METHOD FOR PROTECTING DATA ON A MASS STORAGE DEVICE AND A DEVICE FOR THE SAME

• US 20150156195A1
• Filed: 05/21/2013
• Published: 06/04/2015
• Est. Priority Date: 05/23/2012
• Status: Active Grant

• Current Assignee: Gemalto SA (Thales SA)
• Original Assignee: Gemalto SA (Thales SA)
• Inventors: Chi, Zhaolin
• Granted Patent: US 9,985,960 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 63/0838 using one-time-passwords

Abstract

A method for protecting data on a mass storage device. The device has a security module and a data storage area configured to be switched between a protected state, in which accessing the data storage area is forbidden and an unprotected state, in which accessing the data storage area is authorized. Switching the data storage area from the protected state to the unprotected state by sending a request to a remote server, receiving a one-time password on a communication device, in response to the sent request, providing the received one-time password to the security module, authorizing access to the data storage area by the security module, once the provided one-time password is deemed valid by the security module.

Claims

1. A method for protecting data on a mass storage device, said device comprising a security module and a data storage area configured to be switched between a protected state, in which accessing the data storage area is forbidden and an unprotected state, in which accessing the data storage area is authorized, wherein switching said data storage area from the protected state to the unprotected state comprises steps of:

sending a request to a remote server;

receiving a one-time password on a communication device, in response to the sent request;

providing said received one-time password to the security module;

authorizing access to the data storage area by the security module, once said provided one-time password is deemed valid by said security module.

2. The method of claim 1, further comprising rejecting said one-time password if said one-time password is not provided to the security module within a preset amount of time after the sending of a request.

3. The method of claim 1, wherein receiving said one-time password includes reception, on the communication device, of a text message containing said one-time password.

4. The method of claim 1, wherein receiving said one-time password includes reception, on a pre-set e-mail account, of a message containing said one-time password.

5. The method of claim 1, further comprising displaying said received one-time password on the communication device.

6. The method of claim 1, wherein providing said one-time password includes inputting said one-time password into a user interface connected to the security module.

7. The method of claim 1, wherein authorizing access to the data storage area includes decrypting contents of said data storage area.

9. The mass storage device of claim 7, wherein the security module comprises a chip card.

10. The mass storage device of claim 7, wherein the security module comprises a secure cryptoprocessor.

8. A password-protected mass storage device, comprising a security module and a data storage area, said data storage area being configured to be switched between a protected state, in which accessing the data storage area is forbidden and an unprotected state, in which accessing the data storage area is authorized, wherein said module is programmed to switch said data storage area from the protected state to the unprotected state by executing steps of:

sending a request to a remote server;

retrieving a one-time password provided to the security module and received in response to the sent request;

authorizing access to the data storage area, by the security module, once said provided one-time password is deemed valid by said security module.