FR2886748A1 - SECURE DATA STORAGE DEVICE - Google Patents

Abstract

A portable data storage device (10) includes a data storage memory (20), a memory controller (30) and means (40, 50) for connecting to a host device for accessing in memory, said storage device being characterized in that it comprises on-board security means (60, 70) for at least part of the stored data, said security means making it possible to secure access to the data of an autonomous way vis-à-vis the host device.

Description

SECURE DATA STORAGE DEVICE

  The present invention relates to the field of digital data storage and more particularly relates to a portable data storage device, comprising a data storage memory, a memory management controller and connection means with a host device for the storage of data. access to memory.

  Such devices, for example USB memory sticks (Universal Serial Bus), because of their portability and storage capacity they offer, see their use more and more widespread. Moreover, in many contexts, it is necessary to support the storage of secure solution data that can guarantee users the confidentiality and integrity of stored data.

  Thus, when it is precisely necessary to process confidential data and store it on a USB memory stick via a host device, typically a computer, the solutions used to ensure the security of storage conventionally implement systems for encrypting the contents of the memory key.

  These systems consist of data encryption software, based on symmetric or asymmetric cryptographic algorithms, which are installed on the host device to encrypt the data prior to storage in encrypted form on the memory stick.

  2886748 2 However, the interest of memory keys is to store and transport data, for the purpose of easily transfer from one computer to another, these solutions do not provide a great flexibility of use to users. Indeed, these systems then require to install a suitable software driver on the host device to which the memory key will be connected, able to decrypt the contents of the key to be able to transfer it in the clear on the host device.

  Moreover, this mode of operation does not go without creating security vulnerabilities. Indeed, to ensure good reliability, the user must have confidence in the host device to which the memory key is connected. Indeed, if the host device comprises a spy-type software, when the key is connected to the device, for example to decrypt its content, the latter will be able to intercept the password entered on the host device to decrypt the data. . In this case, if the key is again connected to this host device for a fraudulent purpose, the confidentiality of the data on the key is no longer guaranteed since the password to decrypt the data has previously been captured.

  Also, a malicious user in possession of the key will have access in this way to the content of the key.

  Currently, to secure the contents of a memory key, there are no solutions other than installing an encryption software on the host device hosting the memory key, which will take care of encrypting and decrypting the data of the memory stick. the key, with the disadvantages that such a system causes.

  The present invention therefore aims to remedy these drawbacks, by proposing a solution to do without the dependence of the memory key to the host device to ensure the confidentiality and integrity of the data stored on the key.

  With this object in view, the subject of the invention is a portable data storage device comprising a data storage memory, a memory controller and connection means with a host device for accessing the memory, said device storage device being characterized in that it comprises on-board security means for at least part of the stored data, said security means making it possible to secure access to the data in an autonomous manner with respect to the host device .

  According to one embodiment, the data security means comprise means for inputting at least one secret key cooperating with the memory controller, said controller comprising processing means for encrypting the data by using said secret key when a data writing phase to be stored in the memory and for decrypting said data by using said secret key during a phase of access to said stored data.

  Preferably, the processing means comprise scrambling means consisting of reorganizing the storage in memory of the encrypted data according to a predefined law.

  Preferably, the processing means are provided for cooperating with a plurality of secret keys, each secret key provided via the input means allowing access to a separate set of data stored in the memory.

  According to one embodiment, the input means comprise at least one coding wheel, each of the coding wheels providing a binary code on at least one bit making it possible to generate the secret key.

  According to another embodiment, the input means comprise a keyboard for entering a code corresponding to the secret key used for the encryption and decryption of the data.

  Preferably, the processing means implement a symmetric type encryption algorithm, for example of the AES or DES type.

  Other characteristics and advantages of the present invention will appear more clearly on reading the following description given by way of illustrative and nonlimiting example and with reference to the appended figures in which: FIG. 1 illustrates the general architecture of the storage device according to the invention, and Figure 2 illustrates an embodiment of input means of a secret key, integrated in the storage device according to the invention.

  The present invention thus relates to a portable data storage device, such as a USB memory stick as will be more particularly mentioned in the following description, without however having any limiting character.

  The invention proposes such a completely autonomous storage device vis-à-vis the host device to which it is intended to be connected, as regards the securing of its content. To do this, means for securing the data will be embedded on the storage device according to the invention.

  Figure 1 schematically illustrates a data storage device 10 consisting of a USB memory stick. The memory key 10 conventionally comprises a data storage memory 20 connected to a memory controller 30 via the memory bus 40, and connection means with a host device for accessing the memory, in the form of a USB interface 40 connected to the controller 30 via a USB line 50. The USB line allows on the one hand the power supply of the controller, when the memory key is connected to the host device, as well as the transfer of data between the host device and the memory stick via the USB interface 40.

  The memory key according to the invention is furthermore provided with autonomous means of securing its contents, comprising means 60 making it possible to enter directly on the memory key itself at least one secret key, designed to cooperate with the memory controller. 30. More specifically, the secret key thus entered on the memory key via the input means 60 is sent to specific processing means 70 of the memory controller. Validation means 80 of the secret key, connected to the memory controller, make it possible to indicate to the controller the receipt of the key to activate the processing means. These validation means may for example be in the form of a validation button accessible to the user on the surface of the memory key.

  The processing means 70 are provided according to the invention for applying a calculation of encryption and decryption of the data by using the secret key. They implement, for example, a symmetric encryption algorithm of the AES (for Advanced Encryption Standard) or DES (for Data Encryption Standard) type, making it possible to encrypt the received data by using the secret key during a data writing phase. storing in the memory and decrypting said data using the secret key during a data access phase thus stored in the memory.

  According to one variant, it could also be envisaged that the processing means 70 implement an asymmetric type encryption algorithm, operating on the basis of a public key / private key pair, which keys would then be provided to the processing means 70. the same as previously explained via the input means 60 of the memory key, respectively to encrypt and decrypt the data of the memory key to provide security.

  Only part of the storage memory 20 of the memory key could be secured according to the principles described above. In this way, it is possible to store non-confidential data in a conventional manner in a memory space that would therefore be unsecured by the processing means of the invention.

  To further enhance the security of the data on the memory key, it is possible to envisage an embodiment where the processing means 70 further comprise scrambling means consisting in reorganizing the storage in memory of the encrypted data according to a predefined law. Such means, referred to as scrambling according to the English terminology, advantageously make it possible to store the data in memory in a non-contiguous manner, thus making it very difficult for possible attacks.

  FIG. 2 illustrates an exemplary embodiment of the input means 60 of the secret key directly on the memory key 10. According to this exemplary embodiment, the input means 60 comprise three coding wheels, respectively R1, R2 and R3, each encoder wheels providing a binary code for example on 4 bits for generating the secret key. The binary code supplied by each encoder wheel is different for each digit, for example: 0 -> 0000 1 -> 0001 2 -> 0010 2886748 8 3> 0011 4 -> 0100 -> 0101 6 -> 0110 7 -> 0111 8 -> 1000 9 -> 1001 According to this embodiment, the memory controller 30, once powered, is then waiting for validation of a secret key via the validation button 80. It then reads the code configured by the position of the three coding wheels. This code is preferably stored in a buffer used for the temporary storage of data during the transfer of this code from the input means 60 to the controller 30.

  The code provided by the coding wheels is then used as a secret key for the encryption / decryption algorithm implemented by the processing means 70 of the memory key.

  The foregoing is given by way of example only. We can consider the use of more or fewer encoder wheels, each providing a bit code on more or less bits, depending on the level of security that is sought to achieve.

  According to this example, a coding wheel encoding 4 bits of information, with three wheels, only a key of length equal to 12 bits is obtained, which represents a limited cryptographic resistance. According to one embodiment, the secret key could be entered in blocks of three digits, the validation button then being activated between each block, so as to enter a key 2886748 9 of infinite length. However, we can be content with a key of sufficient length to ensure proper security while remaining memorable by the user. Thus, upon power up, the first block retracted is considered the first part of the key if it comprises several. In the event of an error while entering the secret key, the memory key must be turned on in order to be able to re-enter the entire secret key. We end the entry of the secret key by pressing for example twice the validation button.

  The validation button 80, by making it possible to validate the code entered by the user once the memory key has been connected to the host device, also authorizes the user to turn the coding wheels once the secret key has been completely entered and validated, in such a way that that the wheel position thus modified does not reveal the code corresponding to the secret key for access to the data in the memory. This prevents a possible attacker from seizing the code.

  Of course, any other means for entering the secret key directly on the memory storage device could be envisaged without departing from the scope of the present invention. Thus, for example, one could consider using a keyboard integrated in the memory key as input means of the secret key, to enter a code corresponding to the secret key implemented by the algorithm for encrypting and decrypting data, or a set of cursors.

  Advantageously, it can be provided that the processing means 70 cooperate with a plurality of secret keys, each secret key provided via the input means 60 then allowing access to a separate set of data stored in the memory. In this way, several different users, each with a secret key assigned to it, can use the memory storage device by accessing different areas of the memory, each accessed via the secret key. Thus, the confidential data of each user are secured on the storage device vis-à-vis other users.

  The portable data storage device according to the invention, by embedding all the security means on the storage device itself, thus makes it possible to secure the contents of the memory without requiring the cooperation of the host device, contrary to the solutions of the invention. prior art where the security of the data always depends on it. The process of securing the data on the data storage device is thus made completely transparent to the host device.

2886748 11

Claims (9)

  A portable data storage device (10) comprising a data storage memory (20), a memory controller (30) and means (40, 50) for connecting to a host device for accessing the memory , said storage device being characterized in that it comprises on-board security means (60, 70) for at least part of the stored data, said security means making it possible to secure access to the data in an autonomous manner vis-à-vis the host device.   2. Storage device according to claim 1, characterized in that the data securing means comprise means (60) for inputting at least one secret key cooperating with the memory controller (30), said controller comprising processing means (70) for encrypting the data using said secret key during a write phase of data to be stored in the memory and for decrypting said data using said secret key during a phase of access to said stored data.   3. Storage device according to claim 2, characterized in that the processing means (70) comprises scrambling means of reorganizing the storage in memory of the encrypted data according to a predefined law.   4. Storage device according to claim 2 or 3, characterized in that the processing means (70) are provided for cooperating with a plurality of secret keys, each secret key provided via the input means allowing access to a separate set of data stored in the memory.   5. Storage device according to any one of claims 2 to 4, characterized in that the input means (60) comprise at least one encoder wheel (R1, R2, R3), each of the coding wheels providing a binary code at least one bit for generating the secret key.   6. Storage device according to any one of claims 2 to 4, characterized in that the input means (60) comprise a keyboard for entering a code corresponding to the secret key implemented for the encryption and decryption of data.   7. Storage device according to any one of claims 2 to 6, characterized in that the processing means (70) implement a symmetric type of encryption algorithm.   8. Storage device according to claim 7, characterized in that the encryption algorithm is of AES or DES type.   2886748 13 9. Storage device according to any one of the preceding claims, characterized in that it is a USB memory stick.