KR20190137960A - Data security system with encryption - Google Patents

Abstract

A data security system and method of operation thereof include a data security transceiver or receiver; An authentication subsystem operatively connected to the data security transceiver or receiver; And a storage subsystem coupled to the authentication subsystem.

Description

Data security system using encryption {DATA SECURITY SYSTEM WITH ENCRYPTION}

Cross Reference to Related Application (s)

This application claims the benefit of US Provisional Application No. 60 / 975,814, filed on September 27, 2007, the subject matter of which is incorporated herein by reference, PCT / US2008 / filed September 26, 2008. Claims priority of US patent application Ser. No. 14 / 987,749, filed Jan. 4, 2016, filed on Jan. 4, 2016, with some continuing applicants of co-pending US patent application Ser. do.

This application includes topics related to US patent applications filed simultaneously by Lev M. Bolotin and Simon B. Johnson under the name “DATA SECURITY SYSTEM WITH ENCRYPTION”. The related application is assigned to ClevX, LLC and identified as Agent Document Control Number 502-018P-PCT-US.C1. The subject matter of the relevant application is incorporated herein by reference.

Technical field

The present invention relates generally to electronic devices and, more particularly, to memory devices.

Security is an important issue in almost every aspect of computer use. Storage media such as hard disk drives connected to computers contain valuable information that is vulnerable to data theft. A lot of money and effort is applied to protect personal, corporate and government security information.

As portable memory storage devices become smaller, more easily lost, more ubiquitous, less expensive, and larger in memory capacity, they present unique security issues. General purpose serial bus flash and micro drives, cell phones, camcorders, digital cameras, iPODs, MP3 / 4 players, smartphones, palm and laptop computers, gaming equipment, authenticators, (including memory It is possible to fraudulently download large amounts of information to portable memory storage devices, such as tokens, etc., usually mass storage devices (MSDs).

More specifically, millions of MSDs are used for backup, transfer, intermediate storage and primary storage where information can be easily downloaded and taken away from a computer. The primary purpose of all MSDs is to store and retrieve "portable content," which is data and information associated with a specific owner rather than a specific computer.

The most common means of providing storage security is to authenticate the user with a password entered into the computer. The password is validated against the MSD stored value. If a match occurs, the drive will open. Or the password itself is used as the encryption key to encrypt / decrypt the data stored in the MSD.

For drives that support on-the-fly encryption, encryption keys are often stored on media in encrypted form. Since the encryption key is stored on the media, it is readily available to people who want to read the media directly by bypassing the standard interface. Therefore, the password is used as a key for encrypting the encryption key.

In the case of self-certified drives, their authentication subsystem is responsible for maintaining security. There is no dependency on the host computer to which it is connected. Thus, the password cannot be sent (or need not be sent) from the host to unlock the MSD. In fact, the encryption key no longer needs to be stored on the media. The authentication subsystem is the means for managing the encryption key.

Thus, there remains a need for improving security. Given the ever-increasing commercial competitive pressures with growing consumer expectations and diminished opportunities for meaningful product differentiation in the market, it is important to find answers to these issues. In addition, the need to reduce costs, improve efficiency and performance, and cope with competitive pressures places even greater pressure on the urgent need to find answers to these problems.

Solutions to these problems have been pursued for a long time, but conventional developments have not taught or suggested any solutions, so solutions to these problems have not been achieved for a long time by those skilled in the art.

The invention includes providing a data security system application to a mobile device for connectivity with a data security system; Starting a data security system application; And maintaining a connection between the mobile device and the data security system.

The present invention provides a data security transceiver or receiver; An authentication subsystem operatively connected to the data security transceiver or receiver; And a storage subsystem coupled to the authentication subsystem.

Certain embodiments of the present invention have other aspects in addition to or in place of the above-mentioned aspects. Aspects will become apparent to those skilled in the art by reading the following detailed description when referring to the accompanying drawings.

1 is a schematic diagram of a data security system according to an embodiment of the present invention.
2 illustrates an authentication key delivery method used with a data security system.
3 illustrates different systems in which a user interacts with a data security system.
4 illustrates how a user interacts with a data security system using a host computer system.
5 is a data security method using user verification in a data security system.
6 is an exemplary data secure communication system.
7 is a manager sequencing diagram illustrating a sequence of operations between a mobile device and a data security system.
8 is an unlock sequence diagram in which a mobile device is an authentication factor.
9 is an unlock sequencing diagram illustrating unlocking using a PIN entry from a mobile device.
FIG. 10 is an unlock sequencing diagram illustrating unlocking using PIN entry and user ID / location / time verification via a server / console.
11 is a reset sequencing diagram illustrating resetting a data security system using a server / console.
12 is an unlock sequencing diagram illustrating unlocking a data security system using a server / console.
13 is a password change sequencing diagram of a user using a server / console.

The following examples are described in sufficient detail to enable those skilled in the art to make and use the invention. Other embodiments will be apparent based on the present disclosure, and it should be understood that system, process or mechanical changes may be made without departing from the scope of the present invention.

In the following description, numerous specific details are provided to provide a thorough understanding of the present invention. However, it will be apparent that the invention may be practiced without these specific details. In order to avoid obscuring the present invention, some well-known circuits, system configurations and processing steps are not disclosed in detail.

Likewise, the figures illustrating embodiments of the system are semi-diagrammatic and not to scale, in particular some of the dimensions being for clarity of presentation and are exaggerated in the figures. When a number of embodiments having some features in common are disclosed and described for clarity and ease of illustration, description, and understanding thereof, similar and identical features of one another will typically be described by like or identical reference numerals. Similarly, while the drawings generally show similar directions for ease of explanation, this depiction in the drawings is mostly arbitrary. In general, the present invention can be operated in all directions.

As used herein, the term "system" is referred to and defined as the method of the present invention and the device of the present invention depending on the context in which it is used. As used herein, the term “method” is referred to and defined as the operational steps of the devices.

For convenience and not by way of limitation, the term "data" is defined as information that may be generated by or stored on a computer. The term "data security system" is defined to mean any portable memory device that includes a storage medium. As used herein, the term “storage medium” is referred to and defined as any solid state, NAND flash and / or magnetic data recording system. The term "locked" refers to a data security system when the storage medium is not accessible and the term "unlocked" refers to a data security system when the storage medium is accessible.

There are generally two ways to prevent storage device changes:

1. Apply Epoxy to Components—The epoxy resin applied to the printed circuit board can make it difficult to dismantle the storage device without destroying the storage medium.

2. Encrypt memory data-The data is encrypted when written to the storage medium and an encryption key is needed to decrypt the data.

Referring now to FIG. 1, a schematic diagram of a data security system 100 in accordance with an embodiment of the present invention is shown. Data security system 100 is comprised of an external communication channel 102, an authentication subsystem 104, and a storage subsystem 106.

Storage subsystem 106 is an electronic circuit that includes interface controller 108, encryption engine 110, and storage medium 112. Storage medium 112 may include internal or external hard disk drives, USB flash drives, solid state drives, hybrid drives, memory cards, tape cartridges, and optical disks (e.g., Blu-ray disks, digital multifunction disks) optical versatile disk) or DVD, and compact disk or CD). The storage medium 112 may include a data protection home appliance, an archival storage system, and a cloud-based data storage system. The cloud storage system utilizes a plug-in (or "plug-in") application or extension software installed on a browser application on the host computer or other system connected to the host computer via a wired or wireless network, such as RF or optical, or the World Wide Web. Can be accessed.

The interface controller 108 includes an electronic component such as a microcontroller having the encryption engine 110 in software or hardware, but the encryption engine 110 may be in a separate controller of the storage subsystem 106.

Authentication subsystem 104 includes an authentication controller 114, such as a microcontroller, that may have its own non-volatile memory, such as electrically erasable programmable read-only memory (EEPROM). It is an electronic circuit.

External communication channel 102 provides a means for exchanging data with host computer system 120. Universal Serial Bus (USB) is one of the most common means of connecting data security system 100 to host computer system 120. Other examples of external communication channels 102 include Firewire, Wireless USB, Serial ATA (SATA), High Definition Multimedia Interface (HDMI), and Recommended Standard 232 ( RS-232) and radio frequency wireless networks.

The interface controller 108 may convert the USB packet data into data that can be written to the storage medium 112 of the USB flash drive.

The encryption engine 110 is implemented as part of the interface controller 108 and receives encryption from clear text and / or data (information) from the host computer system 120 and writes it to the MSD or storage medium 112. To converted form. The encryption engine 110 also converts and decrypts the encrypted information from the storage medium 112 to clear the information about the host computer system 120. Cryptographic engine 110 also manages communication protocols, memory and other operating conditions, along with cryptographic controllers and communications with encryption capabilities to encrypt / decrypt data on the fly, for processing communications with encryption key management and cryptographic controllers. It can be two controller subsystems with communication / security controllers.

The encryption key 116 is required by the encryption engine 110 to encrypt / decrypt the information. The encryption key 116 is used for an algorithm (e.g., 256 bit Advanced Encryption Standard (AES) encryption) that encrypts / decrypts the data by an encryption algorithm, thereby making the data unreadable or readable. . The encryption key 116 may be stored internally or externally in the authentication controller 114.

The encryption key 116 is sent by the authentication subsystem 104 to the encryption engine 110 once the user 122 with the identification number or key is verified against the authentication key 118.

By using the authentication key 118 and encryption key 116, it has been found that the portable memory storage devices of various embodiments of the present invention can provide a very high level of security that was not previously available in such devices. lost.

When the data security system 100 is locked, the authentication key 118 remains inside the authentication subsystem 104 and cannot be read from outside. One way to hide the authentication key 118 is to store it in the authentication controller 114 of the authentication subsystem 104. Setting the security fuse of the authentication controller 114 makes it impossible to access the authentication key 118 once the user 122 is verified and the authentication controller 114 does not allow searching. Many microcontrollers are equipped with security fuses that prevent them from accessing any internal memory when they are broken. This is a known and widely used security feature. Such a microcontroller can be used for the authentication controller 114. The authentication controller 114 may be a microcontroller or a microprocessor.

The authentication key 118 can be used as in several competencies:

1. Can be used as an encryption key 116 to directly encrypt / decrypt information.

2. It can be used as a key to recover the encryption key 116 stored in the data security system 100 that can be accessed by the interface controller 108.

3. Can be used for direct comparison by the interface controller 108 to activate the external communication channel 102.

Referring now to FIG. 2, shown is a diagram of an authentication key delivery method for use with the data security system 100. In this figure, the authentication key 118 and the encryption key 116 are one and the same. The encryption engine 110 uses the authentication key 118 as the encryption key 116.

The user 122 must interact with the authentication subsystem 104 by providing the user identification 202, number or key to the authentication subsystem 104. Authentication subsystem 104 authenticates user 122 against authentication key 118. Authentication subsystem 104 sends authentication key 118 to interface controller 108 as encryption key 116.

The encryption engine 110 in the interface controller 108 converts the clear information into encrypted information and the encrypted information into clear information along the channel 206 using the authentication key 118. Any attempt to read encrypted information from storage medium 112 without encryption key 116 will result in information that is generally not available to any computer.

Referring now to FIG. 3, there is shown a diagram of different systems in which user 122 interacts with data security system 300. The interaction may be by communication combination 301, which may be by physical contact, wired connection or wireless connection from a cell phone, smartphone, smart watch, wearable consumer electronics or other wireless device.

In one authentication system, mobile transceiver 302 is used to transmit user identification 304 to data security transceiver 306 of authentication subsystem 310. For illustrative purposes, transceivers are used for bidirectional communication flexibility, but transmitter-receiver combinations for unidirectional communication may also be used. Authentication subsystem 310 includes an authentication controller 114 coupled to interface controller 108 of storage subsystem 106. The user identification 304 is supplied to the data security transceiver 306 in the authentication subsystem 310 by the mobile transceiver 302 from outside the storage subsystem 106 of the data security system 300. Wireless communications include Wireless Fidelity (WiFi), Bluetooth (BT), Bluetooth Smart, Near Field Communication (NFC), and Global Positioning System (GPS). ), Optical, cellular communication (e.g., Long-Term Evolution (LTE), Long-Term Evolution Advanced (LTE-A)), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Universal Mobile Telecommunications System (UMTS), Wireless Broadband (WiBro), or World Mobile Communications System ( Global System for Mobile Communications (GSM), etc.).

Authentication subsystem 310 authenticates user 122 against authentication key 118 by having the code sent from mobile transceiver 302 authenticated against authentication key 118. Authentication subsystem 310 then sends encryption key 116 to interface controller 108 via communication combination 301.

The encryption engine 110 then uses the encryption key 116 to convert clear information to encrypted information along the channel 206 and to convert the encrypted information to clear information. Any attempt to read encrypted information from storage medium 112 without encryption key 116 generally results in information that is not available by host computer system 120.

In an optional second authentication mechanism, authentication subsystem 310 authenticates by allowing user 122 to verify its identity as an authorized user using biometric sensor 320 providing biometric input 322. Prove user 122 against key 118. Types of biometric identification include fingerprints, iris scans, voice imprints, and the like.

In an optional third authentication mechanism, the authentication subsystem 310 authenticates by allowing the user 122 to verify its identity as an authorized user using an electromechanical input mechanism 330 that provides a unique code 332. Prove user 122 against key 118. Unique code 332 may include a numeric, alphanumeric or alphabetic code, such as a PIN. The electromechanical input mechanism 330 is in the authentication subsystem 310. The electromechanical input mechanism 330 receives the unique code 332 from the user 122 from outside of the data security system 300. The unique code 332 is provided to the electromechanical input mechanism 330 in the authentication subsystem 310 from outside the storage subsystem 106 of the data security system 300.

Whichever method is used to verify user 122, authentication key 118 and encryption key 116 remain hidden until user 122 is authenticated.

Referring now to FIG. 4, shown is a diagram of how user 122 can interact with data security system 400 using host computer system 120.

The host computer system 120 is provided with a host application 402. The host application 402 is software or firmware that communicates via an external communication channel 102 of the data security system 400.

The host application 402 may include internal component serial numbers (eg, hard drives) associated with its environment, media access control (MAC) addresses of network cards, login names of users, network internet protocols ( a host identifier 406 such as a network Internet Protocol (IP) address, an ID generated by the data security system and stored in the host, an ID generated by the data security system and stored in the network, and the like. The host identifier 406 is used by the authentication subsystem 408 of the data security system 400.

When the authentication subsystem 408 verifies the user 122 against the authentication key 118 by verifying the host identifier 406, the data security system 400 will be unlocked.

For example, user 122 connects to data security system 400 that is locked to host computer system 120. The host application 402 sends the network card's MAC address to the data security system 400. Data security system 400 recognizes this MAC address as legitimate and unlocks without requiring user 122 of FIG. 1 to enter a user identification. This is an implementation that does not require any interaction with user 122. In this case, what is proven is the host computer system 120 and its associated environment.

Data security system 400 includes: providing an authentication key 118 stored in authentication subsystem 104; Providing verification of the host computer system 120 by the authentication subsystem 104; Providing encryption key 116 to storage subsystem 106 by authentication subsystem 104; And providing access to the storage medium 112 by the storage subsystem 106 by decrypting the storage medium content.

The data security system further includes an authentication subsystem 104 for interpretation of biometric input and verification of the user 122.

The data security system further includes using the authentication key 118 directly as the encryption key 116.

The data security system further includes decrypting and retrieving the encryption key 116 used to decrypt the internal content using the authentication key 118.

The data security system further includes an authentication subsystem 104 for interpretation of the signal input and for verification of the transmission unit.

The data security system further includes an authentication subsystem 104 for the interpretation of manually entered inputs and for verification of the user 122.

The data security system further includes an authentication subsystem 104 for interpreting input sent by the host resident software application for verification of the host computer system 120.

The data security system is external to the interface controller 108 but further includes an encryption engine 110 connected to an external communication channel 102 for the purpose of converting clear data into encrypted data to unlock the data security system 100. Include.

Referring now to FIG. 5, a data security method 500 using user verification in the data security system 100 is shown. The data security method 500 includes verifying the user against an authentication key at block 502; Retrieving the encryption key using the authentication key at block 504; And enabling an unencrypted communication over the storage subsystem between the host computer system and the storage medium using the authentication key at block 506.

Referring now to FIG. 6, an exemplary data secure communication system 600 is shown. Exemplary data secure communication system 600 includes mobile device 610, data security system 620, host computer 630, and server / console 640. Mobile device 610 and server / console 640 are connected by a wired or wireless connection via cloud 650, which may be an internet cloud. Mobile device 610 and data security system 620 are connected by communication combination 301.

The communication combination 301 of the example data security communication system 600 may include a mobile device 610 having an antenna 614 in wireless communication with the antenna 622 of the data security transceiver 624 in the data security system 620. Mobile transceiver 612.

In one embodiment, the mobile device 610 may be a smartphone. In mobile device 610, mobile transceiver 612 may be coupled to conventional mobile device components and data security system application 618, where the data security system application provides information to be used with data security system 620. do.

The data security transceiver 624 is coupled to a security controller 626 that can include information including identification, passwords, profiles, or information of different mobile devices that can access the data security system 620. Security controller 626 is coupled to authentication subsystem 310, a storage subsystem 106 (which may in some embodiments have encryption to encrypt data), and similar subsystems to external communication channel 102.

The external communication channel 102 is connectable to the host computer 630 which allows access to data in the storage subsystem 106 under certain circumstances.

One implementation of the data security system 620 may eliminate the biometric sensor 320 and electromechanical input mechanism 330 of FIG. 3 having only a wireless link to a mobile device 610, such as a smartphone. This implementation has been found to make the data security system 620 safer and more useful.

The data security system application 618 allows the mobile device 610 to discover all data security systems in the vicinity of the mobile device 610 and to determine their status (locked / unlocked / blank, paired / unpaired, etc.). Enable to show

The data security system application 618 allows the mobile device 610 to connect / pair, lock, unlock, change name and password, and reset all data on the data security system 620.

The data security system application 618 may cause the mobile device 610 to set an inactivity auto-lock so that the data security system 620 automatically locks after a predetermined period of inactivity, or close proximity automatically. Set a security auto-lock so that the mobile device 610 is not within a predetermined proximity for a predetermined period of time (to improve reliability and prevent signal de-bouncing). 620 will lock.

The data security system application 618 allows the mobile device 610 to store a password, and similarly, although Touch ID and Touch Watch (both Touch ID and Apple Watch are mentioned herein as examples only). And many other mobile devices with biometric sensors and wearables that can be used in the same mode) can be used, so that the data security system 620 can be unlocked without re-entering a password on the mobile device. have

The data security system application 618 allows the mobile device 610 to be set up to operate only in conjunction with a particular mobile device, such as the mobile device 610, so that the data security system 620 can be used to match other mobile devices (1Phone). Cannot be unlocked with).

The data security system application 618 allows the mobile device 610 to make the data security system 620 read only.

Data security system application 618 allows mobile device 610 to operate in user mode or administrator mode (administrator mode overrides user's settings) and use server / console 640. Server / console 640 is a combination of a console and a computer for entering information into the computer.

Server / console 640 includes a user management database 642 that includes additional information that may be sent to mobile device 610 via cloud 650 to provide additional functionality to mobile device 610. do.

User management database 642 allows server / console 640 to create and identify users using user IDs (usernames and passwords), and to block / unlock data security system 620 Allows you to provide remote help.

User management database 642 allows server / console 640 to remotely reset or unlock data security system 620.

The user management database 642 allows the server / console 640 to remotely change the PIN of the data security system user.

The user management database 642 allows the server / console 640 to restrict / unlock the data security system 620 from certain locations (using geo-fencing).

The user management database 642 allows the server / console 640 to limit / unlock the data security system 620 at specified time periods and at different time zones.

The user management database 642 allows the server / console 640 to restrict unlocking the data security system 620 outside of designated teams / organizations / networks, and the like.

Referring now to FIG. 7, shown is a manager sequencing diagram illustrating a sequence of operations between mobile device 610 and data security system 620.

The connectivity 700 between the data security system 620 and the mobile device 610 is first established by mutual discovery of another device or system, pairing of the device and the system, and connection of the device and the system. Connectivity 700 is secured using a shared secret, which is then used to secure (encrypt) communications between data security system 620 and mobile device 610 for all future communication sessions. do. Standard encryption algorithms are executed on the data security system 620 and approved by global security standards, both of which are selected to be efficient.

Connectivity 700 is maintained by data security system application 618 or security controller 628 or by both working together as long as data security system 620 and mobile device 610 are within a predetermined distance from each other. do. In addition, if the predetermined distance is exceeded, the connectivity 700 is maintained for a predetermined period of time after the data security system 620 is locked.

After connecting the mobile device 610 and the data security system 620, a data security system administrator application start operation 702 occurs in the mobile device 610. The administrator then sets a password in administrator password operation 704. Further, after connection of the mobile device 610 and the data security system 620, in a data security system connected, powered and discoverable operation 706, the data security system 620. Is connected to the host computer 630 of FIG. 6 and powered by the host computer 630 to be found.

After administrator password operation 704, mobile device 610 transmits a set administrator password and unlock signal 708 to data security system 620. The administrator password and unlock setting signal 708 causes an administrator password set and data security system unlocked operation 716 to occur in the data security system 620.

When the administrator password setting and data security system unlocking operation 716 is completed, a confirmation: data security system unlocked signal 712 is sent to the mobile device 610, where Confirmation: A data security system unlocked as administrator operation (714) operation 714 operates. Confirmation: As administrator, the data security system unlocking operation 714 causes a set other restrictions operation 716 to be performed using the mobile device 610. Another set of restrictions operation 716 causes a set administrator restrictions signal 718 to be sent to the data security system 620 and a confirmation: restrictions set signal at the data security system. 720 is returned to mobile device 610. Thereafter, the mobile device 610 and the data security system 620 are in a state where communication is completely ready for operation.

Since it is possible to communicate with the data security system 620 without physical contact with the data security system 620, important interactions with the data security system 620 are printed on the data security system 620 itself or data security. It is required to be accompanied by a data security system unique identifier provided with the system 620 packaging and readily available to the data security system 620 owner.

This unique identifier (unique ID) is required when making a request that may affect user data, such as unlocking or resetting the data security system 620. Attempts to perform these operations without an exact identifier are ignored and made harmless. The unique identifier requires the user to have physical control over the data security system 620 and an authorized device whose connectivity 700 is previously paired, such as the mobile device 610 and the data security system 620. And identify the data security system 620 to the mobile device 610 in a manner that requires verification of what is established between the systems. Once the devices are paired, the shared secret is used to create a communication secret.

Pairing implies that mobile devices and data security systems have unique and established relationships that are established and persisted at some point in the past.

The unique identifier allows the user to grant some control over the data security system when the user has physical control over the data security system.

To increase the security of communication with the data security system 620 when the mobile device 610 is a smartphone, the user may choose to activate a feature, such as a feature called 1Phone herein. This feature limits critical user interaction with the data security system 620 to only one mobile device 610. This is accomplished by replacing the aforementioned data security system unique identifier with a random identifier that is securely shared between the data security system 620 and the mobile device 610. Thus, for example, when a user unlocks the data security system 620, instead of presenting the data security system unique identifier, a 1Phone identifier should be given instead. In practice, this makes the user's mobile device 610 a second authentication factor for using the data security system 620, in addition to a PIN or password. As an example, a paired user telephone selected as "1Phone" may be used without a PIN and as a user authentication single factor and / or in combination with any other user authentication factors. If this feature (1Phone) is selected, the data security system 620 cannot be opened with any other phones except when the administrator's unlock was previously activated.

It will be appreciated that other embodiments may be made that require the administrator's password in the data security system 620 to use the 1Phone feature. Another embodiment may require the server / console 640 to be able to recover the data security system 620 in the event that 1Phone data is lost on the mobile device 610.

The user may be enabled to activate the proximity lock feature for data security system 620. During the communication session, the data security transceiver 624 of FIG. 6 reports the signal strength measurement of the mobile device 610 to the data security system 620. The data security system application 618 on the mobile device 610 sends both an outgoing signal power level and a threshold of proximity to the data security system 620.

Since signal strength changes due to environmental conditions around the transceivers, the data security system 620 mathematically smoothes the signal strength measurements to reduce the possibility of false positives. When the data security system 620 detects that the received signal power has fallen below a defined threshold for a predetermined period of time, it immediately locks the data security system 620 and prevents access to the storage subsystem 106 of FIG. 6. something to do.

The data security system 620 can be divided into three different modes: a user mode in which the functionality of the data security system 620 is determined by the user; The administrator can set an administrator password and enforce some restrictions on the data security system 620 (eg, auto lock, read only, 1Phone after a predetermined period of inactivity) and restrictions can be removed by the user. No admin mode; And in server mode where the administrator role is set when the server / console 640 can remotely reset the data security system 620, change the user password, or correctly unlock the data security system 620. Can be.

Referring now to FIG. 8, an unlock sequence diagram is shown where mobile device 610 is an authentication factor. This diagram shows the automatic unlocking process of the data security system 620 initiated by the data security system application 618 from the mobile device 610, which is a particular mobile device. The user may initially use only one mobile device paired with the data security system 620. If the paired mobile device 610 is lost, the data security system 620 cannot be unlocked (unless an administrator password has been previously set as shown in FIG. 7).

Although similar to FIG. 7, a data security system application started operation 800 occurs after connectivity 700 is established. An unlock required with mobile device ID signal 802 is sent from the mobile device 610 to the data security system 620 after the data security system connection, power up, and discoverable operation 706. . A data security system unlocked operation 804 occurs and the confirmation: data security system unlocked signal 712 is transmitted from the data security system 620. Confirmation: data security system unlocked After operation 806, the mobile device 610 and data security system 620 are in a state where communication is fully ready for operation.

If a Personal Identification Number (PIN) is not set, then the paired mobile device is used as a 1-authentication factor.

Referring now to FIG. 9, an unlock sequencing diagram is shown that illustrates unlocking using a PIN input from mobile device 610. This diagram shows the process of unlocking the data security system 620 by entering a PIN into the data security system application 618 of the mobile device 610. The data security system 620 cannot be unlocked without entering the correct PIN.

Although similar to FIGS. 7 and 8, after a data security system application startup operation 800, an enter username / password operation 900 occurs. After the username / password entry operation 900, the mobile device 610 sends a verify user ID signal 902 to the server / console 640. Server / console 640 then makes a username / password valid decision 904.

When the username / password validity determination 904 verifies the user, a valid user signal 906 is sent to the mobile device 610 so that the user enters the PIN of the mobile device 610. In 908, enter the correct PIN. Mobile device 610 then sends a verify unlock signal 910 to determine if the correct PIN has been entered at server / console 640.

Server / console 640 makes a user authorized decision 912 and determines whether the user is authorized to use a particular data security system, such as data security system 620 to which the PIN is authorized. If authorized, an unlock allowed signal 914 is sent to the mobile device 610, which transmits an unlock request signal 916 to the data security system 620.

A data security system unlock operation 804 is performed, and a confirmation: data security system unlock signal 712 is sent to the mobile device 610, and a confirmation at the mobile device: data security system unlock operation 806 is performed. do.

Referring now to FIG. 10, an unlock sequencing diagram is shown illustrating unlock using PIN entry and user ID / location / time verification via server / console 640. This diagram shows a user entering a PIN from the mobile device 610 into a data security system application 618, entering authentication into a server / console 640 server using a user ID (username / password), and a specific location and The most secure process for unlocking data security system 620 is shown by verifying virtual fence permissions to unlock data security system 620 in a specific time range. The data security system 620 cannot be unlocked without entering a PIN, username and password, and without the mobile device 610 present at a specific (predefined) location and at a specific (predefined) time. .

Although similar to FIGS. 7-9, in server / console 640, an unlock specified data security system operation 1000 is performed such that a particular data security system, such as data security system 620, is performed. Allows you to set desired conditions for operation. For example, the conditions may be within a specific geographic area and / or within a specific time frame.

At mobile device 610, a current condition determination is made as in the location location and / or current time operation 1002. This operation is performed to determine where the mobile device 610 is and what time the current time of where the mobile device 610 is is. Other current conditions around the mobile device 610 are also determined and sent to the server / console 640 by a verify unlock signal 1004 and conditions met determination at the server / console. Decision 1006 is made.

When the desired conditions are met, an unlock allowed signal 1008 is sent to the mobile device 610 where the PIN input operation 908 is performed. After the PIN is entered, a verify unlock signal 1010 is sent with the PIN and the identifier of the data security system 620 that is closest in operation to the mobile device 610. The unlock verification signal 1010 is received by the server / console 640 and the data security system allowed decision 1012 determines that an authorized user is allowed to unlock the specified data security system. Get off. Server / console 640 verifies that this "specific" user is authorized to use the specified data security system.

After determining that the correct information has been provided, the server / console 640 will provide an unlock allowed signal 914 to the mobile device 610, and the mobile device will unlock the request signal 916. Will provide). The unlock request signal 916 causes the data security system 620 to operate.

Referring now to FIG. 11, shown is a reset sequencing diagram illustrating resetting data security system 620 using server / console 640. This diagram shows the ability to remotely reset the data security system 620 via the server / console 640. The data security system 620 can only receive commands via the wireless connection from the mobile device 610 only. However, by setting the "Reset" flag on the server / console 640 for a particular data security system (using S / N), the data security system application 618 running on the mobile device 610 may not be able to access the server / console. The console 640 will be queried for any flags / open requests in the user management database 642. When the user connects to the data security system 620, the data security system application 618 on the mobile device 610 will execute the pending "reset" command. After a successful reset (all user data and credentials are lost), server / console 640 will remove the reset flag, so this will not be executed the next time mobile device 610 connects to a particular data security system. .

Similar to FIGS. 7-10, the mobile device 610 transmits any command waiting signal 1100 to the server / console 640 in response to the valid user signal 906 to reset the command (see FIG. 7-10). reset command) decision 1102. When a command reset is present, a perform reset signal 1104 may be sent to the mobile device 610.

Mobile device 610 will send a reset security system signal 1106 to data security system 620 to initiate a data security system reset operation 1108. Upon completion of the data security system reset operation 1108, the data security system 620 sends a confirmation: data security system reset (1110) signal 1110 to the mobile device 610 to confirm: data security. A data security system reset (11) operation 1112 will be set to an operational state. Thereafter, the mobile device 610 and the data security system 620 are in a state where communication with the reset data security system 620 is fully ready to be driven.

Referring now to FIG. 12, there is shown an unlock sequencing diagram illustrating unlocking a data security system 620 using a server / console 640. This diagram shows the ability to remotely unlock data security system 620 via server / console 640. The data security system 620 may receive a command over a wireless connection only from the mobile device 610. However, by setting an "Administrator Unlock" flag on the server / console 640 for a particular data security system (using S / N), the data security system application 618 running on the mobile device 610 may be random. Will query the server / console 640 for its flags / open requests. When the user connects to the data security system 620, the data security system application 618 on the mobile device 610 will execute the pending "unlock manager" command. After the administrator successfully unlocks, the user's data is not compromised but the user's password is removed (data security system 620 cannot be unlocked by the user). The server / console 640 will remove the reset flag for the data security system 620, so this will not be executed the next time the mobile device 610 is connected to the data security system 620.

7-11, but after receiving any command wait signal 1100, the server / console 640 performs unlock 1200 when there is a command to unlock with the administrator's password. An unlock with an administrator's password signal 1202 is transmitted to the mobile device 610, and the mobile device sends an unlock with administrator's password signal 1204 to the data security system. Provide to 620 to initiate a data security system unlock operation 804. Thereafter, the mobile device 610 and data security system 620 are in a state where communication is fully ready to drive.

Referring now to FIG. 13, a password change sequencing diagram of a user using server / console 640 is shown. This diagram illustrates the ability to remotely change a user's password via server / console 640 for data security system 620. By setting the "Change User's Password" flag on the server / console 640 for a particular data security system (using S / N), the data security system 620 can only establish a wireless connection from the mobile device 610. Although able to receive the command via data security system application 618 running on mobile device 610 will query server / console 640 for any flags / unpaid requests. When the user connects to his data security system 620, the data security system application 618 on the mobile device 610 will execute the pending "change user's password" command. After a successful unlock and password change, the user's data is not compromised and the data security system 620 can be unlocked with the user's new password. The server / console 640 will remove the "change user's password" flag for this data security system 620, so that next time the mobile device 610 is connected to a particular data security system it will not be executed. .

Similar to FIGS. 7-12, server / console 640 responds to any command wait signal 1100 by making a change password decision 1300. When there is a password change at the server / console 640, a change user password signal 1302 is sent to the mobile device 610, and the mobile device changes to a user password signal 1304. To the data security system 620. Thereafter, the mobile device 610 and data security system 620 are in a state where the communication is fully ready to be driven with the new password.

A method of operating a data security system includes: providing a data security system application to a mobile device for connectivity with a data security system; Starting a data security system application; And maintaining connectivity of the mobile device with the data security system.

Maintaining connectivity in the method as described above maintains connectivity when the data security system is within a predetermined proximity to the mobile device.

Maintaining connectivity in the method as described above maintains connectivity when the data security system is within a predetermined proximity to the mobile device for a predetermined period of time.

In the method as described above, establishing the connectivity includes using two-way communication between the data security system and the mobile device.

In the method as described above, establishing connectivity includes using unidirectional communication between the data security system and the mobile device.

The method as described above further includes communication between the mobile device having the data security system application and the server comprising a user management database.

 The method as described above further comprises providing security information to a security controller of the data security system.

The method as described above comprises the steps of: providing an identification of a designated data security system to a server; Providing a specific identification to a data security system; And when the identification of the designated data security system is the same as the specific identification of the data security system, unlocking the data security system.

In a method as described above, providing a data security system application to a mobile device provides an application of a data security system administrator, the method comprising: setting an administrator's password on the mobile device; Transmitting the administrator's password from the mobile device to the data security system; And setting the administrator's password in the data security system and unlocking the data security system.

The method as described above includes: providing an unlock request with the mobile device identification from the mobile device to the data security system; And receiving an unlock request at the data security system and unlocking the data security system.

The method as described above comprises the steps of: entering a user name or password into the mobile device; Determining when the username or password is valid at the server after receiving the username or password from the mobile device; Communicating from the server to the mobile device when the username or password is valid; And communicating from the mobile device to the data security system when the username or password is valid to unlock the data security system.

The method as described above comprises the steps of: entering a user name or password into the mobile device; Determining when the username or password is valid at the server after receiving the username or password from the mobile device; Communicating from the server to the mobile device when the username or password is valid; Determining when the identification number is valid at the server after receiving the identification number from the mobile device; And unlocking the data security system via the mobile device when the server determines that the identification number is valid.

 The method as described above comprises the steps of: providing a server with a valid location of the mobile device; Determining when the mobile device is in a valid location at the server; And unlocking the data security system via the mobile device when the server determines that the mobile device is in a valid location.

The method as described above includes: providing a server with a current time of operation for a data security system at a mobile device; Determining when the mobile device is within the current time at the server; And unlocking the data security system via the mobile device when the server determines that the mobile device has the current time.

The method as described above includes: providing a command at a server; Providing a command from the server to the mobile device in response to the command wait signal from the mobile device; And performing the command in the data security system via the mobile device when the command is provided from the server.

The method as described above comprises the steps of: providing a password change command at the server; Providing a password change command from a server to the mobile device in response to a password change signal from the mobile device; And unlocking the data security system with the changed password in the data security system.

The method as described above further comprises connecting the data security system to the host computer for powering up so that it is discoverable by the host computer.

The data security system includes: a data security transceiver or receiver; An authentication subsystem operatively connected to the data security transceiver or receiver; And a storage subsystem coupled to the authentication subsystem.

The system as described above further comprises a security controller coupled to the data security transceiver or receiver and to the authentication subsystem.

The system as described above further includes a mobile device having a data security system application that operates with the security controller to maintain connectivity when the data security system is within a predetermined proximity to the mobile device.

The system as described above further includes a mobile device having a data security system application that operates with the security controller to maintain connectivity when the data security system is within a predetermined proximity to the mobile device for a predetermined period of time.

The system as described above further includes a mobile device having a mobile transceiver or receiver utilizing two-way communication between the data security system and the mobile device to maintain connectivity.

The system as described above further includes the mobile device having a mobile transceiver or receiver to use unidirectional communication between the data security system and the mobile device to maintain connectivity.

The system as described above further comprises wired or wireless connection communication between the mobile device having the data security system application and the server comprising a user management database.

In a system as described above, the data security system includes an external communication channel for connecting to a host computer.

While the present invention has been described in connection with specific best modes, it should be understood that many alternatives, modifications, and variations will be apparent to those skilled in the art in light of the foregoing description. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the scope of the appended claims. All matters described in this specification or shown in the accompanying drawings are to be interpreted in an illustrative and non-limiting sense.

Claims (20)

As a method,
Detecting a connection to a data storage device having a locked data channel, the data storage device having an interface controller for communication over the data channel, an authentication subsystem having memory, authentication information and encryption keys, encryption An engine, and a wireless transceiver for radio frequency communication outside said data channel;
Receiving, via the wireless transceiver, a user authentication input while the data channel through the interface controller is locked;
Unlocking the data channel of the data storage device based on the received user authentication input and the authentication information of the authentication subsystem; And
While the data channel is unlocked:
After encrypting the data received via the data channel by the encryption key, storing the encrypted data in the memory; And
Transmitting, by the encryption key, the decrypted data over the data channel after decrypting the data read from the memory.
How to include. The method of claim 1,
Sending the encryption key from the authentication subsystem to the encryption engine based on unlocking, wherein the encryption key is not stored in the memory of the data storage device and the encryption key is the data storage device. Method not accessible from outside of. The method of claim 1,
Receiving the user authentication input includes:
Communicating with an application of a mobile device via the wireless transceiver; And
Receiving the user authentication input from the mobile device
Further comprising, the method. The method of claim 1,
Receiving the user authentication input includes:
Communicating with an application of a mobile device via the wireless transceiver, the application comprising a user interface for inputting the user authentication input by a user, when the user authentication input is validated by a remote server, The remote server sends a confirmation to the application; And
After the user is verified by the remote server, receiving, by the data storage device, the user authentication input from the mobile device via the wireless transceiver
Further comprising, the method. The method of claim 4, wherein
And receiving a command for changing the authentication information from the application of the mobile device after the application of the mobile device receives the command for changing the authentication information from the remote server. The method of claim 4, wherein
The application of the mobile device causes the mobile device to lock the data channel of the data storage device, unlock the data channel of the data storage device, change the user name, change the authentication information, Resetting the data storage device. The method of claim 4, wherein
The application of the mobile device enables the remote server to reset the data storage device and unlock the data storage device. The method of claim 4, wherein
The application of the mobile device allows the remote server to determine the presence of the mobile device within a geo-fence, thereby limiting the use of the data storage device to specific locations using the virtual fence. , Way. The method of claim 4, wherein
The application of the mobile device allows the remote server to limit the use of the data storage device to specific time periods and periods. The method of claim 1,
And the data channel is a computer bus interface. The method of claim 1,
The radio frequency communication may be one of wireless fidelity (WiFi), Bluetooth (BT), Bluetooth Smart (BLE), Near Field Communication (NFC), or cellular communication. , Way. As a data storage device,
Memory;
An interface controller for communicating over a locked data channel until a user is authenticated;
A radio transceiver for radio frequency communication outside the data channel, the radio transceiver configured to receive a user authentication input;
An authentication subsystem having authentication information and an encryption key, the authentication subsystem unlocking the data channel of the data storage device based on the received user authentication input and the authentication information; And
Encrypt data received through the data channel with the encryption key before storing encrypted data in the memory, and read data from the memory into the encryption key before transmitting decrypted data through the data channel. Encryption engine for decryption by
Data storage device comprising a. The method of claim 12,
The authentication subsystem sends the encryption key to the encryption engine based on unlocking, the encryption key is not stored in the memory of the data storage device, and the encryption key is accessible from outside of the data storage device. Data storage device. The method of claim 12,
Receiving the user authentication input is:
Communicating with an application of a mobile device via the wireless transceiver; And
Receiving the user authentication input from the mobile device via the wireless transceiver
The data storage device further comprises. The method of claim 12,
Receiving the user authentication input is:
Communicating with an application of a mobile device via the wireless transceiver, the application including a user interface for inputting the user authentication input by a user, when the user authentication input is verified by a remote server; Sends a confirmation to the application; And
After the user is verified by the remote server, receiving, by the data storage device, the user authentication input from the mobile device
The data storage device further comprises. The method of claim 15,
The authentication subsystem is configured to receive a command for changing the authentication information from the application of the mobile device after the application of the mobile device receives the command for changing the authentication information from the remote server. Storage device. A non-transitory machine readable storage medium comprising instructions that when executed by a machine cause the machine to perform operations,
The operations are:
Detecting a connection to a data storage device having a locked data channel, wherein the data storage device comprises an interface controller for communication over the data channel, an authentication subsystem having memory, authentication information and encryption keys, an encryption engine, and A radio transceiver for radio frequency communication outside said data channel;
Receiving, via the wireless transceiver, a user authentication input while the data channel through the interface controller is locked;
Unlocking the data channel of the data storage device based on the received user authentication input and the authentication information of the authentication subsystem; And
While the data channel is unlocked:
Storing, by the encryption key, the encrypted data in the memory after encrypting the data received through the data channel; And
Transmitting, by the encryption key, the decrypted data over the data channel after decrypting the data read from the memory.
A non-transitory machine readable storage medium comprising a. The machine of claim 17 wherein the machine is:
Performing operations including transmitting the encryption key from the authentication subsystem to the encryption engine based on unlocking, wherein the encryption key is not stored in the memory of the data storage device; A non-transitory machine readable storage medium that is not accessible from outside of the data storage device. The method of claim 17,
Receiving the user authentication input is:
Communicating with an application of a mobile device via the wireless transceiver; And
Receiving the user authentication input from the mobile device via the wireless transceiver
The non-transitory machine readable storage medium further comprising. The method of claim 17,
Receiving the user authentication input is:
Communicating with an application of a mobile device via the wireless transceiver, the application including a user interface for inputting the user authentication input by a user, when the user authentication input is verified by a remote server; Sends a confirmation to the application; And
After the user is verified by the remote server, receiving, by the data storage device, the user authentication input from the mobile device
The non-transitory machine readable storage medium further comprising.

Images