Methods used in a mass storage device with automated credentials loading

• US 7,743,409 B2
• Filed: 12/27/2005
• Issued: 06/22/2010
• Est. Priority Date: 07/08/2005
• Status: Active Grant

• Current Assignee: SanDisk Technologies LLC (Western Digital Corporation)
• Original Assignee: SanDisk Corporation (Western Digital Corporation)
• Inventors: Ferchau, Joerg, Gonzalez, Carlos J., Jogand-Coulomb, Fabrice
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/319,259
• Publication Number:
  US 20070016941A1
• Time in Patent Office: 1,638 Days
• Field of Search: None
• US Class Current: 726/9
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06K 19/07 with integrated circuit chips
• CPC Class Codes: G06K 19/07732 the record carrier having a housing or construction similar to well-known portable memory devices, such as SD cards, USB or memory sticks housings for electrical equipment in general, see H05K5/02
• CPC Class Codes: G11C 7/24 Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A portable mass storage device for use in two factor authentication systems and methods. A secure portable mass storage device protects content from being freely copied with security mechanisms and firmware. The security functionality also protects confidential user credentials and passwords, as well as algorithms and seeds needed for two factor authentication or asymmetric authentication methods. A client application residing in the mass storage device acts as both a password manager and an authentication manager that seamlessly performs the authentication procedures in the background while signing a user into various institutions of his choosing. A very high level of security is integrated into a mass storage device the user has for purposes other than two factor authentication, and the convenience of highly secure password management also comes in a convenient pocket sized package easy for the user to transport. This facilitates the acceptance of two factor authentication, and increases security for a wide variety of online transactions.

Claims

1. A method of accessing accounts of a user with a portable mass storage device, the method comprising:

detecting a connecting of the portable mass storage device with a computer, the portable mass storage device comprising a portable memory card or a portable USB drive; and

thereafter

causing a connection to be established between the computer and a first entity; and

thereafter

causing a seed, to be used with a one time password generator implemented within the portable mass storage device, to be loaded into the portable mass storage device while it is connected to the computer;

launching a client application;

executing the client application using the computer;

sending a request from the client application to the portable mass storage device;

generating, in response to the request and within the portable mass storage device using the one time password generator, a one time password with the loaded seed;

causing the one time password to be transmitted to an institution along with user identifying information, thereby logging the user into one of said accounts so that the user can access his account.

2. The method of claim 1, further comprising causing additional seeds that are to be used with the one time password generator to be loaded into the portable mass storage device while it is connected, each additional seed to be used with a particular account or institution, each seed stored in a hidden partition of the mass storage device not accessible through standard read write commands used by file system of the connected computer to access data within the storage volume of the device.

3. The method of claim 2, wherein in order for an entity to load a seed it must establish that it has permission to load a seed in order to load the seed and access the hidden partition.

4. The method of claim 1, wherein generating comprises computing a value with an algorithm, and wherein generating comprises utilizing a different algorithm for each account or institution to be accessed.

5. The method of claim 1, further comprising causing binding of the portable mass storage device with a slot of the portable mass storage device.

6. The method of claim 1, further comprising causing the slot to be activated.

7. The method of claim 1, further comprising causing the user and the portable mass storage device to be authenticated.

8. The method of claim 5, wherein binding comprises:

selecting an account;

receiving a slot identifier;

retrieving a device identifier within the device; and

creating a unique identifier based upon the slot identifier and the device identifier.

9. The method of claim 8, further comprising using the unique identifier to bind the mass storage device to a validation server.

10. The method of claim 8, wherein the slot identifier is received from a client stored on the portable mass storage device and executed by a processor of the computer.

11. The method of claim 8, wherein the slot identifier is received from a client stored on the portable mass storage device and executed by a processor of the portable mass storage device.

12. The method of claim 6, wherein activating the slot comprises:

causing user identifying information to be entered by the user;

causing the user to select an account;

correlating the account and user with the slot.

13. The method of claim 1, further comprising receiving the seed from a first entity prior to loading of the seed.

14. A method of automated credentials loading, comprising:

causing a portable mass storage device comprising a portable memory card or a portable USB drive to perform a one time password generation sequence that generates a one time password value, wherein causing the portable mass storage device to perform a one time password generation sequence includes launching a client application, executing the client application using a host to which the portable mass storage device is connected, sending a request from the client application to the portable mass storage device and wherein the one time password value is generated, in response to the request and within the portable mass storage device by a one time password generator implemented within the portable mass storage device;

obtaining the one time password value from the portable mass storage device;

retrieving one or more user credentials from a list of credentials stored in a secure memory area of the mass storage device;

accessing a web site of an institution;

entering into the web site of the institution the one or more user credentials and the one time password value.

15. The method of claim 14, wherein the entering is triggered by the portable mass storage device, and performed automatically without participation of a user of the device.

16. The method of claim 14, wherein the entering is triggered by an action of the user of the device.

17. The method of claim 14, further comprising loading a seed into the portable mass storage device.

18. The method of claim 14, further comprising loading an identifier of the portable mass storage device into the device.

19. The method of claim 17, wherein one or more institutions are accessed, and wherein for each institution a unique seed is loaded, wherein for a seed to be loaded the entity wishing to load the seed must establish that it has permission to do so.

20. The method of claim 14, wherein one or more institutions are accessed, and wherein for each institution a unique password generation process is utilized in performing the one time password generation sequence.

21. The method of claim 14, wherein entering comprises dragging and dropping.

22. The method of claim 14, wherein entering comprises associating fields stored in the portable mass storage device with appropriate web page fields of the web site.

23. The method of claim 14, wherein entering is triggered by a user'"'"'s selection of an institution from the list.

24. The method of claim 14, wherein entering is triggered by detection of the opening of a particular web page with a web browser.

25. The method of claim 14, wherein entering is performed by a third party.

26. The method of claim 14, wherein entering is performed by the client application stored on the portable device and executed by the host device.

27. The method of claim 14 wherein entering the credentials into the web site comprises entering the credentials into web page fields of the web site.

28. A sign on method comprising:

inserting a portable mass storage device into a socket of a host device, said socket having electronic contacts and disposed for frequent insertion and removal of the portable mass storage device by a user of the device, the portable mass storage device comprising a portable memory card or a portable USB drive;

launching a client application residing on the portable mass storage device;

entering user identifying information and user secret information;

selecting an institution in which to sign on;

connecting to an authority;

receiving, in the host device, a seed from the authority;

receiving, in the host device, a device identifier from the authority;

storing the seed in the mass storage device;

storing the device identifier in the mass storage device;

storing an institution identifier in the mass storage device;

storing a count for use with the seed; and

executing the client application using the host device;

sending a request from the client application to the portable mass storage device;

generating, in response to the request and within the portable mass storage device using a one time password generator within the portable mass storage device a one time password value based on the seed.

29. The method of claim 28, further comprising presenting the user a list of institutions in which to sign on.

30. The method of claim 28, wherein selecting an institution comprises entering an institution identifier.

31. The method of claim 28, wherein selecting an institution comprises selecting the institution from a list.

32. The method of claim 30, wherein the institution identifier comprises a universal resource locator.

33. The method of claim 30, wherein the institution identifier comprises the name or an alias of the institution.

34. The method of claim 28, wherein the seed is stored in an encrypted format.

35. The method of claim 28, wherein the device identifier is stored in the mass storage device by the client application.

36. The method of claim 28, wherein the user identifying information comprises biometric information.

37. The method of claim 28, wherein entering user identifying information and user secret information is done on a form of the client application.

38. The method of claim 28, further comprising learning the placement of the security credentials and identifying information.

39. The method of claim 28, further comprising associating user identifying information and user secret information with the institution identifier.

40. The method of claim 33, further comprising associating the seed with the institution identifier.

41. The method of claim 28, wherein the portable mass storage device has a universal serial bus interface.

42. The method of claim 28, wherein the portable mass storage device has form factor of a memory card.

43. The method of claim 28, wherein the seed is stored in the mass storage device in an encrypted format.

44. The method of claim 28, wherein the seed is stored in a secure portion of the memory used for mass storage in the mass storage device.

45. The method of claim 44, wherein the seed can only be stored while the mass storage device is in certain operating states.

46. A method of logging into an institution, comprising:

sensing the insertion of a portable mass storage device in a socket of a host device, said socket designed for frequent insertion and removal of the portable mass storage device by a user of the device, the portable mass storage device comprising a portable memory card or a portable USB drive;

launching a client application residing on the portable mass storage device and executing the client application on the host device;

retrieving a list of enrolled institutions stored in the mass storage device;

selecting an institution from the list;

retrieving a user identity, user secret, and an institution identifier stored in a memory of the mass storage device;

sending a request from the client application to the portable mass storage device;

generating, in response to the request, a one time password value within the portable mass storage device using a one time password generator implemented within the portable mass storage device;

opening a user interface of the institution whose identifier was retrieved;

causing the host device to enter the user identity, credentials, and the one time password value into the user interface of the institution,

triggering the institution to pass a device identifier, and the one time password value to an authenticating entity,

said authenticating entity thereafter passing an authentication status of the device to the institution.

47. The method of claim 46, further comprising entering the user identity and user secret.

48. The method of claim 46, wherein the entering is performed once, and wherein thereafter it stored within and retrieved from a memory of the mass storage device.

49. The method of claim 46, wherein the list is retrieved by the launched client application.

50. The method of claim 46, wherein the single action comprises a keystroke.

51. The method of claim 46, wherein selecting an institution comprises a single user activation of a cursor control device.

52. The method of claim 46, wherein the user interface comprises one or more world wide web pages.

53. A method of logging into an institution with a portable mass storage device and a computer, the method comprising:

inserting the device into a receptacle of the computer;

executing instructions residing in mass storage memory of the portable mass storage device, wherein the portable mass storage device comprises a portable memory card or a portable USB drive, wherein executing instructions residing in the mass storage device includes launching a client application and executing the client application using the computer,

said client application causing the computer to request a one time password value from the portable mass storage device;

said portable mass storage device generating, within the portable mass storage device using a one time password generator implemented within the portable mass storage device, a one time password value in response to the request from the computer, said instructions client application further causing the computer to provide a user identifier, a user secret, and the one time password value to the server to the institution, thus logging the user into the institution.

54. A method of accessing accounts of a user with a portable mass storage device, the method comprising:

detecting a connecting of the portable mass storage device with a computer, the portable mass storage device comprising a portable memory card or a portable USB drive; and

thereafter

causing a connection to be established between the computer and a first entity; and

thereafter

causing a seed, to be used with a one time password generator implemented within the portable mass storage device, to be loaded into the portable mass storage device while it is connected to the computer;

generating within the portable mass storage device using the one time password generator, a one time password with the loaded seed;

causing the one time password to be transmitted to an institution along with user identifying information, thereby logging the user into one of said accounts so that the user can access his account; and

launching an application from the portable mass storage device and executing the application with the computer, wherein the application is configured to present to the user plural institutions for the user to access and wherein the one time password generator is configured to generate one time passwords for each of the institutions.

55. A method of automated credentials loading, comprising:

causing a portable mass storage device comprising a portable memory card or a portable USB drive to perform a one time password generation sequence that generates a one time password value, wherein the one time password value is generated within the portable mass storage device by a one time password generator implemented within the portable mass storage device;

obtaining the time password value from the portable mass storage device;

retrieving one or more user credentials from a list of credentials stored in a secure memory area of the mass storage device;

accessing a web site of an institution;

entering into the web site of the institution the one or more user credentials and the time password value; and

launching an application from the portable mass storage device and executing the application on a host system to which the portable mass storage device is coupled, wherein the application is configured to present to a user plural institutions for the user to access and wherein the one time password generator is configured to generate, within the portable mass storage device, one time password values for each of the institutions.

56. A sign on method comprising:

inserting a portable mass storage device into a socket of a host device, said socket having electronic contacts and disposed for frequent insertion and removal of the portable mass storage device by a user of the device, the portable mass storage device comprising a portable memory card or a portable USB drive;

launching an application residing on the portable mass storage device;

entering user identifying information and user secret information;

selecting an institution in which to sign on;

connecting to an authority;

receiving, in the host device, a seed from the authority;

receiving, in the host device, a device identifier from the authority;

storing the seed in the mass storage device;

storing the device identifier in the mass storage device;

storing an institution identifier in the mass storage device;

storing a count for use with the seed;

generating within the portable mass storage device using a one time password generator within the portable mass storage device a one time password value based on the seed; and

presenting, using the application, plural institutions for a user to access and wherein the one time password generator is configured to generate, within the portable mass storage device, one time passwords for each of the institutions.

57. A method of logging into an institution, comprising:

sensing the insertion of a portable mass storage device in a socket of a host device, said socket designed for frequent insertion and removal of the portable mass storage device by a user of the device, the portable mass storage device comprising a portable memory card or a portable USB drive;

launching an application residing on the portable mass storage device;

retrieving a list of enrolled institutions stored in the mass storage device;

selecting an institution from the list;

retrieving a user identity, user secret, and an institution identifier stored in a memory of the mass storage device;

generating a one time password value within the portable mass storage device using a one time password generator implemented within the portable mass storage device;

opening a user interface of the institution whose identifier was retrieved;

causing the host device to enter the user identity, credentials, and the one time password value into the user interface of the institution,

triggering the institution to pass a device identifier, and the one time password value to an authenticating entity,

said authenticating entity thereafter passing an authentication status of the device to the institution; and

presenting, using the application, plural institutions for the user to access and wherein the one time password generator is configured to generate, within the portable mass storage device, one time password values for each of the institutions to generate within the portable mass storage device.

58. A method of logging into an institution with a portable mass storage device and a computer, the method comprising:

inserting the device into a receptacle of the computer;

executing instructions residing in mass storage memory of the portable mass storage device, wherein the portable mass storage device comprises a portable memory card or a portable USB drive,

said instructions causing the computer to request a one time password value from the portable mass storage device;

said portable mass storage device generating, within the portable mass storage device using a one time password generator implemented within the portable mass storage device, a one time password value in response to the request from the computer,

said instructions further causing the computer to provide a user identifier, a user secret, and the one time password value to the server to the institution, thus logging the user into the institution; and

wherein said instructions further cause the computer to present to the user plural institutions for the user to access and wherein the one time password generator is configured to generate, within the portable mass storage device, one time passwords for each of the institutions.