Apparatus and method for securing data on a portable storage device

• US 8,234,500 B2
• Filed: 12/16/2011
• Issued: 07/31/2012
• Est. Priority Date: 11/27/2002
• Status: Expired due to Term

• Current Assignee: Western Digital Israel Limited (Western Digital Corporation)
• Original Assignee: SanDisk IL Ltd. (Western Digital Corporation)
• Inventors: Ziv, Aran, Bychkov, Eyal
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/328,859
• Publication Number:
  US 20120089848A1
• Time in Patent Office: 228 Days
• Field of Search: 713/183, 713/193
• US Class Current: 713/183
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A portable storage device including a microprocessor and a secure user data area, the microprocessor operable to perform on-the-fly encryption/decryption of secure data stored on the storage device under a user password, the microprocessor also operable to exclude access to the secure user data area unless the user password is provided.

Claims

1. A secure portable storage device connectable to a host device, the secure portable storage device comprising:

a storage medium including;

a secure user area for storing therein user data in an encrypted form, and

a register for storing therein an encrypted key; and

a microprocessor configured to;

use a user password for encrypting a clear key to produce the encrypted key and, in turn, for decrypting the encrypted key to produce the clear key, and

use the clear key to decrypt the encrypted form of the user data read from the secure user area, and to encrypt the user data received from the host device thereby producing the encrypted form of the user data;

wherein the user password is generated by a user of the secure portable storage device;

wherein the microprocessor is further configured to control access from the host device to the secure user area such that the access is allowed only upon the microprocessor receiving the user password; and

wherein, upon receiving the user password, the secure portable storage device is remounted to the host device by disconnecting a communication link between the secure portable storage device and the host device and then reconnecting the communication link between the secure portable storage device and the host device.

2. The secure portable storage device of claim 1, wherein the storage medium further includes a clear user area, and wherein the microprocessor is further configured to allow access from the host device to the clear user area without requiring entry of the user password.

3. The secure portable storage device of claim 1, wherein the user password includes alphanumeric characters entered by the user.

4. The secure portable storage device of claim 1, wherein the user password includes biometric data.

5. The secure portable storage device of claim 1, wherein the storage medium further includes a register for storing therein a hashed representation of the user password, and wherein the microprocessor is also operable to hash the user password.

6. A secure portable storage device connectable to a host device, the secure portable storage device comprising:

an interface to a host device; and

a storage medium including;

a secure user area for storing user data; and

registers including;

a password register for storing therein a clear or hash version of a user password, which user password being user-generated; and

a key register for storing therein an encrypted key which is a clear key encrypted by the user password, wherein decryption of the encrypted key with the user password exposes the clear key, the clear key being exposable for use thereof in encrypting and decrypting user data communicated via the interface;

wherein the secure portable storage device is configured to bar access from the host device to the secure user area unless the secure portable storage device receives a user-entered password, via the interface, and matches the user-entered password with the clear or hash version thereof in the password register, and if there is such match the secure portable storage device is further configured to prompt the host device to remount the secure portable storage device to the host device by disconnecting a communication link between the secure portable storage device and the host device and then reconnecting the communication link between the secure portable storage device and the host device.

7. The secure portable storage device of claim 6, wherein the remounting prompted by the secure portable storage device is to establish the secure portable storage device as a disk drive with which the host device handles read-write operations.

8. The secure portable storage device of claim 7, wherein the established disk drive is a CD drive.

9. The secure portable storage device of claim 6, wherein the secure portable storage device is configured to, in response to such match, disconnect a communication link between the secure portable storage device and the host device before prompting the host device to remount the secure portable storage device.

10. The secure portable storage device of claim 9, wherein the secure portable storage device prompts the host device to remount the secure portable storage device to the host device by reconnecting the communication link between the secure portable storage device and the host device.

11. The secure portable storage device of claim 6, wherein the secure portable storage device is configured to, during set-up of the secure portable storage device:

receive a command from the host device to format a clear user area in the storage medium;

prompt the host device to dismount the secure portable storage device from the host device;

prompt the host device to remount the secure portable storage device to the host device; and

receive a command from the host device to format the secure user area.

12. The secure portable storage device of claim 6, wherein, in response to a password change, the secure portable storage device is configured to store a new password in the password register and to store a new encrypted key in the key register, wherein the new encrypted key is the clear key encrypted by the new password, and wherein decryption of the new encrypted key with the new user password exposes the same clear key as exposed when the first-mentioned encrypted key was decrypted with the first-mentioned user password.

13. A method for accessing a secure user area of a secure portable storage device, the method comprising:

performing by a secure portable storage device that has an interface to a host device and a storage medium including a secure user area for storing user data, a password register for storing therein a clear or hash version of a user password which is user-generated, and a key register for storing therein an encrypted key, which is a clear key encrypted by the user password;

receiving a user-entered password from the host device via the interface;

matching the user-entered password with the clear or hash version of the user password stored in the password register;

in response to such matching, prompting the host device to remount the secure portable storage device to the host device and providing the host device with access to the secure user area;

decrypting the encrypted key with the user password to expose the clear key; and

performing at least one of;

encrypting user data communicated via the interface and

decrypting user data communicated via the interface.

14. The method of claim 13, wherein the remounting prompted by the secure portable storage device is to establish the secure portable storage device as a disk drive with which the host device handles read-write operations.

15. The method of claim 14, wherein the established disk drive is a CD drive.

16. The method of claim 13 further comprising:

in response to such matching but before prompting the host device to remount the secure portable storage device, disconnecting a communication link between the secure portable storage device and the host device.

17. The method of claim 16, wherein prompting the host device to remount the secure portable storage device to the host device comprising reconnecting the communication link between the secure portable storage device and the host device.

18. The method of claim 13 further comprising, during set-up of the secure portable storage device:

receiving a command from the host device to format a clear user area in the storage medium;

prompting the host device to dismount the secure portable storage device from the host device;

prompting the host device to remount the secure portable storage device to the host device; and

receiving a command from the host device to format the secure user area.

19. The method of claim 13 further comprising:

storing a new password in the password register;

storing a new encrypted key in the key register, wherein the new encrypted key is the clear key encrypted by the new password; and

decrypting the new encrypted key with the new user password, wherein such decrypting exposes the same clear key as exposed when the first-mentioned encrypted key was decrypted with the first-mentioned user password.