Restricting access to data on portable storage media based on access to a private intranet

• US 9,336,375 B1
• Filed: 07/28/2009
• Issued: 05/10/2016
• Est. Priority Date: 07/28/2009
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Sharma, Sanjay K., Lee, Woojae
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US12/510,788
• Time in Patent Office: 2,478 Days
• Field of Search: 726/4
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Systems, products, and methods are disclosed for enabling access to encrypted data stored on a portable storage medium. In one embodiment, an attempt to communicate with a certain intranet is made. If this attempt succeeds, then access is granted to the data stored on the portable storage device, but if access to the intranet is not granted, then access to the data stored on the portable storage device is also not granted. Denying access can include preventing the portable storage device from even being recognized by a requesting device, being recognized but not presented, or can include showing that such encrypted data exists, but denying access to the data in an unencrypted format.

Claims

1. A method of enabling access to encrypted data stored on a portable storage medium, the method comprising:

attempting, by the portable storage medium, to communicate with an intranet, wherein the portable storage medium includes a radio configured to communicate directly with the intranet using a wireless communications network independent of a host device to determine if the intranet is a predetermined private intranet;

receiving a request at the host device to access the encrypted data stored on the portable storage medium;

determining, by the portable storage medium using the radio, that the intranet is the predetermined private intranet that, when identified by the portable storage medium as the predetermined private intranet, allows access to the encrypted data by the host device; and

providing the host device access to the encrypted data stored on the portable storage medium in an unencrypted form.

2. The method of claim 1, wherein the predetermined private intranet is identified by the portable storage medium prior to the request to access the encrypted data.

3. The method of claim 1, wherein attempting to communicate with the intranet includes one or more of the following:

attempting to access one or more computing devices associated with one or a range of IP addresses that form a portion of the intranet;

attempting to access a website via a specific Uniform Resource Locator that is only accessible by way of the intranet;

attempting to access a certain network domain that forms a portion of the intranet;

submitting to a given web page log-in credentials that are required to access the intranet; and

receiving a key that is provided via a computing device that forms a portion of the intranet.

4. The method of claim 3, wherein the predetermined private intranet is accessible by the portable storage medium when one or more of the following occur:

the one or more computing devices associated with one or a range of Internet Protocol addresses are reached;

the website is accessible via the specific Uniform Resource Locator;

the certain network domain is accessed;

the log-in credentials are validated; and

the key is received.

5. The method of claim 2, further comprising attempting to ping a first computing device that forms a portion of the intranet.

6. The method of claim 1, wherein the communication with the intranet is successful when the portable storage medium is permitted to access a prescribed wireless network that provides access to the intranet.

7. The method of claim 6, wherein the host device is permitted to access the prescribed wireless network when the prescribed wireless network is listed in a list of accessible wireless networks on the host device.

8. The method of claim 1, wherein the portable storage medium includes a device identifier that identifies the portable storage medium.

9. The method of claim 1, wherein the communication with the intranet is successful when a computing device within the intranet uses a device identifier associated with the portable storage medium to confirm that the portable storage medium is authorized to decrypt the encrypted data.

10. A memory component comprising:

a housing having a portable computer-readable medium that stores encrypted data in a first portion of the portable computer-readable medium;

a radio configured to communicate directly with an accessible intranet using a wireless communications network to determine if the accessible intranet is a predetermined private intranet; and

a set of computer-executable instructions embodied on a second portion of the portable computer-readable medium, wherein the computer-executable instructions, when executed, perform a process that includes permitting access to the encrypted data in an unencrypted form only when it is determined, at the portable computer-readable medium using the radio, that the predetermined private intranet that allows access to the encrypted data is accessible by the portable computer-readable medium.

11. The memory component of claim 10, wherein it is further determined that a specified trusted source is within a threshold proximity of the memory component and includes an electronics device that is communicated with by way of a short-range wireless technology.

12. The memory component of claim 11, wherein the short-range wireless technology includes Near Fields Communications (NFC) technology.

13. The memory component of claim 10, wherein the predetermined private intranet is capable of being accessed when any of the following are successful:

an attempt to access one or more computing devices associated with one or a range of IP addresses that form a portion of the predetermined private intranet;

an attempt to access a website via a specific Uniform Resource Locator (URL) that is only accessible by way of the predetermined private intranet;

an attempt to ping a first computing device that forms a portion of the predetermined private intranet;

attempting to access a certain network domain that forms a portion of the predetermined private intranet;

a validation of log-in credentials submitted to a web page, wherein the log-in credentials are required to access the predetermined private intranet; and

receiving a key that is provided via a computing device that forms a portion of the predetermined private intranet.

14. A method of enabling access to encrypted data stored on a portable storage medium, the portable storage medium having a radio configured to communicate with an accessible intranet using a wireless communications network, the method comprising:

receiving, from a requesting device, a request to access unencrypted data, which is the encrypted data in an unencrypted format stored on the portable storage medium;

attempting, by the portable storage medium using the radio, to communicate directly with the accessible intranet to determine if the accessible intranet is a predetermined private intranet, connection to which by the portable storage medium allows access to the encrypted data by the requesting device;

determining, by the portable storage medium, whether the accessible intranet is the predetermined private intranet that allows access to the encrypted data by the requesting device; and

if the predetermined private intranet is accessible by the portable storage medium using the radio, then providing access to the unencrypted data, but

if the predetermined private intranet is not accessible by the portable storage medium using the radio, then preventing access to the unencrypted data.

15. The method of claim 14, wherein determining whether the predetermined private intranet is accessible by the portable storage medium includes attempting to access one or more computing devices associated with one or a range of IP addresses that form a portion of the predetermined private intranet.

16. The method of claim 14, wherein determining whether the predetermined private intranet is accessible by the portable storage medium includes attempting to access a website via a specific Uniform Resource Locator that is only accessible by way of the predetermined private intranet.

17. The method of claim 14, wherein determining whether the predetermined private intranet is accessible by the portable storage medium includes attempting to ping a first computing device that forms a portion of the predetermined private intranet.

18. The method of claim 14, wherein determining whether the predetermined private intranet is accessible by the portable storage medium includes attempting to access a certain network domain that forms a portion of the predetermined private intranet.

19. The method of claim 14, wherein determining whether the predetermined private intranet is accessible by the portable storage medium includes receiving a key that is provided via a computing device that forms a portion of the predetermined private intranet.

20. The method of claim 14, wherein preventing access to the unencrypted data includes one or more of:

not presenting to the requesting device a representation of the portable storage medium;

presenting a representation of the portable storage medium to the receiving device without presenting an indication of the unencrypted data nor the encrypted data; and

presenting a representation of the portable storage medium to the receiving device and a representation of the encrypted data, without decrypting the encrypted data.