JP6938602B2 - Data security system with encryption - Google Patents

Description

The present invention relates generally to electronic devices, and more specifically to memory devices.

Security is an important issue in almost every aspect of computer use. Storage media, such as hard disk drives, that are connected to your computer contain valuable information that poses a risk of data theft. A great deal of money and effort has been put into protecting personal, corporate and government security information.

Portable memory storage devices are becoming smaller, easier to lose, more ubiquitous, cheaper, and have more memory capacity, making security issues more prominent. Universal serial bus Portable such as flash drive and microdrive, mobile phone, video camera, digital camera, iPOD, MP3 / 4 player, smartphone, palm computer, laptop computer, game device, authenticator, token (including memory) A large amount of information can be secretly downloaded to a memory storage device, generally a large capacity storage device (MSD).

Specifically, there are various MSDs for backup, transfer, intermediate storage, and main memory that allow you to easily download and take away information from your computer. The main purpose of any MSD is to store and retrieve "portable content", that is, data and information associated with a particular owner rather than a particular computer.

The most common storage security provider is to authenticate a user with a password entered into a computer. The password is validated against the MSD stored value and if it matches, the drive will be opened. Alternatively, the password itself is used as an encryption key for encrypting / decrypting the data stored in the MSD.

For drives that support on-the-fly encryption, the encryption key may be stored on a storage medium in encrypted form. The encryption key is stored on the storage medium so that anyone who wants to bypass the standard interface and read the storage medium directly can use it immediately. Therefore, the password is used as the key to encrypt the encryption key.

In the case of self-authenticated drives, those authentication subsystems are responsible for maintaining security and do not depend on the host computer to which they are connected. Therefore, the host cannot (and does not need to) send a password to unlock the MSD. In fact, it is no longer necessary to store cryptographic keys on storage media, and authentication subsystems have become a means of managing cryptographic keys.

Therefore, security improvements are still needed. Given rising consumer expectations and diminishing opportunities for significant product differentiation in the market, as well as increasing commercial competitive pressure, it is important to find solutions to these problems. In addition, the need to reduce costs, improve efficiency and performance, and respond to competitive pressures further increases the urgency to find solutions to these problems.

Solutions to these problems have long been sought, but previous developments have neither taught nor suggested any solutions, and therefore solutions to these problems have long been unseen by those skilled in the art.

The present invention provides a method of operating a data security system, the method of providing a data security system application for connecting to a data security system to a mobile device and invoking the data security system application. It includes a process and a process of maintaining a connection between the data security system and the mobile device.

The present invention comprises a data security transceiver or receiver, an authentication subsystem operably connected to the data security transmitter / receiver or receiver, and a storage subsystem connected to the authentication subsystem. I will provide a.

Certain embodiments of the invention have other aspects in addition to or in place of the above aspects. Those aspects will become apparent to those skilled in the art by reading the detailed description below with reference to the accompanying drawings.

The schematic diagram of the data security system according to one Embodiment of this invention. The figure which shows the authentication key delivery method used by using a data security system. The figure which shows another system for a user to interact with a data security system. A diagram showing how a user interacts with a data security system using a host computer system. The figure which shows the data security method using the user verification for a data security system. The figure which shows an exemplary data security communication system. An administrator sequence diagram showing a sequence of operations between a mobile device and a data security system. Unlock sequence diagram when the mobile device is an authentication factor. An unlock sequence diagram showing an unlock using a PIN entry from a mobile device. An unlock sequence diagram showing unlocks using PIN entry and user ID / location / time validation via server / console. A reset sequence diagram showing a reset of a data security system that uses a server / console. An unlock sequence diagram showing the unlocking of a data security system that uses a server / console. User password change sequence diagram using the server / console.

The following embodiments are described in sufficient detail so that those skilled in the art can practice and use the present invention. It is to be understood that other embodiments under this disclosure are obvious and that system, process, or mechanical modifications can be made without departing from the scope of the invention.

In the following, many specific details will be described so that the present invention can be fully understood. However, it will be clear that the present invention can be practiced without these particular details. Some well-known circuits, system configurations, and processing steps are not disclosed in detail to avoid obscuring the present invention.

Similarly, the drawings showing embodiments of the system are semi-schematics, not at a constant scale, but are shown in size, especially for the purpose of clarifying the drawings, and are exaggerated in the drawings. When multiple embodiments having some features in common are disclosed and described, similar or similar features are usually referred to as similar or identical references in order to clarify their illustration, description, and understanding. Describe with a number. Similarly, the viewpoints of the drawings are generally shown in similar orientations for ease of explanation, but this illustration is largely arbitrary. In general, the invention can be practiced in any orientation.

As used herein, the term "system" refers to the methods and devices of the invention, depending on the context in which the term is used, and is defined as the methods and devices of the present invention. As used herein, the term "method" refers to the operating process of an apparatus and is defined as that operating process.

For convenience, but not limited to, the term "data" is defined as information that can be generated or stored by a computer. The term "data security system" is defined to mean any portable memory device that incorporates a storage medium. As used herein, the term "storage medium" refers to and is defined as solid state, NAND flash, and / or magnetic data recording systems. The term "locked" refers to a data security system in which the storage medium is inaccessible, and the term "unlocked" refers to a data security system in which the storage medium is accessible.

There are generally two ways to make a storage device tamper resistant, the first is to apply epoxy to the components, and the epoxy resin applied to the printed circuit board destroys the storage medium. It can be difficult to disassemble the storage device without doing so. The second is a method of encrypting memory data. The data is encrypted when it is written to a storage medium, and an encryption key is required to decrypt the data.

Referring to FIG. 1, a schematic diagram of a data security system 100 according to an embodiment of the present invention is shown. The data security system 100 includes an external communication channel 102, an authentication subsystem 104, and a storage subsystem 106.

The storage subsystem 106 is an electronic circuit including an interface controller 108, an encryption engine 110, and a storage medium 112. The storage medium 112 includes internal or external hard disk drives, USB flash drives, solid state drives, hybrid drives, memory cards, tape cartridges, and optical discs (eg, Blu-ray discs, digital versatile discs or DVDs, and compact discs or CDs). ) Can be any optical medium. The storage medium 112 can include a data protection device, an archive storage system, and a cloud data storage system. A cloud storage system is another system that is coupled to the host computer via a wired or RF or optical wireless network using a plug-in application or extension software installed in the browser application. Or you can access the worldwide web.

The interface controller 108 includes electronic components such as a microcontroller with a software or hardware encryption engine 110, which may be in a separate controller within the storage subsystem 106.

The authentication subsystem 104 is an electronic circuit that includes an authentication controller 114, such as a microcontroller, which may itself have non-volatile memory such as an electrically erasable programmable read-only memory (EEPROM).

The external communication channel 102 provides a means of exchanging data with the host computer system 120. The universal serial bus (USB) is one of the most common means of connecting a data security system 100 to a host computer system 120. Other examples of external communication channels 102 include Firewire, Wireless USB, Serial ATA (SATA), High Detail Multimedia Interface (HDMI®), RS-232 (Recommended Standard232), and wireless frequency wireless networks. Is done.

The interface controller 108 can convert the USB packet data into data that can be written to the storage medium 112 in the USB flash drive.
The encryption engine 110 is implemented as part of the interface controller 108 and receives clear text and / or data (information) from the host computer system 120 and puts it in an encrypted form written on the MSD or storage medium 112. Convert. The encryption engine 110 converts the encrypted information from the storage medium 112 and decrypts it into clear information for the host computer system 120. The encryption engine 110 includes an encryption controller having an encryption function for encrypting / decrypting data on the fly while managing communication protocols, memory, and other operating conditions, and a communication, encryption key management, and encryption controller. It may be two controller subsystems having a communication / security controller for handling the communication of.

The encryption engine 110 requires an encryption key 116 to encrypt / decrypt information. The encryption key 116 is used in an algorithm that encrypts / decrypts data with an encryption algorithm (eg, 256-bit Advanced Encryption Standard (AES) encryption) to make the data unreadable or readable. .. The encryption key 116 can be stored either inside or outside the authentication controller 114.

When the user 122 with the identification number or key is confirmed against the authentication key 118, the encryption key 116 is transmitted by the authentication subsystem 104 to the encryption engine 110.
It has been found that the portable memory storage devices of various embodiments of the present invention can provide an extremely high level of security that was not previously available in such devices by using the authentication key 118 and the encryption key 116. ..

When the data security system 100 is locked, the authentication key 118 remains inside the authentication subsystem 104 and cannot be read from the outside. One way to hide the authentication key 118 is to store the authentication key 118 in the authentication controller 114 in the authentication subsystem 104. By setting the safety fuse of the authentication control unit 114, it is impossible to access the authentication key 118 unless the user 122 is confirmed and the authentication control unit 114 permits the retrieval. Many microcontrollers are equipped with a safety fuse that blows and makes internal memory inaccessible. This is a well-known and widely used security feature. Such a microcontroller can be used for the authentication controller 114. The authentication controller 114 can be a microcontroller or a microprocessor.

The authentication key 118 can be used in several functions, 1 ... can be used as an encryption key 116 for directly encrypting / decrypting information, and 2 ... a data security system that can be accessed by the interface controller 108. It can be used as a key to recover the encryption key 116 stored in 100, and 3 ... can be used for direct comparison by the interface controller 108 to activate the external communication channel 102.

With reference to FIG. 2, an authentication key distribution method used by using the data security system 100 is shown. In this figure, the authentication key 118 and the encryption key 116 are the same. The encryption engine 110 uses the authentication key 118 as the encryption key 116.

The user 122 must interact with the authentication subsystem 104 by providing the user identification information 202 (number or key) to the authentication subsystem 104. The authentication subsystem 104 authenticates the user 122 against the authentication key 118. Next, the authentication subsystem 104 transmits the authentication key 118 as the encryption key 116 to the interface controller 108.

The encryption engine 110 in the interface controller 108 uses the authentication key 118 to convert the clear information into the encrypted information and the encrypted information into the clear information along the channel 206. Attempts to read the encrypted information from the storage medium 112 without the encryption key 116 will only result in information that cannot be used by any computer.

With reference to FIG. 3, another system for the user 122 to interact with the data security system 300 is illustrated. This dialogue can be performed by a communication combination 301 that can be by physical contact, a wired connection, or a wireless connection from a mobile phone, smartphone, smartwatch, wearable device, or other wireless device.

In one authentication system, the mobile transmitter / receiver 302 is used to transmit the user identification information 304 to the data security transmitter / receiver 306 in the authentication subsystem 310. For illustrative purposes, multiple transmitters and receivers are used for the flexibility of two-way communication, but a combination of transmitters and receivers for unidirectional communication can also be used. The authentication subsystem 310 includes an authentication controller 114 connected to an interface controller 108 in the storage subsystem 106. The user identification information 304 is supplied from the outside of the storage subsystem 106 of the data security system 300 to the data security transceiver 306 in the authentication subsystem 310 by the mobile transceiver 302. Wireless communication includes WiFi, Bluetooth (BT (registered trademark)), Bluetooth smart, short-range communication (NFC), global positioning system (GPS), optical, cellular communication (eg LTE-A), code division. Includes multiple access (CDMA), wideband code division multiple access (WCDMA (registered trademark)), universal mobile communication system (UMTS), wireless broadband (WiBr), or global system for mobile communication (GSM (registered trademark)). be able to.

The authentication subsystem 310 authenticates the user 122 against the authentication key 118 by verifying the code transmitted from the mobile transmitter / receiver 302 against the authentication key 118. Next, the authentication subsystem 310 transmits the encryption key 116 to the interface controller 108 via the communication combination 301.

The encryption engine 110 then uses the encryption key 116 to convert the clear information into encrypted information and the encrypted information into clear information along channel 206. Attempting to read the encrypted information from the storage medium 112 without the encryption key 116 would only yield unusable information by the host computer system 120.

In an optional second authentication mechanism, the authentication subsystem 310 causes the user 122 to use the biometric sensor 320 to provide a biometric input 322 to verify that the user's identity is an authenticated user. By doing so, the user 122 is authenticated against the authentication key 118. Types of biometrics include fingerprints, iris scans, and voiceprints.

In the third optional authentication mechanism, the authentication subsystem 310 causes the user 122 to use the electromechanical input mechanism 330 to provide a unique code 332 to confirm that the user's identity is the authenticated user. By supplying the user 122, the user 122 is authenticated against the authentication key 118. The unique code 332 can include a numeric, alphanumeric or alphabetic code such as a PIN. The electromechanical input mechanism 330 is within the authentication subsystem 310. The electromechanical input mechanism 330 receives the unique code 332 from the user 122 from the outside of the data security system 300. The unique code 332 is supplied to the electromechanical input mechanism 330 in the authentication subsystem 310 from outside the storage subsystem 106 of the data security system 300.

Whichever method is used to match the user 122, the authentication key 118 and the encryption key 116 remain hidden until the user 122 is authenticated.
Referring to FIG. 4, a method is shown in which the user 122 uses the host computer system 120 to interact with the data security system 400.

The host computer system 120 includes a host application 402. The host application 402 is software or firmware that communicates via the external communication channel 102 of the data security system 400.

The host application 402 is created by the serial number of an internal component (eg, hard drive), the media access control (MAC) address of the network card, the user's login name, the network Internet Protocol (IP) address, and stored on the host. It delivers the host identifier 406 associated with the environment, such as the ID, the ID created by the data security system and stored on the network. Host identifier 406 is used by the authentication subsystem 408 within the data security system 400.

When the authentication subsystem 408 authenticates the user 122 against the authentication key 118 by verifying the host identifier 406, the data security system 400 is unlocked.

For example, user 122 connects the locked data security system 400 to the host computer system 120. The host application 402 transmits the MAC address of the network card to the data security system 400. The data security system 400 recognizes that this MAC address is valid and unlocks it without having the user 122 in FIG. 1 input the user identification information. This is an implementation example that does not require dialogue with the user 122. In this case, it is the host computer system 120 and its associated environment that are verified.

The data security system 400 provides the authentication key 118 stored in the authentication subsystem 104, verifies the host computer system 120 by the authentication subsystem 104, and transfers the encryption key 116 to the storage subsystem 106 by the authentication subsystem 104. It includes presenting and allowing the storage subsystem 106 to access the storage medium 112 by decoding the contents of the storage medium.

The data security system further includes an authentication subsystem 104 for interpreting the biometric input and validating the user 122.
The data security system further includes using the authentication key 118 directly as the encryption key 116.

The data security system further includes using the authentication key 118 to decrypt and retrieve the encryption key 116 used to decrypt the internal content.
The data security system further includes an authentication subsystem 104 for interpreting the signal input and verifying the transmitting unit.

The data security system further includes an authentication subsystem 104 for interpreting manually entered inputs and validating the user 122.
The data security system further includes an authentication subsystem 104 for interpreting the input sent by the host resident software application for verification of the host computer system 120.

The data security system is an encryption engine 110 outside the interface controller 108, and is an encryption connected to the external communication channel 102 for the purpose of converting clear data into encrypted data for unlocking the data security system 100. Further includes the encryption engine 110.

With reference to FIG. 5, a data security method 500 using user verification against the data security system 100 is shown. The data security method 500 is between a step of verifying the user against the authentication key in block 502, a step of using the authentication key to retrieve the encryption key in block 504, and between the host computer system and the storage medium in block 506. Includes the use of cryptographic keys to enable unencrypted communication over the storage subsystem of.

With reference to FIG. 6, an exemplary data security communication system 600 is shown. An exemplary data security communication system 600 includes a mobile device 610, a data security system (DSS) 620, a host computer 630, and a server / console 640. The mobile device 610 and server / console 640 are connected by a wired connection or by a wireless connection via a cloud 650, which can be an internet cloud. The mobile device 610 and the data security system 620 are connected by a communication combination 301.

The communication combination 301 in the exemplary data security communication system 600 includes a mobile transmitter / receiver 612 in a mobile device 610 having an antenna 614 that wirelessly communicates with an antenna 622 of the data security transmitter / receiver 624 in the data security system 620.

In one embodiment, the mobile device 610 may be a smartphone. In the mobile device 610, the mobile transmitter / receiver 612 may be connected to a conventional mobile device component and may be connected to a data security system SS) application 618 that provides information to be used with the data security system 620.

The data security transmitter / receiver 624 is connected to a security controller 626, which includes identification information, passwords, profiles, etc. that can access the data security system 620, including those of different mobile devices. Information can be retained. The security controller 626 is connected to an authentication subsystem 310, a storage subsystem 106 (in some embodiments, it may have a cipher for encrypting data), and a subsystem similar to the external communication channel 102. NS.

The external communication channel 102 is connectable to the host computer 630 and allows access to data in the storage subsystem 106 under specified circumstances.
In one implementation example of the data security system 620, the biometric sensor 320 and the electromechanical input mechanism 330 of FIG. 3 may be omitted, and only a wireless link to a mobile device 610 such as a smartphone may be provided. It has been found that this implementation example can make the data security system 620 more secure and useful.

The data security system application 618 allows the mobile device 610 to discover all data security systems near the mobile device 610 and indicate their status (lock / unlock / blank, paired / unpaired, etc.). do.

The data security system application 618 allows the mobile device 610 to connect / pair, lock, unlock, change names and passwords, and reset all data on the data security system 620.

The data security system application 618 allows the mobile device 610 to set an inactive auto-lock mode in which the data security system 620 automatically locks after a predetermined length of inactivity, or is mobile over a predetermined period of time. Allows the mobile device 610 to set the proximity auto-lock mode so that the data security system 620 is locked (to improve reliability and avoid signal debounce) when the device 610 is not within a predetermined proximity range. To.

The data security system application 618 allows the mobile device 610 to store passwords and use Touch ID and Apple Watch (both Touch ID and Apple Watch are mentioned only as examples, but have biometric sensors and wearables. By being used in a similar mode in which many other mobile devices exist), the data security system 620 can be unlocked without having to re-enter the password on the mobile device.

The data security system application 618 can configure the mobile device 610 to operate only when there is a particular mobile device, such as the mobile device 610, so that the data security system 620 cannot be unlocked by other mobile devices ( 1Phone).

The data security system application 618 allows the mobile device 610 to set the data security system 620 to read-only mode.
The data security system application 618 allows the mobile device 610 to operate in user mode or administrator mode (administrator mode ignores user settings) and to use the server / console 640. The server / console 640 is a combination of a computer and a console for entering information into the computer.

The server / console 640 includes a user management database 642, which includes additional information that may be transmitted to the mobile device 610 via the cloud 650 to provide additional functionality to the mobile device 610.

The user management database 642 allows the server / console 640 to create and identify users using user IDs (usernames and passwords), prohibit / allow unlocking of the data security system 620, and provide remote help. To enable.

The user management database 642 allows the server / console 640 to remotely reset or unlock the data security system 620.
The user management database 642 allows the server / console 640 to remotely modify the data security system user PIN.

The user-managed database 642 allows the server / console 640 to restrict / allow the data security system 620 to be unlocked from a particular location (by using geo-fencing).

The user management database 642 allows the server / console 640 to limit / allow unlocking of the data security system 620 for a specified time period and different time zones.

The user management database 642 allows the server / console 640 to limit the unlocking of the data security system 620 outside of a defined team / organization / network or the like.

Referring to FIG. 7, an administrator sequence diagram showing an operation sequence between the mobile device 610 and the data security system 620 is shown.
First, the connection state 700 between the data security system 620 and the mobile device 610 is established by mutual discovery between the device and the system, pairing between the device and the system, and connection between the device and the system. This connection state 700 is protected by the use of the shared secret, which is used to protect (encrypt) the communication between the data security system 620 and the mobile device 610 during subsequent communication sessions. Will be done. A standard encryption algorithm that is efficient to run on the data security system 620 and is approved by global security standards is selected.

As long as the data security system 620 and the mobile device 610 are within a predetermined distance from each other, the connection state 700 is maintained by the data security system application 618 and / or by the security controller 628 in cooperation with each other. When separated from the predetermined distance, the data security system 620 is locked after the connection state 700 is maintained for a predetermined time period.

After the connection between the mobile device 610 and the data security system 620, the data security system administrator application start operation 702 is performed on the mobile device 610. Next, in the administrator password operation 704, the administrator sets a password. After the connection between the mobile device 610 and the data security system 620, in the data security system connection, power supply, and discovery enablement operation 706, the data security system 620 is powered by the host computer 630 in the data security system 620 and can be discovered. It is connected to the host computer 630 of FIG.

After the administrator password operation 704, the mobile device 610 sends an administrator password setting and unlock signal 708 to the data security system 620. The administrator password setting and unlock signal 708 causes the administrator password setting and data security system unlock operation 716 in the data security system 620.

When the administrator password setting and the data security system unlock operation 716 are completed, the data security system unlock confirmation signal 712 is transmitted to the mobile device 610, and the confirmation of the data security system unlock as the administrator operation 714 in the mobile device 610. Is executed. Upon confirmation of data security system unlock as administrator action 714, other limit setting actions 716 performed using the mobile device 610 are allowed. When there is another restriction setting operation 716, the administrator restriction setting signal 718 is transmitted to the data security system 620, the administrator restriction is set in the data security system 620, and the restriction setting confirmation signal 720 returns to the mobile device 610. Will be done. After that, the mobile device 610 and the data security system 620 are in a fully operational communication state.

Since it is possible to communicate with the data security system 620 without having physical contact with the data security system 620, important interactions with the data security system 620 are printed on the data security system 620 itself or are printed on the data security system. It is required to be accompanied by a data security system unique identifier that comes with the 620 package and is readily available to the owner of the data security system 620.

This unique identifier (unique ID) is required when requesting an operation that affects user data, such as unlocking or resetting the data security system 620. Attempts to perform these actions without the correct identifier are ignored and rendered harmless. With this unique identifier, the user has physical control on the data security system 620, and the connection state 700 between the authenticated and previously paired device such as the mobile device 610 and the data security system 620 and the system is established. It is a method for verifying that the mobile device 610 is used to identify the data security system 620. When paired with devices, shared secrets are used to keep communications confidential.

Pairing involves establishing and maintaining a unique and defined relationship between a mobile device and a data security system at some point in the past.
The unique identifier gives the user some control over the data security system when the user has physical control over the data security system.

In order to enhance the security of communication with the data security system 620 when the mobile device 610 is a smartphone, the user can choose to enable a function such as a function called "1phone" in the present embodiment. This feature limits important user dialogue with the data security system 620 to only the mobile device 610. This is done by replacing the data security system unique identifier described above with a random identifier that is securely shared between the data security system 620 and the mobile device 610. Therefore, for example, when the user unlocks the data security system 620, he / she must present the 1Pone identifier instead of presenting the data security system unique identifier. In practice, this makes the user's mobile device 610 a second authentication factor for using the data security system 620 in addition to the PIN or password. As an example, the paired user phones selected as "1 Phone" can be used without a PIN and can be used as a single user authentication factor and / or in combination with other user authentication factors. If this feature (1phone) is selected, the data security system 620 cannot be opened on other phones unless administrator unlock has been enabled in advance.

It will be appreciated that in other embodiments, an administrator password may be required on the data security system 620 in order to use the 1Phone function. In another embodiment, the server / console 640 may be able to recover the data security system 620 if the 1Pone data of the mobile device 610 is lost.

The user can enable the proximity auto-lock function of the data security system 620. During the communication session, the data security transmitter / receiver 624 of FIG. 6 reports the signal strength measurement of the mobile device 610 to the data security system 620. The data security system application 618 on the mobile device 610 transmits both the source signal output level and the proximity threshold to the data security system 620.

Since the signal strength varies depending on the environmental conditions around the transmitter / receiver, the data security system 620 mathematically smoothes the signal strength measurement to reduce the possibility of false positives. When the data security system 620 detects that the received signal strength has fallen below a predetermined threshold over a predetermined period of time, it immediately locks the data security system 620 to prevent access to the storage subsystem 106 of FIG.

The data security system 620 can be used in three different modes. That is, a user mode in which the user can determine the function of the data security system 620, an administrator can set an administrator password, and the data security system 620 has some restrictions that cannot be removed by the user (for example, after a predetermined period of inactivity). Administrator mode with automatic lock, read-only, 1phone), and server / console 640 remotely resets data security system 620, changes user passwords, unlocks data security system 620 It is a server mode that sets the administrator role for such things.

With reference to FIG. 8, an unlock sequence diagram is shown when the mobile device 610 is an authentication factor. This figure shows the automatic unlocking process of the data security system 620 initiated by the data security system application 618 from the mobile device 610, which is a particular mobile device. The user can only use a single mobile device previously paired with the data security system 620. If the paired mobile device 610 is lost, the data security system 620 will not be able to be unlocked (unless an administrator password has been previously set as shown in FIG. 7).

Similar to FIG. 7, but the data security system application start operation 800 is performed after the connection state 700 is established. After the data security system connection, power supply, and discovery enablement operation 706, the mobile device 610 transmits an unlock request signal 802 with the mobile device ID to the data security system 620. The data security system unlock operation 804 is performed, and the data security system unlock confirmation signal 712 is transmitted from the data security system 620. After the data security system unlock confirmation operation 806, the mobile device 610 and the data security system 620 are in a fully operational communication state.

If a PIN (Personal Identification Number) is not set, the paired mobile device is used as the 1-authentication factor.
Referring to FIG. 9, an unlock sequence diagram showing an unlock operation using a PIN entry from the mobile device 610 is shown. This figure shows the process of unlocking the data security system 620 by entering a PIN into the data security system application 618 in the mobile device 610. The data security system 620 cannot be unlocked without entering the correct PIN.

Similar to FIGS. 7 and 8, but after the data security system application start operation 800, the user name / password input operation 900 is performed. After the user name / password input operation 900, the mobile device 610 transmits the user ID verification signal 902 to the server / console 640. Next, the server / console 640 performs the user name / password appropriateness determination 904.

When the user name / password suitability determination 904 verifies the user, a proper user signal 906 is transmitted to the mobile device 610, causing the user to input the correct PIN in the PIN input operation 908 of the mobile device 610. The mobile device 610 then transmits an unlock verification signal 910 to determine if the correct PIN has been entered into the server / console 640.

The server / console 640 performs a user authentication determination 912 to determine whether the user is authorized to use a particular PIN-authorized data security system (eg, data security system 620). If authenticated, an unlock permission signal 914 is transmitted to the mobile device 610, which passes the unlock request signal 916 to the data security system 620.

The data security system unlock operation 804 is executed, the data security system unlock confirmation signal 712 is transmitted to the mobile device 610, and the data security system unlock operation confirmation 806 is executed.

Referring to FIG. 10, an unlock sequence diagram showing an unlock operation using PIN entry and user ID / position / time verification via server / console 640 is shown. This figure is by entering a PIN from the mobile device 610 into the data security system application 618 and verifying it on the server / console 640 server using the user ID (username / password), and in a specific location and time range. Shows the most secure process of unlocking the data security system 620 by verifying the geofence permission to unlock the data security system 620 in. The data security system 620 unlocks unless the PIN, username and password are entered and the mobile device 610 is present at a specific (predetermined) location at a specific (predetermined) time. You won't be able to.

Similar to FIGS. 7-9, but in order to allow the server / console 640 to set the conditions necessary for the designated data security system, such as the data security system 620, to operate. The lock operation 1000 is performed. For example, the condition may be within a particular geographic area and / or within a particular time frame.

In the mobile device 610, the current state is determined, such as the position and / or the current time acquisition operation 1002. This operation is performed to determine where the mobile device 610 is located and / or the current time at the location where the mobile device 610 is located. Other current states around the mobile device 610 are determined and may be transmitted to the server / console 640 by the unlock verification signal 1004, at which the server / console 640 makes a condition conformance determination 1006.

When the desired conditions are met, an unlock permission signal 1008 is transmitted to the mobile device 610 to perform the PIN input operation 908. After the PIN is input, the unlock verification signal 1010 is transmitted along with the PIN and the identification information of the data security system 620 that is operably close to the mobile device 610. When the verification unlock signal 1010 is received by the server / console 640, a data security system permission determination 1012 is performed to determine that the authentication user is allowed to unlock the designated data security system. The server / console 640 confirms that this "specific" user is authorized to use the designated data security system.

After determining that the correct information has been provided, the server / console 640 provides the mobile device 610 with an unlock permission signal 914, which provides the mobile device 610 with an unlock request signal 916. The unlock request signal 916 operates the data security system 620.

Referring to FIG. 11, a reset sequence diagram showing an operation of resetting the data security system 620 using the server / console 640 is shown. This figure shows the ability to remotely reset the data security system 620 via a server / console 640. The data security system 620 may only receive commands from the mobile device 610 over a wireless connection. However, by setting the server / console 640 with a "reset" flag for a particular data security system (using a serial number), the data security system application 618 running on the mobile device 610 will have the server / console 640. Will query any flag / pending request in the user management database 642. When the user connects to the data security system 620, the data security system application 618 on the mobile device 610 will execute a "reset" wait command. After a successful reset (after all user data and credentials have been lost), the server / console 640 removes the reset flag so that the reset will occur the next time the mobile device 610 is connected to a particular data security system. Not executed.

Similar to FIGS. 7 to 10, the mobile device 610 sends an arbitrary command waiting signal 1100 to the server / console 640 in response to the appropriate user signal 906 to perform the reset command determination 1102. When the reset command is present, the reset execution signal 1104 is transmitted to the mobile device 610.

The mobile device 610 transmits a security system reset signal 1106 to the data security system 620 to start the data security system reset operation 1108. When the data security system reset operation 1108 is completed, the data security system 620 is set to transmit the data security system reset confirmation signal 1110 to the mobile device 610 to perform the data security system reset confirmation operation 1112. After that, the mobile device 610 and the data security system 620 are in a fully operational communication state with the reset data security system 620.

Referring to FIG. 12, an unlock sequence diagram showing an operation of unlocking the data security system 620 using the server / console 640 is shown. This figure shows the ability to remotely unlock the data security system 620 via a server / console 640. The data security system 620 may only receive commands from the mobile device 610 over a wireless connection. However, by setting the "Administrator Unlock" flag on the server / console 640 console for a particular data security system (using a serial number), the data security system application 618 running on the mobile device 610 The server / console 640 will be queried for any flag / pending request. When the user connects to the data security system 620, the data security system application 618 on the mobile device 610 executes an "administrator unlock" wait command. After a successful administrator unlock, the user data remains, but the user password is deleted (the data security system 620 cannot be unlocked by the user). The server / console 640 removes the reset flag for the data security system 620 so that the reset will not be performed the next time the mobile device 610 is connected to the data security system 620.

Similar to FIGS. 7-11, but the server / console 640 executes unlock 1200 if there is a command to unlock with an administrator password after receiving an arbitrary command wait signal 1100. When the unlock signal 1202 with the administrator password is transmitted to the mobile device 610, the mobile device 610 provides the unlock signal 1204 with the administrator password to the data security system 620 to start the data security system unlock operation 804. .. After that, the mobile device 610 and the data security system 620 are in a fully operational communication state.

Referring to FIG. 13, a user password change sequence diagram using the server / console 640 is shown. This figure shows a function that can remotely change the user password of the data security system 620 via the server / console 640. The data security system 620 can only receive commands from the mobile device 610 over a wireless connection, but set the "change user password" flag for a particular data security system (using a serial number) on the server / console 640 console. The data security system application 618 running on the mobile device 610 will query the server / console 640 for any flag / pending request. When the user connects to his data security system 620, the data security system application 618 on the mobile device 610 executes a "change user password" wait command. After the unlock is successful and the password is changed, the user data remains, but the data security system 620 can be unlocked with the new user password. The server / console 640 removes the "change user password" flag for this data security system 620 so that the user password change will not be performed the next time the mobile device 610 is connected to a particular data security system.

Similar to FIGS. 7-12, the server / console 640 responds to an arbitrary command waiting signal 1100 by performing a password change determination 1300. When the password is changed on the server / console 640, the user password change signal 1302 is transmitted to the mobile device 610, and the mobile device 610 transmits the user password change signal 1304 to the data security system 620. After that, the mobile device 610 and the data security system 620 are in a fully operational communication state with the new password.

The operation method of the data security system includes a step of providing a data security system application for connecting to the data security system to the mobile device, a step of invoking the data security system application, and the data security system and the mobile device. It is provided with a step of maintaining the connection state of.

In the above method, the step of maintaining the connected state maintains the connected state when the data security system is within a predetermined proximity range from the mobile device.
In the method described above, the step of maintaining the connected state maintains the connected state when the data security system is within a predetermined proximity range from the mobile device for a predetermined period of time.

In the above method, establishing the connection state includes using bidirectional communication between the data security system and the mobile device.
In the above method, establishing the connection state includes using unidirectional communication between the data security system and the mobile device.

The method further comprises communication between the mobile device having the data security system application and a server including a user management database.
The above method further comprises a step of providing security information to the security controller of the data security system.

The above method includes a step of providing the identification information of the designated data security system to the server, a step of providing the specific identification information to the data security system, and the identification information of the designated data security system is the said of the data security system. It further includes a step of unlocking the data security system when it is the same as the specific identification information.

In the above method, the step of providing the data security system application to the mobile device provides the data security system administrator application, further sets an administrator password to the mobile device, and sets the administrator password to the mobile device. It includes transmitting from the mobile device to the data security system, setting the administrator password in the data security system, and unlocking the data security system.

The method comprises a step of providing an unlock request from the mobile device to the data security system together with mobile device identification information, and a step of receiving the unlock request in the data security system and unlocking the data security system. Further prepare.

The above method includes a step of inputting a user name or password into the mobile device, a step of determining when the user name or password is valid in the server after receiving the user name or password from the mobile device, and a step of determining when the user name or password is valid in the server. When the user name or password is valid, the step of communicating from the server to the mobile device, and when the user name or password is effective for unlocking the data security system, the mobile device is said to be said. It also has a process of communicating with the data security system.

The above-mentioned method includes a step of inputting a user name or password into the mobile device and a step of determining when the user name or password is valid on the server after receiving the user name or password from the mobile device. , A step of communicating from the server to the mobile device when the user name or password is valid, and a step of determining when the identification number is valid in the server after receiving the identification number from the mobile device. Further, the server further includes a step of unlocking the data security system via the mobile device when the server determines that the identification number is valid.

The above method includes a step of providing an effective position of the mobile device to a server, a step of determining when the mobile device is in the effective position by the server, and a step of determining when the mobile device is in the effective position of the server. Further includes a step of unlocking the data security system via the mobile device when the determination is made.

The method described above includes a step of providing the server with a current time of operation of the mobile device for the data security system, a step of determining when the mobile device is within the current time, and a step of determining when the mobile device is within the current time. Further provided is a step of unlocking the data security system via the mobile device when the server determines that the server has the current time.

The above method includes a step of providing a command to the server, a step of providing the command from the server to the mobile device in response to a command standby signal from the mobile device, and a step of providing the command from the server. Further includes a step of executing the command in the data security system via the mobile device.

The above method includes a step of providing a password change command to the server, a step of providing the password change command from the server to the mobile device in response to a password change signal from the mobile device, and a step of providing the password change command in the data security system. A step of unlocking the data security system with the password after the change of the above is further provided.

The above method further comprises connecting the data security system to a host computer for power and making it discoverable by the host computer.
The data security system includes a data security transceiver or receiver, an authentication subsystem operably connected to the data security transmitter / receiver or receiver, and a storage subsystem connected to the authentication subsystem.

The system further comprises a data security transmitter / receiver or receiver and a security controller connected to the authentication subsystem.
The system further comprises a mobile device having a data security system application that works with the security controller to maintain a connection state when the data security system is within a predetermined proximity range from the mobile device.

The system further comprises the mobile device having a data security system application that works with the security controller to maintain a connection state when the data security system is within a predetermined proximity range from the mobile device for a predetermined period of time. Be prepared.

The system further comprises said mobile device having a mobile transmitter / receiver or receiver for maintaining a connection state including using bidirectional communication between the data security system and the mobile device.

The system further comprises said mobile device having a mobile transmitter / receiver or receiver for maintaining a connection state including using unidirectional communication between the data security system and the mobile device.

The above system further comprises wired or wireless connection communication between the mobile device and the mobile device having the data security system application and the server including the user management database, and the server including the user management database.

In the above system, the data security system includes an external communication channel for connecting to a host computer.
Although the present invention has been described in the context of the particular best mode, it should be understood that many alternatives, modifications, and variations will be apparent to those skilled in the art in the light of the above description. Therefore, it is intended to include all such alternatives, modifications and variants that fall within the appended claims. All matters described herein or shown in the accompanying drawings should be construed in an exemplary and non-limiting sense.

Claims (40)

A method for data storage devices
The method comprising: providing an interface controller to the data-storage device, the interface controller is connected to a communication channel, wherein the data storage device, the authentication subsystem having a memory, the authentication information and encryption key, encryption Provided , including a cryptographic engine, a radio transmitter / receiver for radio frequency communication outside the communication channel.
When the communication channel via the interface controller is locked, the authentication subsystem receives a user authentication input via the wireless transmitter / receiver.
The authentication subsystem unlocks the communication channel of the data storage device based on the received user authentication input and the authentication information of the authentication subsystem.
When the communication channel is unlocked
Prior to storing the encrypted data in the memory, the encryption engine encrypts the data received via the communication channel with the encryption key.
A method comprising: that the encryption engine decrypts the data read from the memory with an encryption key before transmitting the decrypted data via the communication channel. Further prepared to transmit the encryption key from the authentication subsystem to the encryption engine based on the unlocking.
The method according to claim 1, wherein the encryption key is not stored in the memory of the data storage device, and the encryption key cannot be accessed from the outside of the data storage device. Receiving the user authentication input
Communicating with mobile device applications via the wireless transmitter / receiver,
The method of claim 1, further comprising receiving the user authentication input from the mobile device. Receiving the user authentication input
Communicating with an application on a mobile device via the wireless transmitter / receiver, the application includes a user interface for entering the user authentication input by the user, the user authentication input being validated by a remote server. And the remote server sends a confirmation to the application, said communication,
The method of claim 1, wherein the data storage device receives a user authentication input from the mobile device via the wireless transmitter / receiver after the user has been validated by the remote server. After the application of the mobile device receives a command for changing the authentication information from the remote server, the authentication subsystem receives a command for changing the authentication information from the application of the mobile device. The method according to claim 4, further comprising. The mobile device application
The mobile device locks the communication channel of the data storage device, unlocks the communication channel of the data storage device, changes the user name, changes the authentication information, and resets the data storage device. The method of claim 4, which enables. The mobile device application
The method of claim 4, wherein the remote server allows the data storage device to be reset and unlocked. The mobile device application
4. The fourth aspect of the invention, which allows the remote server to use geofencing to limit the use of the data storage device to a particular location by determining the presence of the mobile device within the geofence. Method. The mobile device application
The method of claim 4, wherein the remote server allows the use of the data storage device to be restricted to a particular time zone and period. The method of claim 1, wherein the communication channel is a computer bus interface. The method according to claim 1, wherein the radio frequency communication is one of wireless fidelity (WiFi), Bluetooth (BT), Bluetooth smart (BLE), near field communication (NFC), or cellular communication. .. It is a data storage device
With memory
An interface controller for communication via the communications channel to be locked until the user is authenticated,
A wireless transmitter / receiver for radio frequency communication outside the communication channel, which is configured to receive a user authentication input, and the wireless transmitter / receiver.
An authentication subsystem having an authentication information and an authentication key, which unlocks the communication channel of the data storage device based on the received user authentication input and the authentication information.
The data received via the communication channel is encrypted with the encryption key before the encrypted data is stored in the memory, and the data read from the memory before the encrypted data is transmitted through the communication channel is described as described above. A data storage device equipped with an encryption engine that decrypts with an encryption key. The authentication subsystem sends the encryption key to the encryption engine based on the unlock, the encryption key is not stored in the memory of the data storage device, and the encryption key is the data storage. The data storage device according to claim 12, which is not accessible from the outside of the device. Receiving the user authentication input
Communicating with mobile device applications via the wireless transmitter / receiver,
The data storage device according to claim 12, further comprising receiving a user authentication input from the mobile device via the wireless transmitter / receiver. Receiving the user authentication input
Communicating with an application on a mobile device via a wireless transmitter / receiver, said application comprising a user interface for entering the user authentication input by the user, the user authentication input being validated by a remote server. , The remote server sends confirmation to the application, said communication,
The data storage device according to claim 12, wherein the data storage device receives a user authentication input from the mobile device after the user has been verified by the remote server. The authentication subsystem
A claim configured such that the application of the mobile device receives a command to change the authentication information from the remote server and then receives a command to change the authentication information from the application of the mobile device. The data storage device according to 15. A non-transitory machine-readable storage medium containing multiple instructions,
When executed by the data storage device, the plurality of instructions causes the data storage device to perform a plurality of operations, and the plurality of operations are performed .
The method comprising: providing an interface controller to the data-storage device, the interface controller is connected to a communication channel, wherein the data storage device, the authentication subsystem having a memory, the authentication information and encryption key, encryption Provided , including a cryptographic engine, a radio transmitter / receiver for radio frequency communication outside the communication channel.
When the communication channel via the interface controller is locked, the authentication subsystem receives a user authentication input via the wireless transmitter / receiver.
The authentication subsystem unlocks the communication channel of the data storage device based on the received user authentication input and the authentication information of the authentication subsystem.
When the communication channel is unlocked
Prior to storing the encrypted data in the memory, the encryption engine encrypts the data received via the communication channel with the encryption key.
A non-transitory machine-readable storage medium comprising: that the encryption engine decrypts the data read from the memory with an encryption key before transmitting the decrypted data over the communication channel. .. The data storage device is
Based on the unlocking, the authentication subsystem further performs a plurality of operations comprising transmitting the encryption key to the encryption engine.
The non-temporary machine-readable storage medium according to claim 17, wherein the encryption key is not stored in the memory of the data storage device, and the encryption key cannot be accessed from the outside of the data storage device. Receiving the user authentication input
Communicating with mobile device applications via the wireless transmitter / receiver,
The non-transitory machine-readable storage medium of claim 17, further comprising receiving a user authentication input from the mobile device via the wireless transmitter / receiver. Receiving the user authentication input
Communicating with an application on a mobile device via a wireless transmitter / receiver, said application comprising a user interface for entering the user authentication input by the user, the user authentication input being validated by a remote server. , The remote server sends confirmation to the application, said communication,
The non-transitory machine-readable storage medium of claim 17, wherein the data storage device receives the user authentication input from the mobile device after the user has been verified by the remote server. It ’s a system,
With one or more computer processors
With a data channel connected to the one or more computer processors
A self-encrypting device connected to the data channel,
The self-encrypting device
An authentication subsystem that includes an authentication processor and
With the encryption engine
A storage medium for storing encrypted data encrypted with an encryption key provided by the authentication subsystem.
Radio frequency (RF) transmitter / receiver for communication outside the data channel,
Including the data interface of the interface controller connected to the data channel.
A system in which the data interface is locked from sending and receiving data until the self-encrypting device is unlocked by the authentication subsystem using user authentication information received via the radio frequency transmitter / receiver. 21. The system of claim 21, wherein the self-encrypting device authenticates a user without using one or more computer processors in the system. The radio frequency transmitter / receiver is configured to receive the user authentication information from the mobile device, the mobile device is separated from the one or more computer processors, and the self-encrypting device is from the mobile device. 21. The system of claim 21, configured to unlock the data interface in response to receiving the user authentication information. The radio frequency transmitter / receiver is configured to use independent encryption in radio frequency communication with the mobile device, the independent encryption being the encryption provided by the communication protocol for the radio frequency communication. 23. The system according to claim 23, which is distinguished. 23. The system of claim 23, wherein the application of the mobile device provides a user interface for acquiring the user authentication information from the user. The application of the mobile device authenticates the user by verifying the user on the management server, and the mobile device issues an unlock command to the self-encrypting device in response to the management server verifying the user. 23. The system of claim 23 for transmission. Before SL authentication subsystem stores the encryption key, the authentication subsystem, the user is successfully authenticated, transmitting the encryption key to the encryption engine of claim 21 system. The self-encrypting device initializes a timer when the system shutdown is detected, and the self-encrypting device initializes in an unlocked state if the system is restarted before the timer expires. The system according to claim 21, wherein the self-encrypting device is initialized in a locked state when the system is restarted after the timer expires. 21. The system of claim 21, wherein the data is transmitted in clear form between the data interface and the data channel. The systems include laptops, personal computers, kitchen utensils, printers, scanners, servers, tablet devices, medical devices, door unlocking systems, secure access systems, access control devices, home automation devices, household items, mobile phones, vehicles. , Or one of the smart televisions, the system of claim 21. 21. The system of claim 21, wherein the self-encrypting device further includes a power source for powering the authentication subsystem when the self-encrypting device is locked. A method for self-encrypting devices ,
The self-encrypting device sets up a communication channel between the data interface of the self-encrypting device and the host computer system , wherein the host computer system has one or more processors, said. The communication channel is locked until the self-encrypting device is authenticated.
Before SL radio frequency (RF) transceiver self-encrypting device, comprising: receiving user authentication information, the radio frequency transceiver is for communication outside the communication channel, said receiving it,
The authentication subsystem of the self-encrypting device unlocks the communication channel based on the user authentication information.
Wherein the self-encrypting device, the received data through the communication channel, encrypted with the encryption key provided by the authentication subsystem of the self-encrypting device,
How comprising the, said self-encrypting device stores the encrypted data in the storage subsystem of the self-encrypting device. 32. The method of claim 32, wherein the self-encrypting device authenticates a user without using one or more processors in the host computer system. Wherein the user authentication information, via said radio frequency transceiver is a mobile device or et received,
32. The method of claim 32 , wherein unlocking the self-encrypting device is performed in response to receiving the user authentication information via the radio frequency transmitter / receiver. The mobile device application authenticates the user by verifying the user on the management server .
34. The method of claim 34 , wherein receiving the user authentication information includes receiving an unlock command from the mobile device in response to the management server verifying the user. The self-encrypting device initializes a timer when the shutdown of the host computer system is detected, and the self-encrypting device unlocks if the host computer system is restarted before the expiration of the timer. 32. The method of claim 32, wherein the self-encrypting device is initialized in a state and is initialized in a locked state when the host computer system is restarted after the timer expires. When executed by a self-encrypting device, it is a non-temporary machine-readable storage medium containing a plurality of instructions for causing the self-encrypting device to perform a plurality of operations.
The self-encrypting device sets up a communication channel between the data interface of the self-encrypting device and the host computer system , wherein the host computer system has one or more processors, said. The communication channel is locked until the self-encrypting device is authenticated.
Before SL radio frequency (RF) transceiver self-encrypting device, comprising: receiving user authentication information, the radio frequency transceiver is for communication outside the communication channel, said receiving it,
The authentication subsystem of the self-encrypting device unlocks the communication channel based on the user authentication information.
Wherein the self-encrypting device, the received data through the communication channel, encrypted with the encryption key provided by the authentication subsystem of the self-encrypting device,
A non-transitory machine-readable storage medium comprising the self-encrypting device storing encrypted data in a storage subsystem of the self-encrypting device. The non-transitory machine-readable storage medium of claim 37, wherein the self-encrypting device authenticates a user without using one or more processors of the host computer system. The self-encrypting device
Receiving the user authentication information from the mobile device via the radio frequency transmitter / receiver,
38. The non-temporary aspect of claim 37, further performing a plurality of operations comprising unlocking the self-encrypting device in response to receiving the user authentication information via the radio frequency transmitter / receiver. Machine-readable storage medium. The mobile device application authenticates the user by verifying the user on the management server.
The self-encrypting device
39. The non-transitory machine-readable storage medium of claim 39, further performing a plurality of operations comprising receiving an unlock command from the mobile device in response to the management server verifying the user.

Images