METHOD, APPARATUS AND SYSTEM FOR AUTHENTICATION OF EXTERNAL STORAGE DEVICES

• US 20100017546A1
• Filed: 10/04/2006
• Published: 01/21/2010
• Est. Priority Date: 10/04/2006
• Status: Active Grant

• Current Assignee: Trek 2000 International Limited (Trek Technology Singapore PTE Limited)
• Original Assignee: Trek 2000 International Limited (Trek Technology Singapore PTE Limited)
• Inventors: Tan, Henry, Poo, Teng Pin
• Granted Patent: US 8,412,865 B2
• Time in Patent Office: Days
• US Class Current: 710/32
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2209/043 of tables, e.g. lookup, substitution or mapping
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for authentication of an external storage device (16) operatively connected to a port of a host computer (10) where the host computer (10) conducts a handshake with the external storage device (16) seeking an authentication key from the external storage device. The host computer (10) electrically disconnects the external storage device (16) from the host computer (10) if the authentication key is incorrect or not provided within a predetermined period. The host computer (10) allows access to the host computer (10) by the external storage device (16) if the authentication key is correct and provided within the predetermined period. Corresponding apparatus and systems are also disclosed.

Claims

1. A method to authenticate an external USB storage device connected to a port of a host computer, the method comprising:

the host computer conducting an authentication handshake with the external USB storage device and during the authentication handshake the host computer seeks an authentication key from the external USB storage device;

electrically disconnecting the external USB storage device from the host computer if the authentication key is at least one selected from the group consisting of;

incorrect, and not provided within a predetermined period;

allowing access to the host computer by the external storage device if the authentication key is correct and provided within the predetermined period; and

allocating the authentication key to the external USB storage device that does not have the authentication key by querying if the authentication key is required and, upon a positive response within the predetermined period, checking the external USB storage device and, if the external USB storage device is clear, allocating the authentication key to the external USB storage device.

2. A method as claimed in claim 1, wherein correct authentication keys are maintained in a lookup table.

3. A method as claimed in claim 2, wherein the correct authentication keys are maintained in one of:

the host computer, and a server of a network to which the host computer is connected.

4. A method as claimed in claim 2, wherein the authentication key is restricted by at least one selected from the group consisting of:

a particular user, a particular host computer, a particular terminal of a network to which the host computer is connected.

5. A method as claimed in claim 4, wherein the particular user is determined by user login code, the particular host computer is determined by host computer identity, and the particular terminal of the network is determined by network terminal identity.

6. A method as claimed in claim 5, wherein the user login code, the host computer identity, and the network terminal identity are stored in the lookup table.

7. A method as claimed in claim 2, wherein access to the host computer is restricted to certain applications or certain data of the host computer, the restrictions being maintained in the lookup table.

8. A method as claimed in claim 3, wherein access to the network is restricted to certain applications or certain data, the restrictions being maintained in the lookup table.

10. A method as claimed in claim 1, wherein the checking of the external USB storage device includes at least one selected from the group consisting of:

external USB storage device identity, user identity, host computer identity, network terminal identity, and scans for viruses or other malignant applications or data.

11. A method as claimed in claim 1, wherein an authentication module is downloaded to the external USB storage device before the authentication key is sent to the external USB storage device.

12. A method as claimed in claim 1 further comprising electrically disconnecting the external USB storage device from the host computer if the response is negative or if the response is not provided within the predetermined period.

13. A method as claimed in claim 1, wherein allocation of the authentication key is by an administrator.

9. (canceled)

14. An external USB storage device able to be operatively connected to a port of a host computer by use of a connector of the external USB storage device, the external USB storage device comprising an authentication module configured to communicate with an authentication application of the host computer;

the authentication module being configured to comprise an authentication key for sending to the authentication application for authentication of the external USB storage device, wherein at least one of the authentication module and the authentication key is able to be downloaded from the authentication application.

16. An external storage device as claimed in claim 14, wherein the authentication key is restricted by at least one selected from the group consisting of:

a particular user, a particular host computer, and a particular terminal of a network to which the host computer is connected.

17. An external storage device as claimed in claim 16, wherein the particular user is determined by user login code, the particular host computer is determined by host computer identity, and the particular terminal of the network is determined by network terminal identity.

15. (canceled)

18. A system to authenticate an external USB storage device connected to a port of a host computer by use of a connector of the external storage device, the external USB storage device comprising an authentication module to communicate with an authentication application of the host computer;

the authentication module comprising an authentication key for sending to the authentication application for authentication of the external USB storage device, wherein access to the host computer by the external USB storage device is allowed if the authentication key is correct and provided within the predetermined period, and allocating the authentication key to the external USB storage device that does not have the authentication key by querying if the authentication key is required and, upon a positive response within the predetermined period, checking the external USB storage device and, if the external USB storage device is clear, allocating the authentication key to the external USB storage device.

19. A system as claimed in claim 18, wherein the host computer conducts an authentication handshake with the external USB storage device seeking the authentication key from the external storage device.

20. A system as claimed in claim 18, wherein correct authentication keys are maintained in a lookup table maintained in one of:

the host computer, and a server of a network to which the host computer is connected.

21. A system as claimed in claim 20, wherein the authentication key is restricted by at least one selected from the group consisting of:

a particular user, a particular host computer, a particular terminal of a network to which the host computer is connected.

22. A system as claimed in claim 21, wherein the particular user is determined by user login code, the particular host computer is determined by host computer identity, and particular terminal of the network is determined by network terminal identity.

23. A system as claimed in claim 22, wherein the user login code, the host computer identity, and the network terminal identity are stored in the lookup table.

24. A system as claimed in claim 20, wherein access to the host computer is restricted to certain applications or certain data of the host computer, the restrictions being maintained in the lookup table.

25. A system as claimed in claim 20, wherein access to the network is restricted to certain applications or certain data, the restrictions being maintained in the lookup table.

26. A system as claimed in claim 20, where the authentication key is allocated by an administrator.