Providing data security with a token device

• US 9,544,301 B2
• Filed: 01/28/2015
• Issued: 01/10/2017
• Est. Priority Date: 01/28/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hintermeister, Gregory R.
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): MURPHY, JOSEPH B
• Application Number:
  US14/607,452
• Publication Number:
  US 20160219033A1
• Time in Patent Office: 713 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

A computer-implemented method for providing security to access and store data may include transferring first information for display from a token device having a memory to a first computing device at a first time, the token device connected to the first computing device and the first information describing public data stored on the token device. A request to retrieve a root directory of private data may be received, the request specifying a root directory name. In response to receiving the request to retrieve a root directory of private data, the root directory may be requested by establishing a wireless connection between the token device and a server computing device, transferring the root directory name to the server computing device, wherein the root directory name is used as a password to retrieve the root directory, and receiving the root directory from the server computing device by the token device.

Claims

1. A token device for providing security to access and store data, comprising:

a private data conceal engine configured to transfer first information for display from the token device having a memory to a first computing device at a first time, the token device connected to the first computing device and the first information describing public data stored on the token device;

a radio configured to establish a wireless connection between the token device and a server computing device, wherein the token device receives a request to retrieve a root directory of private data, the request specifying a root directory name and in response to the receiving of the request, the token device requests the root directory from the server computing device and receives the root directory from the server computing device; and

a cryptosystem configured to transfer the root directory name to the server computing device, wherein the root directory name is used as a password to retrieve the root directory from the server computing device.

2. The token device of claim 1,

wherein the radio is further configured to receive a request to retrieve a sub-directory of the root directory of private data, the request specifying a sub-directory name, and in response to the receiving of the request, the token device requests the sub-directory from the server computing device and receives the sub-directory from the server computing device;

and

wherein the cryptosystem is further configured to transfer the sub-directory name to the server computing device, wherein the sub-directory name is used as a password to retrieve the sub-directory from the server computing device.

3. The token device of claim 1, wherein the radio is further configured to synchronize the token device with the server computing device to store the root directory from the server computing device to the token device.

4. The token device of claim 3,

wherein the data conceal engine is further configured to transfer second information for display to a second computing device at a second time, wherein the token device is connected to the second computing device, the second information describing the public data stored on the token device;

further comprising an authentication engine configured to receive a request to retrieve the root directory of private data stored on the token device, the request specifying the root directory name that is used as a password to retrieve the root directory stored on the token device, and in response to receiving the request to retrieve the root directory of private data stored on the token device, the authentication engine further configured to authenticate the request by verifying that the root directory name matches the name of the root directory; and

wherein the data conceal engine is further configured to transfer the root directory of private data stored on the token device to a display screen of the second computing device.

5. The token device of claim 1, further comprising a compressed URL generator configured to generate a unique compressed URL each time a link, which corresponds to the compressed URL, is selected to open the root directory of private data in a browser.

6. The token device of claim 1, further comprising a public storage engine configured to display a public storage, wherein the display of the public storage shows a total storage capacity that is less than the actual total storage capacity of the token device and the display of the public storage shows only the public data stored on the token device, wherein the token device is configurable to alter how much of the total storage capacity is displayed for the public storage.

7. A computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code comprising computer readable program code configured for:

transferring first information for display from a token device having a memory to a first computing device at a first time, the token device connected to the first computing device and the first information describing public data stored on the token device;

receiving a request to retrieve a root directory of private data, the request specifying a root directory name;

in response to receiving the request to retrieve a root directory of private data, requesting the root directory by;

establishing a wireless connection between the token device and a server computing device,

transferring the root directory name to the server computing device, wherein the root directory name is used as a password to retrieve the root directory, and

receiving the root directory from the server computing device by the token device.

8. The computer program product of claim 7, further comprising:

receiving a request to retrieve a sub-directory of the root directory of private data, the request specifying a sub-directory name;

in response to receiving the request to create the sub-directory of the root directory of private data, requesting the sub-directory by transferring the sub-directory name to the server computing device, wherein the sub-directory name is used as a password to retrieve the sub-directory; and

receiving the sub-directory from the server computing device by the token device.

9. The computer program product of claim 7, comprising:

receiving offline data entries by the token device, wherein the wireless connection between the token device and the server computing device is disconnected;

re-establishing the wireless connection between the token device and the server computing device; and

synchronizing the token device with the server computing device to store the offline data entries from the token device to the server computing device.

10. The computer program product of claim 9, wherein the synchronizing occurs by:

transferring second information for display from the token device to a second computing device at a second time, the token device connected to the second computing device and the first information describing public data stored on the token device;

receiving a request to retrieve the root directory of private data, the request specifying the root directory name;

in response to receiving the request to retrieve the root directory of private data, requesting the root directory by transferring the root directory name to the server computing device, wherein the root directory name is used as a password to retrieve the root directory;

receiving the root directory from the server computing device by the token device; and

transferring any quantity of the offline data entries to the root directory on the token device, wherein the any quantity of offline data entries are stored to the server computing device and not the token device.

11. The computer program product of claim 7, further comprising generating a unique compressed uniform resource locator (URL) each time a link, which corresponds to the compressed URL, is selected to open the root directory of private data in a browser.

12. The computer program product of claim 7, further comprising displaying a public storage, wherein the display of the public storage shows a total storage capacity that is less than the actual total storage capacity of the token device and the display of the public storage shows only the public data stored on the token device, wherein the token device is configured to alter how much of the total storage capacity is displayed for the public storage.

13. A token device for providing security to access and store data, comprising:

a private data conceal engine configured to transfer first information for display from the token device to a first computing device at a first time, the token device connected to the first computing device and the first information describing public data stored on the token device;

wherein the private data conceal engine is further configured to conceal second information that describes a plurality of directories of private data, wherein the second information is not displayed by the first computing device at the first time; and

an authentication engine configured to verify that a user has generated one or more names of one or more of the plurality of directories of private data, wherein the one or more names are used as one or more passwords to obtain the one or more of the plurality of directories, and wherein in response to the user generating the one or more names, the one or more of the plurality of directories are displayed by the first computing device at a second time.