Secure storage device permanently disabled by remote command

• US 9,244,862 B2
• Filed: 07/03/2013
• Issued: 01/26/2016
• Est. Priority Date: 05/23/2008
• Status: Active Grant

• Current Assignee: Exacttrak Limited
• Original Assignee: Exacttrak Limited
• Inventors: Shaw, Norman, Pragnell, John
• Primary Examiner(s): REHMAN, MOHAMMED H
• Application Number:
  US13/934,336
• Publication Number:
  US 20130311737A1
• Time in Patent Office: 937 Days
• Field of Search: 713/323
• US Class Current: 1/1
• CPC Class Codes: G06F 12/14 Protection against unauthorised use of memory or access to memory
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A communication and security device for a portable computer is disclosed including a housing, a connector provided on the housing for physical connection to the portable computer, a computer interface coupled to the connector for communicating data with the portable computer, a wireless modem coupled to the computer interface for communicating data between the portable computer and a remote device via a wireless network, a regulator operable to regulate power in the communication and storage device, and a processor coupled to control the regulator, the processor coupled to the wireless modem and arranged to process at least one security command received by the wireless modem to control the regulator in response to the received command.

Claims

1. A removable memory device comprising:

an interface for connecting the removable memory device to a host device;

a data storage coupled to the interface;

a wide area communication interface configured to receive a security message, the security message comprising a user data header and message data including a security command;

a controller coupled to the wide area communication interface, wherein the controller is configured to apply a physically damaging voltage to permanently disable the data storage in response to the security message received via the wide area communication interface;

wherein the wide area communication interface is configured to accept security messages only from at least one predetermined source; and

wherein the controller is configured to identify the at least one predetermined source based on an identifier carried by the user data header.

2. The removable memory device of claim 1 comprising a location determiner coupled to the controller, wherein the controller is configured to transmit, over the wide area communication interface, location information determined by the location determiner to a specified device controlled by an authorised controller of the memory device, to be compared with a stored list of authorised locations, and to enable the controller to determine whether to permanently disable the data storage based on the comparison.

3. The removable memory device of claim 2 further comprising an encryption processor wherein the controller is configured to inhibit decryption operations of the encryption processor if it is determined that location information measured by the location determiner does not correspond to an authorised location.

4. The removable memory device of claim 2 wherein the removable memory device transmits location information measured by the location determiner to a remote device, and at least one of inhibits and enables decryption operations of the encryption processor in dependence upon authorisation information received from the remote device in response to said location information.

5. The removable memory device of claim 1, further comprising an encryption processor coupled between the data storage and the interface for connection to a host device.

6. The removable memory device of claim 5 wherein the controller is configured to control the encryption processor and the data storage to control access to data stored in the data storage.

7. The removable memory device of claim 6 wherein the controller is configured to inhibit decryption operations of the encryption processor unless a host device provides security information.

8. The removable memory device of claim 5 wherein the controller is configured to control the encryption processor based on a second security command received via the wide area communication interface.

9. The removable memory device of claim 5 wherein the controller is configured to inhibit decryption operations of the encryption processor.

10. The removable memory device of claim 1 wherein the controller comprises a non-volatile memory storing instructions for performing security actions of the removable memory device.

11. The removable memory device of claim 10 wherein the security action is chosen from a list comprising instructions:

to delete data from the data storage means;

to disable the encryption processor;

to change or delete an encryption key of the encryption processor;

to delete a directory structure of the data storage means;

to overwrite a directory structure of the data storage means;

to modify data on the data storage means;

to delete nominated data from the data storage means;

to read and transmit data from the data storage to a remote device;

to activate the location determining means;

to perform a location measurement using the location determining means;

to transmit location information;

or to perform any combination of the foregoing actions.

12. The removable memory device of claim 10 wherein the security command comprises a reference to a memory address of the non-volatile memory of the controller and the controller is configured to follow instructions associated with that memory address.

13. The removable memory device of claim 1 wherein the wide area communication interface comprises a cellular wireless device.

14. The removable memory device of claim 1 wherein permanently disabling the data storage comprises permanently destroying the data storage.

15. The device of claim 1 wherein the security message comprises an SMS message.

16. A method of securing a removable memory device, the method comprising:

communicating with the removable memory device via a wide area communication interface to control access to a data store of the removable memory device; and

receiving a security message from at least one predetermined source via the wide area communication interface, the security message comprising a user data header and message data comprising a security command to disable the removable memory device;

wherein the removable memory device accepts the security message from the at least one predetermined source based on an identifier carried by the user data header;

wherein the removable memory device is configured to apply a physically damaging voltage to the data store to permanently disable the data storage when the security command is received.

17. The method of claim 16 comprising receiving location information from the removable memory device, determining that the location information indicates that the removable memory device is not in an authorised location, and, prior to receiving the security command to permanently disable the removable memory device, sending a second security message including a second security command to the removable memory device via the wide area communication interface, the removable memory device configured to switch off access to the data store of the removable memory device.

18. The method of claim 16 further comprising, prior to receiving the security command to disable the removable memory device, controlling access to the data store of the removable memory device by sending a command to the removable memory device to at least one of:

switch off access to the data store in the removable memory device and switch off a power supply to the data store of the removable memory device.

19. The method of claim 16, wherein the removable memory device is configured to reject security messages that do not originate from at least one predetermined source.