WO2010037409A1

WO2010037409A1 - Storage system and method for securely accessing data

Info

Publication number: WO2010037409A1
Application number: PCT/EP2008/008380
Authority: WO
Inventors: Bernd Lamparter; Pierre Imai
Original assignee: NEC Europe Ltd
Current assignee: NEC Europe Ltd
Priority date: 2008-10-02
Filing date: 2008-10-02
Publication date: 2010-04-08
Anticipated expiration: 2011-04-02

Abstract

A Storage system for securely accessing data by an untrusted device is disclosed, the storage system being characterized in that the storage system comprises a protected storage area which can only be accessed by a trusted device, an open storage area which can be accessed by a trusted and an untrusted device, a data control unit arranged at the protected device, wherein said data control unit supports synchronization of the data stored in said protected storage area with the data stored in said open storage area, and supports checking for malicious data or undesirably changed data stored in said open storage area at said synchronization. Furthermore, a method for securely accessing data is disclosed.

Description

STORAGE SYSTEM AND METHOD FOR SECURELY ACCESSING DATA

The present invention relates to a storage system and a method for securely accessing data by an untrusted device.

Many people are using not only personal devices like a computer at home or in the office but sometimes also shared computers, e.g. in an internet cafe or an computer of a friend or co-worker. Since these computers are not under the direct control of the user, malicious software might be present, which might include viruses, worms, spyware, and the like. At using shared computers, there is very often the need of loading data from or storing data to external storage media, like USB memory sticks or Memory Cards. When using these external storage media, the shared computer might store malicious data onto the storage device or might manipulate existing data. This might lead to a loss of data or might endanger the security of the personal device of the user, if the external storage media contains malicious data and is connected to the personal device.

There are some measures available to solve this problem. One possibility is to set a write protection on the external storage media. Each computer can read the data from the storage media, but writing to the storage media is prohibited. This prevents the data contained on the external storage media from being manipulated. But as soon as the user wants to store data on the external storage media, the write lock has to be removed and data can be manipulated again.

Another possibility which is known in the art includes the usage of security software which checks for malicious software, when external storage media are attached to a computer. These methods are problematic to that effect that they are not able to protect from unauthorized changes of data contained on the external storage media.

Yet another option includes encryption of the data stored on the storage media. For accessing the data, it has to be decrypted where a correct key has to be present. But this method also cannot prevent storing malicious data or changing existing data. As soon as the access to the storage media is permitted, each data might be stored, including malicious data.

It is therefore an object of the present invention to improve and further develop a storage system and a method of the initially described type in such a way that data can be accessed securely by both trusted devices and untrusted devices, while security is available on a high level.

In accordance with the invention the aforementioned object is accomplished by a storage system comprising the features of claim 1. According to this claim such a storage system is characterized in that the storage system comprises a protected storage area which can only be accessed by a trusted device, an open storage area which can be accessed by a trusted and an untrusted device, a data control unit arranged at a protected device, wherein said data control unit supports synchronization of the data stored in said protected storage area with the data stored in said open storage area, and supports checking for malicious data or undesirably changed data stored in said open storage area at said synchronization.

Furthermore, the aforementioned object is accomplished by a method comprising the features of claim 6. According to this claim such a method is characterized by the step of storing data in a protected storage area by means of a trusted device, wherein the protected storage area can not be accessed by an untrusted device, the step of making data, that is stored in said protected storage area and that should be accessed by an untrusted device, available in an open storage area by means of a trusted device, the step of reading and/or modifying data stored in said open storage area or storing data in said open storage area by means of an untrusted device, the step of synchronizing the data stored in said open storage area with the data stored in said protected storage area by means of a trusted device, and the step of checking the data stored in said open storage area before writing the data to said protected storage area by means of a trusted device.

According to the invention it has first been recognized that secure access to data stored at a storage system by an untrusted device can be achieved using simple means. This is accomplished by using a protected storage area and an open storage area. The protected storage area can only be accessed by trusted device, while the open storage area can be accessed by both, trusted and untrusted devices. Thus the protected storage area contains only data which for sure is written by a trusted device, as an untrusted device is not able to access the protected storage area. The untrusted device can use the open storage area for storing data. In this manner, each untrusted device can read data from and write data to the open storage area without any restriction, wherein the protected storage area is not accessible for an untrusted device.

Beside the protected storage area and the open storage area, the storage system comprises a data control unit which support synchronization of the data stored in said protected storage area with the data stored in said open storage area. Thus, the contents of the protected storage area and of the open storage area can be synchronized. If data is changed in the open storage area by an untrusted device, the data can be written to the protected storage area, where the data can be regarded as secure. For ensuring the security of data contained in the protected storage area, the data control unit further supports checking of the data contained in the open storage area during said synchronization. This checking includes the checking for malicious data or undesirably changed data stored in said open storage area. The checking for malicious data might include the checking for viruses, Trojans, spyware or the like. Checking changes might be achieved by comparing the data stored in the protected storage area by the associated data contained in the open storage area.

The data control unit is arranged at a trusted device for further ensuring security of data contained in the protected storage area. In this manner, only trusted devices write to the protected storage area and each data originating from the open storage area is thoroughly checked before storing to the protected storage area. This leads to a high level of security of the data, even if a untrusted device is involved in a file transfer.

A trusted device can be each device which is capable of handling data. These devices include a personal computer, a mobile phone, a personal digital assistant (PDA), or similar devices. Generally, a trusted device can be each device which is on direct control of the user. This can be a home computer or an office computer of the user as well as his/her smart phone. An untrusted device can be a device, similar to a trusted device. The difference lies in the fact that an untrusted device is accessible to other potentially untrusted users. This can for instance be a PC in an internet cafe or an internet terminal in a hotel.

Access control to the protected storage area can be fulfilled in different ways. In a very simple embodiment the access control might be achieved physically by incorporating the protected storage area into a trusted device. The protected storage area can then be a part of the hard disc or a similar storage of the trusted device. In this case the open storage area is located in an external storage device which can be carried to different devices. This might include an USB memory stick, a Smartcard, a NFC (Near Field Communication) card, or the like.

A more flexible implementation includes a security controller which controls access to the protected storage area. Then access to the protected storage area needs not to be restricted locally. The security controller keeps track of the devices which want to access the data stored in the protected storage area and permits or denies access to the protected storage area. This generally includes authentication where a trusted device proves its right to access the protected area.

According to a particular preferred embodiment of the invention the storage system comprises a storage device. This storage device contains said protected storage area and said open storage area. Thus the usage of the protected storage area is not limited to a single trusted device but can be used at each trusted device. A home computer can be used as well as an office computer to serve as trusted device. The storage device is preferably configured as a USB memory stick or a NFC card, where "NFC card" is used as a generic term for any short range radio technology.

In this embodiment, the security controller is preferably part of said storage device. The security controller can then be configured in a technology which is known as Smartcards. There the protected storage area is not directly accessible. It can only be accessed through the security controller, wherein the security controller offers a protected communication channel to the device which wants to read data from or write data to the protected storage area. Advantageously, the data control unit is implemented as a program running at a trusted device. This program can control communication within the storage system. Each time the open storage area is connected to a trusted device, the data control unit can perform synchronization and checking of data.

The method according to the invention first comprises the step of storing data in a protected storage area. This storage area can only be accessed by a trusted device. Thus, the step of storing data in the protected storage area is performed by a trusted device. In the next step, the data that is available in the protected storage area and which should be accessed by an untrusted device is made available in the open storage area. Also this step is performed by means of a trusted device to ensure that the data contained in the protected storage area can be regarded as being secure. In the next step the data contained in the open storage area can be accessed freely, including reading, modifying and storing data. Also new data can be stored in the open storage area. This step can be performed by each device, trusted and untrusted. Thus the open storage area can be used which each device which is available.

Back at a trusted device the data stored in the open storage area is synchronized with data stored in the protected storage area. By this step the data contained in the open storage area is made available in the protected storage area. At the step of synchronization the data stored in the open storage area is checked. In this matter, malicious data and changed data can be determined and eliminated. The data contained in the protected storage area keeps trusted and secure.

For simplifying the step of checking, files stored in the open storage area might have a security flag. This security flag is set to "secure", when the file is written to the open storage area by a trusted device. As soon as the data is changed or new data is stored to the open storage area, the security flag can be set to "not secure". At checking the data in the open storage area, first the files with a security flag "not secure" can be chosen. Only these files have to be synchronized and checked with data contained in the protected storage area. Advantageously, the step of making data available in the open storage area comprises the step of copying data from the protected storage area to the open storage area. Alternatively or additionally a reference can be set to the open storage area. This reference points to data stored in the protected storage area. At accessing this data, an untrusted device accesses the reference to the data stored in the protected storage area, reads the data from the protected storage area using the reference, and works on the data retrieved in this manner. When storing changed data, the untrusted device writes the data in the open storage area. In this manner, the changes can be stored and the data in the protected storage area is not influenced. This usage of references saves memory, as only data which is changed has to be duplicated in the open storage area.

Before permitting access to the protected storage area, the trusted device is authenticated. For authentication, many methods are known in the art. This can be performed automatically by exchanging of authentication credentials between the trusted device and the storage system. It can also include the step of typing a password into the trusted device. Another possibility is to have a button at a storage device which is pressed whenever the storage device is connected to a trusted device.

Additionally, the data stored in the protected storage area can be encrypted. Theoretically, each encryption method known in the art can be used with the method according to the invention. This additionally offers a kind of access control to the protected storage area, as generally the key for decrypting the data is unknown to an untrusted device. Thus an untrusted device which manages to access the protected storage area cannot manipulate data contained in the protected storage area.

Advantageously, the step of checking the data contained in the open storage area comprises the step of comparing the data stored in said open storage area to the data stored in said protected storage area. This can be dependent on the type of data. Some examples shall make this clear, where they should not delimit the invention to these methods of comparing: If the data is in text format (e.g. ASCII), the data stored in the protected storage area and the data stored in the open storage area might be compared line by line. If the data is in XML of HTML format, the changed tags are extracted. If the data is a bookmark file, then new, changed, or deleted bookmarks can be determined.

Each difference found at the step of comparing data can be presented to the user. The user can decide if the changes are desired or undesired, and can accept the changes or discard them. Thus a high level or security can be fulfilled.

There are several ways how to design and further developed teaching of the present invention in an advantageous way. To this end it is to be referred to the patent claims subordinate to patent claims 1 and 6 and to the following description of an example embodiment of the invention. In connection with the explanation of the preferred example of an embodiment and of the invention, generally preferred embodiments and further developments of the teaching will be explained.

Concerning to the example embodiment, the storage system comprises a storage device in the form of an USB (Universal Serial Bus) memory stick. The USB stick includes a security controller which makes sure that only trusted devices can access the protected area. The trusted device can be a home PC (Personal Computer) or an office PC. The untrusted device can be any public PC, e.g. one in an Internet Cafe.

The user copies the data he wants to use on an untrusted device from the trusted device to the open storage area of the USB stick. This data is also copied to the protected storage area in order to have a reference available. Next the storage device is put into an untrusted device which can read/write the data in the open storage area but not to the protected storage area. The user can e.g. copy his bookmarks to the untrusted device, use it there and write it back with newly found bookmarks. In a similar way other data on the storage device can be used and changed. Some applications might have support for usage of external data like the bookmarks file or other configuration files and uses this instead of the normal one.

When the user goes back to one of his trusted devices and plugs the storage device, a dedicated application checks for changed or new data. As the unchanged data is still also in the protected area of the storage device, this works also in cases where different trusted devices are used. Depending on the type of data, this application can perform in different ways: If the data is in text format (e.g. ASCII), the old and new data is compared line by line and the user gets a list of the differences. He then can choose whether to incorporate the change or to ignore it. If the data is in XML or HTML format, the changed tags can be presented to the user instead of the changed lines. If the data is a bookmark file, then new, changed, or deleted bookmarks are presented to the user. Additionally the application can provide hints to the user whether the new bookmark might point to a malicious website. The user decides on each change, if he wants it applied.

In addition to the described data checking, anti virus software can be used to check any new or changed data.

At checking a bookmark file, some characteristics of malicious websites can be checked. Malicious websites like phishing websites often use IP numbers instead of domain names. An application could also compare the URLs with blacklists which stores known malicious websites. Hence the user can be warned to adopt such a bookmark.

To ensure that only trusted devices can access the protected area, the controller has to authenticate the trusted device. After initialization this can be performed automatically, i.e. authentication credentials are exchanged between the trusted device and the storage device without involvement of the user. For initialization of the trusted device, the user plugs the storage device, starts software from the open area, and enters an initialization code which is delivered with the storage device.

An alternative would be a small button on the storage device. The user has to press this button whenever the storage device is connected to a trusted device.

It is not necessary to physically copy all data to both areas. A data control unit can just copy the data into the protected storage area and put a reference into the open storage area. When an untrusted device reads the data, the data from the protected storage area is delivered. When the data is written back to the open storage area, the reference is deleted and the data is written into the open storage area. This saves time when writing the data from the trusted device and less memory is needed because usually not all data will be changed.

Instead of a USB stick a smartcard can be used. Smartcards have built-in security controllers, so the implementation of the security is easier. Smartcards use NFC (Near Field Communication) technology as physical interface to the device, where low frequency radio signals are used for communication and energizing the device. As NFC technology uses only very low transmission power, communication is only possible within very limited range (a few centimeters). Hence it is very difficult for an attacker to eavesdrop the communication even with an antenna in the same room.

The invention could be used by Internet Cafes. The card could be combined with the membership card which also configures the shared computer. The storage device could be an NFC based smartcard or a USB memory stick with security controller. In an Internet Cafe the NFC smartcard might be more appropriate because it could be easily used also as membership card, whereas in corporate environments special USB memory sticks with security controller might be the better approach.

Claims

Clai ms

1. Storage system for securely accessing data by an untrusted device, characterized in that the storage system comprises a protected storage area which can only be accessed by a trusted device, an open storage area which can be accessed by a trusted and an untrusted device, a data control unit arranged at the protected device, wherein said data control unit supports synchronization of the data stored in said protected storage area with the data stored in said open storage area, and supports checking for malicious data or undesirably changed data stored in said open storage area at said synchronization.

2. Storage system according to claim 1 , wherein said storage system comprises a security controller which permits or denies access to said protected storage area.

3. Storage system according to claim 1 or 2, wherein said storage system comprises a storage device, wherein said protected storage area and said open storage area are part of said storage device.

4. Storage system according to claim 2 and 3, wherein said security controller is part of said storage device.

5. Storage system according to any of claims 1 to 4, wherein said data control unit is implemented as a program running on a trusted device.

6. Method for securely accessing data by an untrusted device, particularly for usage in combination with a storage system according to any of claims 1 to 5, characterized by the steps of storing data in a protected storage area by means of a trusted device, wherein the protected storage area cannot be accessed by an untrusted device, making data, that is stored in said protected storage area and that should be accessed by an untrusted device, available in an open storage area by means of a trusted device, reading and/or modifying data stored in said open storage area or storing data in said open storage area by means of an untrusted device, synchronizing the data stored in said open storage area with the data stored in said protected storage area by means of a trusted device, and checking the data stored in said open storage area before writing the data to said protected storage area by means of a trusted device.

7. Method according to claim 6, wherein said step of making data available comprises the step of copying data from said protected storage area to said open storage area, or the step of putting a reference to data stored in said protected storage area in said open storage area.

8. Method according to claim 6 or 7, wherein a trusted device is authenticated before permitting access to said protected storage area.

9. Method according to any of claims 6 to 8, wherein the data stored in said protected storage area is encrypted.

10. Method according to any of claims 6 to 9, wherein data which is changed or newly stored in the open storage area by an untrusted device is marked as being not secure.

11. Method according to any of claims 6 to 10, wherein the step of checking the data comprises the step of comparing data stored in said open storage area to data stored in said protected storage area, and the step of identifying the differences between the data.

12. Method according to claim 11 , wherein the differences between the data are presented to a user.