Device, system and method for data access control

• US 6,324,537 B1
• Filed: 09/30/1999
• Issued: 11/27/2001
• Est. Priority Date: 09/30/1999
• Status: Expired due to Term

• Current Assignee: Innovative Memory Systems, Inc. (Wi-LAN Inc.)
• Original Assignee: M-Systems Flash Disk Pioneers Ltd. (Western Digital Corporation)
• Inventors: Moran, Dov
• Primary Examiner(s): Lintz, Paul R.
• Application Number:
  US09/409,091
• Time in Patent Office: 789 Days
• Field of Search: 707/9, 707/100, 707/200, 711/163, 711/164
• US Class Current: 707/758
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G07F 7/084 Additional components relating to data transfer and storing, e.g. error detection, self-diagnosis
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A device, a method and a system for providing control of access to data which is stored in an electronic data storage device. The device, method and system enable various types of permissions to be set for determining access to the stored data, such that if an attempt is made to access particular data which does not have a suitable permission type, access is denied. Preferably, the present invention is implemented as an access control device, such as a chip for example, which more preferably controls all access to the data storage device. This implementation is preferred, since such electronic devices are more difficult to “hack” for access by an unauthorized user. The device, system and method have a number of different utilizations, such as for controlling access to credit card information; for identifying a user according to a PIN or other identification information; for controlling access to a particular location according to the identity of the user; and for controlling access to various types of data files, such as music files in the MP3 format and so forth.

Claims

1. A system for controlling access to stored data, the stored data having at least one associated type of permission, the system comprising:

(a) an electronic data storage device for storing the stored data; and

(b) an access control device for controlling access in said electronic data storage device according to a type of requested access, wherein said access control device has a plurality of different types of access for accessing data on said electronic data storage device, such that the stored data is only accessed through said access control device, and such that said access control device determines access to the stored data by comparing the at least one associated type of permission to said type of access being requested.

2. The system of claim 1, wherein said electronic data storage device and said access control device are implemented on a single chip.

3. The system of claim 2, wherein said access control device includes a microprocessor and firmware for storing a plurality of instructions, such that said access control device determines said access according to said instructions of said firmware.

4. The system of claim 2, wherein said access control device is only logic, the system further comprising:

(c) a software program for containing a plurality of instructions for determining said access to said data storage device; and

(d) a data processor for operating said software program.

5. The system of claim 4, wherein said data storage device and said access control device are contained on said chip, and wherein said chip is included in a removable device.

6. The system of claim 1, wherein said data storage device and said access control device are implemented as a plurality of separate components.

7. The system of claim 1, wherein said access control device is implemented as a programmable ASIC.

8. The system of claim 1, wherein said access control device further comprises:

(i) an input for receiving a request to access the stored data;

(ii) a non-volatile memory for storing at least one permission for determining access to the stored data;

(iii) at least one instruction for determining a permitted access according to the at least one permission, said at least one instruction being stored on said non-volatile memory; and

(iv) a processor for executing said at least one instruction and for comparing said request to said at least one permission, such that if said at least one permission includes a type of access requested in said request, the stored data is provided, and alternatively if said at least one permission does not include a type of access requested in said request, the stored data is not provided.

9. The system of claim 8, wherein said non-volatile memory is a flash memory device.

10. The system of claim 9, further comprising:

(c) a CPU (central processing unit) for transmitting said request to said access control device and for receiving provided data; and

(d) a bus for connecting said CPU to said access control device, such that said electronic data storage device is not accessed through said CPU, but only through said access control device.

11. The system of claim 10, wherein said bus is a USB (universal serial bus).

12. The system of claim 11, wherein said at least one permission is for comparing said request to the stored data and for returning a positive or negative comparison, such that if said request is identical to the stored data, said comparison is positive, and alternatively such that if said request is not identical to the stored data, said comparison is negative, and such that the stored data is not read.

13. The system of claim 1, wherein said access control device is integrated with said electronic data storage device.

14. A method for controlling access to data stored in an electronic storage device, the method comprising the steps of:

(a) providing an access control device for determining access to the electronic data storage device;

(b) receiving a request to access the stored data by said access control device;

(c) comparing said request to at least one permission for determining access to the stored data by said access control device, wherein said at least one permission is one of a plurality of different types of permission, each type of permission determining a type of success to the stored data;

(d) if said at least one permission includes a type of access requested in said request, performing said request for accessing the stored data from the electronic data storage device by said access control device; and

(e) alternatively, if said at least one permission does not include a type of access requested in said request, rejecting said request by said access control device.

15. The method of claim 14, wherein said type of access includes permission to read from the stored data, such that step (d) includes the step of reading from the stored data.

16. The method of claim 14, wherein said type of access includes permission to write to the stored data, such that step (d) includes the step of writing to the stored data.

17. The method of claim 14, wherein said type of access only includes comparing said request to the stored data and for returning a positive or negative comparison, such that if said request is identical to the stored data, step (d) includes the step of returning a positive comparison, and alternatively such that if said request is not identical to the stored data, step (d) includes the step of returning a negative comparison, such that the stored data is not read.

18. The method of claim 14, wherein the stored data is a credit card number, and said credit card number features a plurality of types of data, each of said plurality of types of data being stored with a separately selected access permission.

19. The method of claim 14, wherein the stored data has a permission for a predetermined number of data read accesses, such that step (c) includes the steps of:

(i) determining a number of performed data read accesses for the stored data; and

(ii) if said number of performed data read accesses is less than said predetermined number of data read accesses, permitting the stored data to be read.

24. The method of claim 14, wherein said access control device has a single input and wherein a success is determined only through said single input.

20. A system for controlling access to stored data, the system comprising:

(a) an electronic data storage device for storing the stored data, the stored data having at least one associated type of permission, said at least one associated type of permission being determined according to a data-based definition; and

(b) an access control device for controlling access to said electronic data storage device according to a type of requested access, said access control device comprising hardware, such that said at least one associated type of permission is not determined by said hardware of said access control device, said access control device having a plurality of different types of access for accessing data on said electronic data storage device, such that stored data is only accessed through said access control device, and such that said access control device determines access to said stored data by comparing said at least one associated type of permission to said type of access being requested.

21. A system for controlling access to stored data, the system consisting essentially of:

(a) an electronic data storage device for storing the stored data; and

(b) an access control device for controlling access to said electronic data storage device, such that the stored data is only accessed through said access control device, and such that said access control device determines access to the stored data according to at least one permission.

22. A system for controlling access to stored data, the system comprising:

(a) an electronic data storage device for storing the stored data, said electronic data storage device having a single input for accessing the stored data, such that the stored data is only accessed through said single input; and

(b) an access control device for controlling access to said electronic data storage device through said single input, such that the stored data is only accessed through said access control device, and such that said access control device determines access to the stored data according to at least one permission.

23. The system of claim 22, wherein said at least one associated type of permission is determined according to a type of data being stored.