should be used for different applications (social media accounts, online banking, online mail order companies, etc.), so that even if a user spied successfully, his or her other applications or logins are still protected.

Although corresponding online password managers make it possible to store different passwords considered secure, they are themselves vulnerable, so that the stored passwords are not adequately protected against misuse. In addition, online password managers or password safes are often operated by data-gathering companies or services that make a user traceable. In addition, this often enforced a bond that can be paid later.

The present invention is therefore based on the object to provide a device for storing passwords, which allows the storage of very long, for example, longer than 10, 20 or even 80 characters (or more) long passwords without these passwords limited in the character set are. Another object of the invention is that the passwords at any time and location-independent, but with a high degree of security, can be accessed against unauthorized access.

This object is achieved by a device having the features of claim 1.

The device according to the invention is designed as a self-sufficient and portable device, so that it can be used anytime, anywhere to retrieve required passwords. In order to protect the device against unauthorized access, the device has a first reading device for wireless, for example RFID, NFC, etc., detection of an ID chip. Only when such an ID chip (RFID, NFC ID, etc.) has been read and (its secret key) recognized as correct can the user access a desired password. By a possible small design (pocket size, check card size or smaller to a standard USB stick size), the device according to the invention can be carried in a simple manner, so that their use by this portability even mobile (ATM, on the road on the smartphone, etc .).

Due to its miniaturization, a corresponding ID chip can also be carried by a user or else implanted (for example, under the skin) in any everyday, preferably personal objects, such as ring, pen, glasses, watch, pendant, bracelet, chain, etc. ,

After such an access authorization, the user authenticated by means of a recognized ID chip can individually access the passwords stored in the device in a non-volatile memory, in particular flash memory. For this purpose, the device has a manually operable input device, for example in the form of a selector switch, a 3-point rocker (forward, back, selection), a rotary switch or a rotary encoder, in order to select between several stored passwords.

In a preferred embodiment of the invention, the device has a second reader for reading a plug-in smart card. A file stored on the card, preferably a text file, is read when the card is inserted into the second reading device, in particular a card reader (for example an SD card reader) with required direct contact to the chip card, and the passwords contained in the file, preferably encrypted, stored in the non-volatile memory of the device.

The first and / or the second reading device is preferably an exclusive reading device, without thereby enabling information in the reverse direction, that is to say a description of the chip card or of the ID chip. This increases security against unauthorized access. Accordingly, in a write access to the memory only information by means of a file, in particular text-based file, transferred (and preferably overwrites a previous content), without a reading of an information contained in the memory is possible.

In a further embodiment of the invention, the device has program means, by means of which information, in particular a password, encrypted, preferably double-encrypted and stored in non-volatile memory and can be output unencrypted. Encryption increases protection against unauthorized access.

In a further embodiment of the invention, the device has as output device at least one communication interface, for example in the form of a USB connection (type A, type B, micro B, type C). This ensures that the device according to the invention can be used on a very large number of devices. For example, not only computers (PC, MAC, laptop, etc.) but also tablets, smartphones, etc. have universal interfaces (nowadays USB interfaces).

By way of such a communication interface, the power supply of the device according to the invention can also be provided in an advantageous embodiment of the invention, so that the device does not have to have its own energy source and yet is self-sufficient in the sense of the invention. The energy required for reading, encrypting and storing in the memory can be obtained from the device (PC, MAC, laptop, tablets, smartphones, etc.).

In a further embodiment of the invention, the device has a display. In this display, for example, a position of the password in the memory, or other information sufficient for a user to identify a respective password can be displayed.

In an advantageous embodiment of the invention, an identifier can be entered by means of the input device, preferably in addition to the ID chip recognition, so that the device can only be accessed by means of an authorized and recognized identifier.

In a particularly preferred embodiment of the invention, the device is designed such that it emulates a virtual keyboard for a password output, in particular a USB HID keyboard. As a result, the password input to these devices can be automated on a very large number of devices, without having to enter a password yet by the user on the respective device.

This increases for a user on the one hand the comfort and also reduces incorrect entries. On the other hand, this also increases the security against misuse and unauthorized access, since the transmission of a password to there respective device in these methods directly and not on a display, and thus unprotected from strangers eyes, is displayed.

In a particularly preferred embodiment of the invention, the device is designed such that an export of the entire memory contents is prevented and only a single password can be passed to the output device. This advantageously further increases the protection against misuse and unauthorized access, in particular by means of hacking an export of the memory contents of the device to the passwords of a user.

Further advantageous embodiments of the invention will become apparent from the dependent claims.

The invention will be explained in more detail with reference to an embodiment shown in the drawing.

In the sole figure of the drawing, a device according to the invention in the form of a so-called offline password safe is shown schematically as a block diagram.

The offline password safe 1 includes a processor 3 and a non-volatile memory 5 in the form of a flash memory (e.g., EEPROM) resident in the processor 3 integrated and / or can be designed separately from this structurally.

Furthermore, the password safe includes 1 in structural unit an RFID reader or the like, by means of which an ID chip, in particular an RFID chip can be read wirelessly and without plug connection. The wireless readout is preferably limited to the immediate environment (for example, at a distance of less than a meter or a few centimeters, or even direct placement on the appropriate location of the device housing the password safe) to prevent unwanted tapping by unauthorized persons.

Furthermore, the password includes safe 1 a display 9 on which information for selecting a respective password or identifier can be displayed. Thus, a user-selectable information for designating the respective password, such as type or even name of the access ("bank", "name of the bank", "online banking", "name of the application", etc.) or a fancy term on display 9 displayed when the associated password by means of a manually operable input device 11 , in particular in the form of a rocker switch, and for output via a USB port 15 emulated as keyboard output is present.

The password safe 1 has appropriate program means, so that he can connect to the USB port 15 connected device (PC, MAC, laptop, tablets, smartphones, etc.) as a keyboard or HID keyboard emulator 19 is recognized, so that the password selected by the user on the device or the application running on it is recognized as a password input.

Because in the password safe 1 preferably no user name is stored, the user must enter his username on the device itself, whereby the security against abuse is further increased.

Passwords can be stored together with the respective designations in the password safe by storing a corresponding file, preferably a text file on an SD card (for example with a PC). The SD card must be used to describe the password safe 1 or its flash memory 5 in the SD card reader 13 are inserted, whereupon the password safe 1 automatically or after confirmation on the input device 11 the contents of the SD card, so the passwords including their names read, encrypted and flash memory 5 (encrypted) stores.

In flash memory 5 existing information (passwords and designations) are preferably overwritten in the writing, so that a read access, in particular to individual addresses of the flash memory 5 for safety reasons can be avoided. The new content of flash memory 5 corresponds - but in encrypted form - thus the content of the SD card created.

Of course it is also possible in the password safe 1 or its flash memory 5 Passwords and labels in a different way, for example via the USB port 15 to take off. However, by using an SD card, especially a special SD card, it can be used exclusively in the (special) SD card reader 13 is recognized, the security against misuse and unauthorized access will be further increased.

That in the password safe 1 in the processor 3 running program to the respective aforementioned actions, such as reading RFID chip, reading SD card, issuing a password through the USB port 15 , Emulating an HID keyboard 19 , Display a selected password on the Diplay 9 , Read and write access to flash memory 5 , etc., is itself protected against overwriting and readout. For this purpose, for example, a programming interface (if required for the production) can be switched off after the production process.

Access to this program is neither via the RFID reader 7 , still on the SD card reader 13 possible because there is no write access (to the RFID chip or the SD card) on these readers and thus readout of the flash memory 15 is possible.

Also in the password safe 1 included USB port 15 provides no unwanted unrestricted access from the outside to the flash memory 5 , in particular its entire content. Via the USB port 15 Only an output is made by the user via input device 11 selected individual password, and preferably the power supply of the password safe 1 ,

The transmission direction of the respective information is clearly indicated to the figure by means of arrows, the only bidirectional transmission between processor 3 or microcontroller and memory 5 he follows.

With the password safe according to the invention, an authentication (login) to any devices or systems that require a high level of security and protection against unauthorized access. The password safe according to the invention allows a high degree of security, since both the password safe itself, including the associated ID chip must be in the possession of the user. Accordingly, a password safe can be supplied with several associated ID chips (RFID), and SD cards that only work with this password safe or can not be transferred to another password safe. To increase security can also be dispensed with the possibility of learning new chips or cards.

Furthermore, in the password safe according to the invention only the password including the user selectable name (or even password number) is stored. A password is issued only individually and preferably without username, so that it must be entered by the user in the application itself. This further increases security against unauthorized access because the username required for successful login remains unknown.

Even if a component is lost (password safe or RFID chip), a user's passwords remain secure against unauthorized access.

Claims (14)

A device for storing passwords comprising a processor (3), a non-volatile memory (5), an input device (11) for manual operation and an output device (15) first reader (7) for wireless detection of an ID chip (17), wherein a) the device (1) is designed as a portable device and b) the device (1) is designed as a self-sufficient device. Device after Claim 1 , characterized in that the device (1) has a second reading device (13) for reading out a plug-in chip card. Device after Claim 1 or 2 , characterized in that the device (1) has program means, by means of which passwords can be stored encrypted and output unencrypted. Device according to one of the preceding claims, characterized in that the input device (11) is designed as a selector switch, by means of which can be selected within a plurality of stored passwords. Device according to one of the preceding claims, characterized in that the device (1) as output device (15) has at least one universal communication interface. Device according to one of the preceding claims, characterized in that the device (1) has a display (9). Device according to one of the preceding claims, characterized in that the device (1) as a further reading device has a memory card reader (13) in which a memory card can be inserted. Device according to one of the preceding claims, characterized in that the device (1) as the first reader (7) has an RFID reader, so that only by means of legitimate and recognized chip (17) on the device (1) can be accessed. Device according to one of the preceding claims, characterized in that by means of the input device (11), an identifier can be input, so that only by means of authorized and recognized identifier to the device (1) can be accessed. Device according to one of the preceding claims, characterized in that the device (1) is designed such that the device (1) emulates a virtual keyboard (19) for a password output. Device according to one of the preceding claims, characterized in that the device (1) has an interface (15), by means of which an external power supply is made possible. Device after Claim 11 , characterized in that the interface (15) is designed as an input device or input and output device. Device according to one of the preceding claims, characterized in that the device (1) is designed such that in a write access to the memory (5) only passwords by means of a file, in particular text-based file, can be transmitted. Device according to one of the preceding claims, characterized in that the device (1) is designed such that an export of the entire memory contents of the memory (5) is prevented and only a single password can be passed to the output device (15).

Images