Apparatus and method for securing data on a portable storage device

• US 20040103288A1
• Filed: 11/27/2002
• Published: 05/27/2004
• Est. Priority Date: 11/27/2002
• Status: Active Grant

• Current Assignee: Jpmorgan Chase Bank NA As The Agent
• Original Assignee: M-Systems Flash Disk Pioneers Ltd. (Western Digital Corporation)
• Inventors: Ziv, Aran, Bychkov, Eyal
• Granted Patent: US 7,478,248 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A portable storage device including a microprocessor and a secure user data area, the microprocessor operable to perform on-the-fly encryption/decryption of secure data stored on the storage device under a user password, the microprocessor also operable to exclude access to the secure user data area unless the user password is provided.

Claims

1. A secure portable storage device for securing user data under a clear key, the portable storage device being connectable to a host device, the host device selectably writing user data onto the portable storage device and reading user data from the portable storage device, the secure portable storage device comprising:

a. a storage medium including a secure user area; and

b. a microprocessor operable to use the clear key to decrypt data read from the secure user area and to encrypt data written onto the secure user area.

2. The secure portable storage device of claim 1, wherein said storage medium further includes a register for storing therein an encrypted key that has been encrypted from said clear key under a user password, and wherein said microprocessor is further operable to use the user password for decrypting the encrypted key to obtain said clear key prior to said use of said clear key.

3. The secure portable storage device of claim 1, wherein said microprocessor is further operable to exclude access from said host device to said secure user area unless a user password is provided to said microprocessor.

4. The secure portable storage device of claim 3, wherein said storage medium further includes a clear user area, and wherein said microprocessor is further operable to allow access from the host device to the clear user area without requiring entry of said user password.

5. The secure portable storage device of claim 3, wherein said storage medium further includes an offset register, and wherein said secure area is made accessible by said microprocessor by offsetting storage medium addresses by an offset value retrieved from the offset register upon receiving said user password.

6. The secure portable storage device of claim 5, wherein said offsetting takes place in cooperation with said microprocessor causing said host device to remount said secure portable storage device.

7. The secure portable storage device of claim 2, wherein said user password includes alphanumeric characters entered by the user.

8. The secure portable storage device of claim 2, wherein said user password includes biometric data.

9. The secure portable storage device of claim 3, wherein said storage medium further includes a user password register storing therein a hashed representation of said user password, and wherein said microprocessor is also operable to hash said user password.

10. A secure portable storage device for securing user data under a user password, the portable storage device being connectable to a host device, the host device selectably sending user data to be written onto the portable storage device and receiving user data read from the portable storage device, the secure portable storage device comprising:

a. a storage medium including a secure user area; and

b. a microprocessor operable to exclude access from the host device to the secure user area unless the user password is provided to the microprocessor.

11. The secure portable storage device of claim 10, wherein said storage medium further includes a clear user area, and wherein said microprocessor is further operable to allow access from said host device to the clear user area without requiring entry of said user password.

12. The secure portable storage device of claim 11, wherein said storage medium further includes an offset register, said secure user area made accessible via said microprocessor offsetting storage medium addresses by an offset valued retrieved from the offset register upon receiving said user password.

13. The secure portable storage device of claim 12, wherein said offsetting takes place in cooperation with said microprocessor causing said host device to remount said secure portable storage device.

14. The secure portable storage device of claim 10, wherein said user password includes alphanumeric data.

15. The secure portable storage device of claim 10, wherein said user password includes biometric data.

16. The secure portable storage device of claim 10, wherein said microprocessor is further operable to use a clear key to decrypt data read from said secure user area and encrypt data written onto said secure user area.

17. The secure portable storage device of claim 16, wherein said storage medium further includes a register for storing therein an encrypted key that has been encrypted from said clear key under said user password, and wherein said microprocessor is further operable to use said user password for decrypting the encrypted key to obtain said clear key prior to said using said clear key.

18. The secure portable storage device of claim 10, wherein said storage medium further includes a user password register storing therein a hashed representation of said user password, and wherein said microprocessor is also operable to hash said user password.

19. A method for using a user password for securing and accessing user data exchanged with a host device and stored in a portable storage device, the portable storage device including a microprocessor, the method comprising:

a. generating a secret key by;

operating the microprocessor to generate a random clear key,

operating the microprocessor to encrypt the clear key with the user password to obtain the secret key, and

storing the secret key within the portable storage device;

b. selectably storing first user data in the portable storage device by;

receiving the first user data from the host device,

retrieving the secret key from the portable storage device,

operating the microprocessor to decrypt the secret key with the user password to obtain the clear key, and

operating the microprocessor to encrypt the first user data and store the encrypted first user data within the portable storage device; and

c. selectably retrieving second encrypted user data from the portable storage device by;

reading second encrypted user data from the portable storage device,

retrieving the secret key from the portable storage device,

operating the microprocessor to decrypt the secret key with the user password to obtain the clear key, and

decrypting the second encrypted user data with the clear key and sending the decrypted second user data to the host device.

20. The method of claim 19, wherein said portable storage device further including a secure storage area and a register to contain a representation of the user password, the method further comprising:

d. selectably receiving an entered user password;

e. operating the microprocessor to check the entered user password against the representation of the user password, and then;

if the check is positive, operating the microprocessor to allow access to the secure storage area; and

if the check is negative, operating the microprocessor to exclude access from the secure storage area.

21. A method for using a user password for securing and accessing user data exchanged with a host device and stored in a portable storage device;

the portable storage device including a microprocessor, a secure storage area, and a register to contain a representation of the user password;

the method comprising;

a. selectably receiving an entered user password;

b. operating the microprocessor to check the entered user password against the representation of the user password, and then;

if the check is positive, operating the microprocessor to allow access, and

if the check is negative, operating the microprocessor to exclude access from the secure storage area.

22. The method of claim 21, wherein said portable storage device further includes a clear user area, the method further comprising operating the microprocessor to allow access to the clear user area if said selectably receiving an entered user password includes not receiving an entered user password.

23. The method of claim 21, wherein said portable storage device further includes a clear user area, the method further comprising operating the microprocessor to allow access to the clear user area if said check is negative.

24. The method of claim 21, further comprising:

c. generating a secret key by;

operating the microprocessor to generate a random clear key,

operating the microprocessor to encrypt the clear key with the user password to obtain the secret key, and

storing the secret key within the portable storage device;

d. selectably storing first user data in the portable storage device by;

receiving the first user data from the host device,

retrieving the secret key from the portable storage device,

operating the microprocessor to decrypt the secret key with the user password to obtain the clear key, and

operating the microprocessor to encrypt the first user data and store the encrypted first user data within the portable storage device; and

c. selectably retrieving second encrypted user data from the portable storage device by;

reading second encrypted user data from the portable storage device,

retrieving the secret key from the portable storage device,

operating the microprocessor to decrypt the secret key with the user password to obtain the clear key, and

decrypting the second encrypted user data with the clear key and sending the decrypted second user data to the host device.