SE0950854A1 - Method and arrangement for securing information - Google Patents

Abstract

The present invention relates to a memory arrangement (70, 80, 90) consisting of a security driver application (71, 901) and a storage (72, 902), wherein said driver application (71) is configured to, upon request, authenticate a user using of an authentication procedure and secure and/or insecure data on said storage part. The driver application is further configured to provide or deny access to said data or delete said data stored in the memory arrangement. (Fig. 9)

Description

10 15 20 25 Standard USB sticks store data without encryption, providing easy access to the stored data, for example if the USB memory is lost.

Currently, secure USBs are designed to work with users who secure their own memories. Some companies, for example, may just want their IT administrators to be able to secure memories and then distribute to their users, so that users do not have to do the securing process.

When a USB memory is secured and available for the first time, USB can be registered in one server belonging to the user who secured it. The memory is provided with some private information belonging to the user (called a USB token) and this information is sent to the server to verify that the memory was actually created by the user.

There is thus a need for a procedure to provide the benefits of USB or the like memory type connection options, while enabling increased security.

SUMMARY Advantages of the invention are: - Allow the user to secure / unsecure data to a memory device, - Operated by the client (the computer that receives the memory) based on policy settings, - Encryption method is controlled by policy setting, - Ability to monitor the commissioning process centrally, Ability to centrally configure the method for securing the memory device Opportunity to follow different protection methods that suit the user's working methods. Ability to utilize the encryption and decryption logic on any computer, without the need for extra drivers, - Easy usability, guided commissioning - Allows an administrator and / or a user to use the security process - Allows logging of user interactions, and tracks content revision history, 10 15 20 25 30 Apply encryption to everything placed in the memory device, - Central control over the stored information.

For these and other reasons mentioned below, a memory arrangement is provided including a driver application for security and a storage component. The driver application is configured to, when opened, authenticate a user using a authentication procedure and secure and / or insecure data on said storage arrangement.

The driver application is further configured to allow or deny access to said data or delete said data stored in said memory arrangement.

The coin access arrangement may include end-user processing commands such as is used to access said data. Advantageously, the memory arrangement is one of USB (Universal Serial Bus) memory device, digital camera, digital video camera, Personal Digital Assistant (PDA) or a mobile phone. The memory arrangement can be configured to connect to one hosted using one or fl era of a USB bus, FireWire (IEEE 1394), Human Interface Devices (HID), PCMCIA, Bluetooth or IR. The memory arrangement can use an application on a host configured to guide the user and act as a link between the user and the memory arrangement. The application may be part of memory encryption policy and applied to the user centrally. In one embodiment, one comprises user deployment configuration one of: secure the memory arrangement manually, ask that secure the memory arrangement each time for each device, ask to secure the memory arrangement each time an insecure device is used. The memory arrangement is further configured to block said data on a synchronization process in the absence of a synchronization process within a specified period of time.

The invention also refers to a method for policy-based safe deployment for one memory arrangements, using a first level of operation, a second level of policy and a third component logic level, wherein an administrator administers said deployment policy of the second level, whereby the safety commissioning is transferred to said third level, where a server communicates with a client, which is intended to receive said memory arrangement, and when said memory arrangement is received, security rules are transferred to it, wherein at receiving according to a command from the server of the memory arrangement on said component logic level, said memory is arranged to provide access to or deny access to or delete data on said memory arrangement. Preferably, when data is secured, it is 10 15 20 25 encrypted using the appropriate encryption method. The method may further comprise a function time lock for to lock the arrangement after a predetermined period of time. The method may include one recovery procedure that acts as a second private password. The reset password works by: Assign an ID to a key location that has a key used to secure the event - Storage of a centrally administered user ID in a user profile database, - Use the user's reset password as the reset seed, providing a key used to encrypt said arrangement as a hash, - If the password is lost: - Authenticate the user and receive a data recovery, Use the said recovery data and the user who owns the recovery data used in encryption, authenticate the user and use the reset password to secure a certain content.

In one embodiment, hash consists of a key identifier, user identifier and recovery seed. combined. The recovery data can be user identifier in combination with the key identifier. A final recovery key is generated using: user identifier, key identifier and recovery seed.

BRIEF DESCRIPTION OF DRAWINGS In the following, the invention is described with reference to a number of non-limiting exemplary embodiments illustrated schematically in the accompanying drawings, in which: Fig. 1 shows a block diagram showing protection levels according to the invention, Fig. 2 shows a block diagram showing the key management according to the invention, Fig. 3 is a block diagram showing the steps for generating recovery keys according to the invention, Fig. 4 shows a block diagram for handling recovery keys according to the invention, 10 15 20 25 Fig. 5 shows a block diagram showing inquiry and response logic according to the invention, Fig. 6 is a block diagram of the method of invention, Fig. 7 is a block diagram showing a USB / computer according to the invention, Fig. 8 is a block diagram showing a memory / computer connection according to the invention, and Fig. 9 shows a block diagram showing the principles of the invention.

DESCRIPTION In the following, the invention is described with reference to a desired embodiment of a USB (Universal Serial Bus) Memory Stick. However, it is obvious to a person skilled in the art that the teachings of the invention can be implemented on all types of memory devices that can be connected to one computer, for example, memory devices include memories, digital cameras, digital video cameras, Personal Digital Assistant (PDA), mobile phones, etc., which can be connected to a host for example a computer via a USB bus, FireWire (IEEE 1394), Human Interface Devices (HlD), PCMCIA, Bluetooth, IR mm.

Fig. 9 schematically shows the principles of the invention. An exemplary system may consist of one memory device 90, according to the present invention, a user computer 95, and a server 92 which communicates via a network 93.

The memory unit 90 consists of a layer of executable instruction sets, i.e. driver application, 901 and stored in a portion of the memory 902, the storage data area 9021 is user profile data 9022 and secured (encrypted) memory area 9023. The driver part can include instructions for encrypting / decrypting data and communicating with the server 92.

Encryption / decryption, username and setup managed is entirely the 901 driver.

The component 9022 may include protection methods for one or more users of the memory device.

The protection methods can be: - Customized, - Private, - Master, 10 15 20 25 - Restoration, - Safe groups, - Corporate security.

These methods are described in more detail below.

The server 92, which can communicate with the memory device via the network 93, at any time communication is established, may contain a database 920 for the user identities, user passwords, user groups, master passwords, reset passwords, etc.

However, the master password for encryption, decryption of the memory device set by the user is stored on the memory device itself.

The following describes parameters involved when a user 96 goes from having an unprotected one memory device to a protected memory device. Basically, the client program (client) is configured how to guide the user in the deployment process. Here, "client" refers to what programs run on the computer 95, which receives the memory device 90. Well installed can the client program acts as a link between the user 96 and the memory device. This will be part of the memory encryption policy located in the user's profile database (as managed by the client), and can be applied to the user centrally.

The client deployment configuration may include one or more of the following (in the following USB the memory device is used for memory device): ~ Secure USB sticks manually - Ask to secure USB sticks once for each device - Ask to secure USB sticks each time an insecure device is connected.

- Automatically secure all non-priority memory connected.

According to one embodiment, the USB memory can be configured for manual commissioning, and the user must secure the USB memory manually. A second option is the settings, where the user can select "secure USB memory immediately".

The method can allow several options to secure USB sticks. If configured to be prompted to secure a USB memory device once for each device, the client will prompt the user if he wants to secure a USB memory device as soon as he connects a memory device in 10 15 20 25 30 his computer. It will only be done once for each device, as the client will hold find out which USB memory devices are connected.

If configured to be prompted each time an insecure USB memory device is connected the client to prompt the user to secure the device every time he plugs it into his computer. This only happens if the USB memory does not have a secure area.

Preferably, the process of securing a USB memory is a guided process, if so user-friendly as possible. This means that an application program helps the user to run the commissioning procedure step by step.

Fig. 1 illustrates a policy-based commissioning procedure. The procedure consists of three levels: first operational layer 10, second policy and regulations 11 and third component logic 12. I the operating warehouse 10, an administrator 101 administers the security policy and security deployment policy of the second level. Security and policy deployment are transferred to level 3 with, for example, a corporate server 121 (or a server designed for such functions). The enterprise server 121 communicates with a client 122 (operating system based) driver or driver application) intended to receive the memory device 123. When the memory device 123 is connected, the security policy is transferred to it. The security policy is also provided users 102.

Fig. 6 illustrates an exemplary embodiment of the method for the invention. When a memory device is connected 601 to a computer, a program (such as the Single Encryption Platform (SEP) such as developed by Cryptzone) is installed on the computer to check 602 if the memory device is secured, i.e. encrypted, if the memory device is not secured it will ask 603 if the user wants secure it. If the memory is already secured, the driver of the memory device may try to find out 604 if the computer is connected to a network, it can contact a server that contains information about the secure memory. The server can be the company's server or a security provider's server which contains information about the secure memory. Results according to the communication with the server may result in various actions which will be described in more detail below.

The above steps can be arranged depending on the application.

If the user's memory device is not protected and the user does not want to secure the memory device procedure 605 is terminated. But if the user wants to secure the memory device, ask application program 606 for a key or password that has been used to secure the memory. But if the memory is secured the driver already installed on the memory will ask 10 15 20 25 30 the key or password. In one embodiment, the user or an administrator may have given or put up a pro fi l (set of rules) to manage the memory device. Based on these rules may various protection methods 607 are applied for memory management. These are described below. If any a connection to the server can include information such as logs, audit history, permissions, etc. transmitted 608 to the server.

Depending on the proe, received information from the server and the key or password memory device handled 609, ie encrypted, decrypted, access denied or content deleted.

When securing data on memory device, various protection methods can be used as mentioned earlier. During The activation phase inherits the memory device settings for the user in terms of security attributes, such as protection methods. These settings are embedded in the profile database 9022 (Fig. 9). Other attributes that can take effect are: logging options session timeout options and different memory behaviors. These can be part of the security policy, and can be applied for the user centrally.

During the activation phase, the memory 902 prepared by the activating component (as may be the client 122 on the user's desktop or the driver 901 at a later stage) establish the encryption policy enable the user.

When accessing secured content9023 within the memory device, the user may need to enter one password manually every time he she wants to access the information. The reason for this is that the memory device logic does not need to hold any logic server connection or any connection to the user's pro fi l database on the client program 122 on the computer.

Technically, when data is secured, it is encrypted, e.g. with AES256 with strongly randomized 256 bit key or any other suitable encrypting algorithm. In this case, the key is placed in a so called "key | holder slots", i.e. in a secure data header. Each key slot is then encrypted with the AES256 or any other suitable algorithm encrypts with the key related to a special protection method. The key is a hashad version of the actual password, to prevent brute-force procedures. Se fi gur. 2.

A time-lock function may also be available for the memory device used for locking the device after a predetermined period.

The protection methods previously mentioned may be applied one by one or in combinations and described in the following: 10 15 20 25 In the custom method, the user enters a password.

In the private password method, a password is the user (owner) of the memory device that is up when the USB memory is encrypted for the first time.

In the master password method, the password acts as a second password, and can be given when by one administrator of, for example, a company or of the user. The master password can overshadow other passwords and managed by an administrator. The master password may be applied to each user.

In secure group method, a secure group password is provided by an administrator and assigned to members of a group to provide access to the USB memory or parts of memory according to the device by these members.

In company passwords are randomly generated by the client or driver 901 when used.

The password is provided to the server, along with meta-information describing which ones users who should have access to the key and what role they should have when the key is used to come protected material. Possible roles can be: - No access: No access is allowed, - Read: Only reading the contents of the memory state, - Contribute: Read and write rights, - Manger: read and write and authority to change "state", - Admin: administrator rights.

In one embodiment, when a secured USB memory is configured to use the company password protection method, and a user tries to access the memory, the driver tries logic on the memory device find the server. If the server is located, the user can be automatically verified, for example with help the operating system (such as Windows, Linux, Mac OS, etc.) built-in authentication mechanisms to provide references manually, e.g. with a login dialog.

Once verified, the driver will make requests to the server for the key used to secure it the area. This means that the server acts as a port to access information about it secure the area. The server evaluates the meta-data in relation to important to re-evaluate it authenticated user should have access to it, or not. If access is granted, the key is shared out and the user can access the encrypted memory device. 10 15 20 25 10 The password recovery method is generated by the client when applied to the secured memory 902.

The key generation is based on a seed given to each user by the server on the server initiation. Each user in the company usually has a unique seed for this purpose. This means indirectly that each user's recovery password will be created differently for each user. The key generation logic also uses a random factor as in turn ensures that all keys on a user are unique per secured memory 902 (or parts of the). Reset password works as follows, see picture. 3: 1. An fi l or a USB memory is secured. An lD will be assigned key opening that has the key used to secure this device. This ID is called the key identifier (in fi guren marked as Content ID). 2. Company (centrally administered) user ID is considered a user, e.g. "stored in user profile database 30. Business is a general term that includes components such as the server, an administration tool and the client. 3. The user's recovery password (for example, hosting a Business Server 32) is considered as seed restoration 31. 4. The key to be used to encrypt the file or USB memory device will be a hash, for example, using the key identifier, user identification and seed recovery combined. 5. If the password is lost: 6. Optionally, all users will receive information on how to contact a support in case of lost password, when trying to access the file. The user follows the instructions and contact support. 7. Support by using an Admin tool goes through a "lost password & recovery password "routine. 8. Once authenticated the user enters a "reset ticket", which is it user identification combination with key, e.g. "is delimited by a character (eg" - ").

The user will be able to see this information among information on what to do 10 15 20 25 11 if the password is lost. For example, the reset ticket may be "3243-AA443210" - there 3243 is the user identification and AA443210 is the key identifier. 9. Support indicates the recovery ticket in the admin tool guide, and the user as the owner of the password reset used for encryption is displayed. 10. The support authenticates (orally or in writing) the calling user, and if they are happy with authentication he or she clicks next. 11. Reset passwords used for the specific content will be displayed on support desktop screen, while communicating to the user.

According to a preferred design, there can be three components to a recovery password: User ID: (eg 32 bits) ID of the user on the enterprise server Key identifier: (eg 32 bits) ID of the key slot that has the key to unlock secured file / folder / USB memory Reset Seed: (eg 128 bits (variable)) The actual seed that will be generated and stored by the server. Recovery ticket: A strict value that is a compound strict consequence of user identification and key identifier (for example "00078-FEAB0002").

The final recovery key is generated as follows: SHA1 (user identifier | | key identifier | | reset seed), which will result in, for example, 160 bits of data. The reset ticket will be coded in such a way that it is user-friendly readable and easily communicated in written or oral form. Se fi gur. 4.

When the server processes the recovery ticket, it will retrieve the ID of the user (User ID) and key identifier. Using the user ID, the server will retrieve the recovery seed used. The server will then process the user ID, central identifier and the recovery of the seed in the same way as mentioned above with e.g. SHA1, att recover the recovery password.

According to one embodiment of the invention, it is possible to verify the user against the server for to access a key to access the device, which opens Single Sign-On (SSO) values. 10 15 20 25 12 Any action performed with the secured area of the USB memory device can be logged in securely area, see picture. 5. This includes, deleting files, insecure files, secure files, changing passwords, etc.

Logging procedure that can also include a review content, logs all transactions, ie copy, delete, add, make changes, etc. on the memory device device user computer and / or the server. All transactions are provided with a serial number or ID. The logs are usually but not exclusively transmitted and stored on the server whenever possible using the driver of the memory device.

The logs are available for reading if you have access to the secure area or the server (after sync processing). This is done by opening the secured area in the browser mode, go to main menu and select, ie. view log browser.

This makes it possible to determine, for example, whether a specific file (such as data) was on a memory at a certain time.

The present invention can perform encryption on all data loaded on the USB device.

The goal of this is to create a way so that data can not be stored as plain text on a USB device which has a safe area. This feature can be policy controlled through settings: - Allow the user to store insecure data on the USB memory - Automatic identification if non-priority data exists outside the secure area, and ask the user to secure it.

- Do not allow the user to store unsecured data on the USB memory One aspect of the invention may involve a policy that may be decided centrally. A policy contains settings. A policy can contain one or more settings. One or your policies can be applied to a user or a group of users. Merge rules are used for to define the final settings to be applied to a user. This adds a big flexibility for the product and allows administrators to configure policy settings on the way they want. Thus, this is an advantage that policy management can centrally have a common policy applied to a single user or group, or fl your users and / or groups and more 10 15 20 25 30 13 policy areas apply to an individual user or group, or several users and / or groups.

Furthermore, a policy can consist of a single system settings, as well as many. In addition, an attitude of not being unique between policy, conflicting rules. In an implementation The administrator may have the option to select a "list" of policies for users and rank each policy area in the list. The higher rank a policy has means that it will override the lower rank policy. This is only the case if the two strategies have settings that clash with each other.

Example: Policy A has certain settings that are denoted for e-mail safe and secure. Policy B has some settings such as e-mail secure, password and admin lock. The user applies both policy A and policy B, with policy A as the higher rank. The user will receive the email settings from policy one because it has a higher rank than policy B. But he will get passwords and Admin lock settings from policy B because these settings have not been defined in threaded in policy A.

Fig. 7 illustrates the encryption procedure for USB memory 70 according to the invention. USB memory consists of a driver application for security 71 (901 in fi g. 9) and a database found in flash memory slot 72. The client application 76 on the receiving device, e.g. a computer 75 activated. When the driver application 71 is accessed, it will be the user with one password. The end user processing commands on the computer 75 with the interface set provided by the driver application 71 will then be able to secure and insecure data to and from USB memory. The secured data is stored on the USB memory driver slot 72.

In one embodiment, the invention causes a user or administrator to remotely block access to USB or delete data on a secure USB memory.

When a lock is issued on a secure USB, USB will be blocked from further access locking is removed. When an erasure is issued on a secure USB, all the data on the device arrives together with the secured USB executable is wiped off and the data can be recovered.

Fig. 8 shows the schematic of this embodiment. When a user connects another 80 USB memory a computer 85 to access data on USB, driver application (as above) on the USB memory is 10 15 20 25 14 configured to contact a security server 82, e.g. Enterprise server (as above), through a communication network 83, Internet or intranet. l a life cycle parameter of the device one System Administrator may initiate lock or uninstall options. These are stored in a database 84 communicate with the server. When USB memory contacts the server, it receives the command and the driver application executes the command, i.e. decrypts data, locks (deny access to data) or delete data. With this feature can take control of USB, which may have gone lost when a lock or delete command is given to the device, the command may be in one standby mode until the command has been notified to the device. Then the administrator can see that the command has been delivered to the device.

According to one embodiment, USB sticks that have not been synchronized with the server secured for a certain number of days can be made inaccessible to the user.

For example, some companies may require their users to sync their secure USB devices. memory devices regularly. This allows companies to claim their employees to sync the content logs of its USB sticks with the server.

This is possible through an attitude to the policy editor to enforce this behavior.

A secured USB memory has not synchronized with the server successfully for a certain period will not be available until successful synchronization occurs.

This is achieved in the same way as it gives up examples. A parameter for power synchronization can be set when the USB memory is secured. The driver application controls this parameter each time it secured USB memory is accessed.

When the secured USB memory device has not been synchronized for a certain period of time, access to the USB memory device is blocked.

In one embodiment, the driver program on the receiving computer can upgrade the driver on the memory device. When a secure memory device is inserted into the computer where driver122 is installed, the driver 122 evaluates the contents of the memory device to determine if the driver on the memory can upgraded to a newer version. This provides an opportunity to correct logical errors the memory device.

In yet another embodiment, an integrity check mechanism may be applied which is based on the revision and log mentioned earlier a stick can be found "damaged" and be repaired. 10 15 It should be noted that the word "comprising" does not exclude the existence of parts or steps other than those specified and the words "one" or "one" before an element do not exclude the presence of a diversity of such factors. It should also be noted that a reference sign does not restrict the requirements that the invention can be carried out at least in part with the help of both hardware and software, and that multiple "means", "devices" or "devices" may be represented by the same object of hardware.

The above mentioned and described designs are given by way of example only and should not be limited to this achievement. Other solutions, uses, goals and functions within the framework of the invention as claimed in the claims described below should be apparent to the one who is skilled in the arts.

Claims (15)

Patent claims A memory arrangement (70, 80, 90) consisting of a driver application for security (71, 901) and a storage part (72, 902), said driver application (71) being configured to, when accessed, authenticate a user by means of a authentication method and secure and / or insecure data in said memory arrangement, characterized in that said memory arrangement is configured to execute an application which is part of a memory encryption policy, which is applied by a central control unit and that driver application is further configured based on said authentication method deny access to said data or delete said data stored in said memory arrangement. The memory arrangement of claim 1, further comprising a memory access arrangement (75), comprising the end-user processing commands used to access said data. The memory arrangement of claim 1, wherein the memory arrangement is a USB (Universal Serial Bus) memory device, digital camera, digital video camera, Personal Digital Assistant (PDA) or a mobile telephone. The memory arrangement of claim 1, which is configured to connect to a host using one or more of a USB bus, FireWire (IEEE 1394), Human Interface Devices (HID), PCMCIA, Bluetooth or IR. The memory arrangement of claim 1, which uses a program on a host configured to guide the user and act as a link between the user and the memory arrangement. The memory arrangement of claim 1, wherein a user deployment configuration comprises one of: securing the memory arrangement manually, requesting to secure the memory arrangement management once for each device, requesting to secure the memory arrangement each time an insecure device is used. The memory arrangement of claim 1, wherein the memory arrangement is further configured to block said data about a synchronization process in the absence of a synchronization method within a specified period of time. A method for policy-based secure deployment of a memory arrangement according to any one of claims 1-7, using a first operation level (10), a second policy level (11) and a third component logic level (12), wherein an administrator means (101) administers said deployment policy in the second level, whereby secure deployment is transferred to the third level, where a server (121) communicates with a client (122) intended to be connected to said memory arrangement (123), and when said memory arrangement is connected, the security policy is transmitted to that, wherein upon receiving a command from the server of the memory arrangement component logic level, the memory is arranged to allow or deny access to or delete data in the memory arrangement. The method of claim 8, wherein when the data is secured, it is encrypted using the appropriate encryption method. The method of claim 8, further comprising a time lock function for locking the arrangement after a predetermined time period. The method of claim 8, comprising a recovery method operating as a secondary private password. The method of claim 11, wherein said reset password operates: - assigning an identity to a key location having a key used to secure the arrangement - storing a centrally managed user ID in a user profile database (30), - using the user's reset password as recovery seed (31), - provide a key to encrypt said arrangement as a hash, - If the password is lost: o authenticate the user and receive recovery data, o use said recovery data and the user who is the owner of the recovery data used in encryption, o authenticate the user and o use recovery passwords to secure a specific content. The method of claim 12, wherein said hash consists of a combination of key identifier, user identifier and recovery seed. The method of claim 13, wherein said reset data is user identifier combined with key identifier. The method of claim 14, wherein a final reset key is generated using: the user identifier, the key identifier and the reset seed.