METHOD AND SYSTEM FOR REMOTE ACCESS TO DATA STORED ON A HOST SYSTEM

• US 20130086695A1
• Filed: 09/26/2012
• Published: 04/04/2013
• Est. Priority Date: 09/26/2011
• Status: Abandoned Application

• Current Assignee: iTwin Pte Ltd. (CloudDesk Pte Ltd.)
• Original Assignee: iTwin Pte Ltd. (CloudDesk Pte Ltd.)
• Inventors: Lakshminarayanan, Anantharaman
• Application Number:
  US13/627,329
• Publication Number:
  US 20130086695A1
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect

Abstract

A method and system for remote access to data stored on a host system from a remote system via a data link, a method and system for storing validation password data on a pair of connected first and second modules, and a method and system for verifying the identity of a first module removed from a pair of initially connected and associated first and second modules.

Claims

1. A method for remote access to data stored on a host system from a remote system via a data link, the method comprising the steps of:

connecting a first module and a second module to the host system, the first module initially being connected to and associated with the second module;

storing validation password data for verifying the identity of the first module on the second module; and

upon connecting the removed first module to the remote system to establish a secure communication channel between said first and second modules across said data link to access said data, the host system having the second module connected thereto, entering a user password for generating user password data for verification by the second module based on the stored validation password data.

2. The method as claimed in claim 1, wherein the step of storing validation password data for verifying the identity of the first module on the second module comprises:

providing a validation password;

generating random first and second SALT values;

calculating a first password hash based on the validation password and the first SALT value, and a second password hash based on the validation password and the second SALT value; and

storing the first SALT value and the second password hash on the second module.

3. The method as claimed in claim 2, wherein the second SALT value and the first password hash are stored on the first module.

4. The method as claimed in claim 2, wherein the step of calculating the first and second password hashes is performed at the host system.

5. The method as claimed in claim 2, wherein the step of calculating the first and second password hashes is performed at either the first module or the second module.

6. The method as claimed in claim 3, wherein generating the user password data comprises calculating a third password hash based on the user password entered and the second SALT value stored on the first module.

7. The method as claimed in claim 6, wherein the verification by the second module comprises:

receiving the third password hash transmitted from the first module via the data link;

comparing the third password hash with the second password hash stored on the second module; and

confirming the identity of the first module only if the third password hash is identical to the second password hash.

8. The method as claimed in claim 7, further comprising entering another user password for another verification attempt if the third password hash is considered not identical to the second password hash by the second module.

9. The method as claimed in claim 8, wherein no further verification attempt is allowed after a predetermined number of failed verification attempts.

10. The method as claimed in claim 2, wherein each password hash is calculated using a respective one-way function.

11. The method as claimed in claim 2, wherein the first and second SALT values each has a length of about 20 bytes.

12. A method of storing validation password data on a pair of connected first and second modules, the method comprising the steps of:

associating the first module with the second module; and

storing validation password data for verifying the identity of the first module on the second module.

13. A method of verifying the identity of a first module removed from a pair of initially connected and associated first and second modules, the method comprising the steps of:

receiving, at the second module, user password data generated at and transmitted from the first module via a data link; and

verifying said user password data based on validation password data stored on the second module.

14. An access system for providing remote access to data stored on a host system from a remote system via a data link, the access system comprising the remote system and the host system, wherein:

the host system is configured to connect to a first module and a second module, the first module initially being connected to and associated with the second module, and to store validation password data for verifying the identity of the first module on the second module; and

the remote system is configured to, upon connecting the removed first module to the remote system to establish a secure communication channel between said first and second modules across said data link to access said data, the host system having the second module connected thereto, enter a user password for generating user password data for verification by the second module based on the stored validation password data.

15. A host system for storing validation password data on a pair of connected first and second modules, the host system configured to associate the first module with the second module;

and store validation password data for verifying the identity of the first module on the second module.

16. A host system for verifying the identity of a first module removed from a pair of initially connected and associated first and second modules, the host system configured to receive user password data generated at and transmitted from the first module via a data link;

and verify said user password data based on validation password data stored on the second module being connected to the host system.

17. A data storage medium having stored thereon computer code means to instruct a computing device to execute a method of storing validation password data on a pair of connected first and second modules, the method comprising the steps of:

associating the first module with the second module; and

storing validation password data for verifying the identity of the first module on the second module.

18. A data storage medium having stored thereon computer code means to instruct a computing device to execute a method of verifying the identity of a first module removed from a pair of initially connected and associated first and second modules, the method comprising the steps of:

receiving, at the second module, user password data generated at and transmitted from the first module via a data link; and

verifying said user password data based on validation password data stored on the second module.

19. A data storage medium having stored thereon computer code means to instruct an access system to execute a method of providing remote access to data stored on a host system from a remote system via a data link, the access system comprising the remote system and the host system, wherein the method comprises the steps of:

connecting a first module and a second module to the host system, the first module initially being connected to and associated with the second module;

storing validation password data for verifying the identity of the first module on the second module; and

upon connecting the removed first module to the remote system to establish a secure communication channel between said first and second modules across said data link to access said data, the host system having the second module connected thereto, entering a user password for generating user password data for verification by the second module based on the stored validation password data.