Secure storage system and method of use

• US 20080155276A1
• Filed: 12/20/2006
• Published: 06/26/2008
• Est. Priority Date: 12/20/2006
• Status: Active Grant

• Current Assignee: Kingston Technology Corporation
• Original Assignee: Kingston Technology Corporation
• Inventors: Chen, Ben Wei, Chien, Yungteh
• Granted Patent: US 8,607,070 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 12/1491 in a hierarchical protection system, e.g. privilege levels, memory rings
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A secure storage system is disclosed. The secure storage system comprises a crypto engine and a storage device. The crypto engine comprises a random number generator; a hash function; a general encryption engine; and a data encryption engine. The secure storage system further includes a storage device coupled to the crypto engine. The storage device includes a storage array. The storage array includes a public partition, a secure partition and a system partition. The public partition is accessible to the public. The secure partition is accessible through the password authentication. The system partition is accessible only by the secure storage system. The password authentication is two-level instead of one, to avoid hash collision or insider tampering. The secure partition is accessed with “access gating through access key” instead of “access control through comparison.” The password can be changed without reformatting the secure storage.

Claims

1. A secure storage system comprising:

a crypto engine the crypto engine comprising a random number generator;

a hash function;

a general encryption engine;

a data encryption engine; and

a storage device coupled to the crypto engine;

the storage device including a storage array;

the storage array comprising a public partition, a secure partition and a system partition, wherein the public partition is accessible to the public, the secure partition is accessible through the password authentication and the system partition is accessible only by the secure storage system.

2. The secure storage system of claim 1 wherein the system partition is utilized to store a hashed password, an encrypted access key, a master hashed password, a master encrypted key and other data spaces.

3. The secure storage system of claim 2 wherein an access key within the system partition is generated by the random number generator and then encrypted to provide access gating to the secure partition.

4. The secure storage system of claim 2 wherein data can be recovered utilizing the master password.

5. The secure storage system of claim 2 wherein a two-level password authentication is utilized to allow the flow of data through the access gating.

6. The secure storage system of claim 5 wherein a first hashed password and a second hashed password are compared for the first level password authentication and the access key for the access gating serves as the second level password authentication.

7. The secure storage system of claim 2 wherein the data encryption engine is further utilized to process data between a host system and the secure storage system and provides protection from a brute force attack of multiple attempts to decrypt the data without a proper access key.

8. The secure storage system of claim 2 wherein a unique and secure access key is associated with the change of password without reformatting the secure storage.

9. The secure storage system of claim 2 wherein the master password is utilized to recover data in the secure storage system.

10. The secure storage system of claim 2 wherein a password request utility can be implemented through a standard browser interface on a universal host platform to call home and allow for a change in the user password or the master password.

11. A method for creating and storing passwords in a secure storage system comprising:

providing a user password from a host system;

retrieving a default master password from the secure storage system; and

hashing the user password and the default master password utilizing a hash function and encrypting an access key through an encryption engine utilizing the user password and the master password.

12. The method of claim 11 wherein the size of a secure partition in the secure storage system is defined by the user.

13. A method for password authentication in a storage system, the method comprising:

requesting a first password;

hashing the first password;

retrieving a second password from the secure storage system;

comparing the first and second password;

retrieving an original access key from the secure storage system if the first and second passwords match; and

retrieving an encrypted access key and utilizing the decrypted access key for gating to the secure partition

14. The method of claim 13 wherein a two-level password authentication is utilized to allow the flow of data through access gating.

15. The method of claim 14 wherein a first hashed password and a second hashed password are compared for the first level authentication and the access key for access gating services as the second level password authentication.

16. The method of claim 14 wherein the data encryption engine is further utilized to process data between a host system and the secure storage system and provides protection from a brute force attack of multiple elements to decrypt the data without a proper access key.

17. The method of claim 14 wherein a unique and secure access key is utilized to associate with the change of password without reformatting the secure storage.

18. The method of claim 14 wherein the master password is utilized to recover data in the secure storage system.

19. A processing system comprising:

a host system; and

a secure storage system in communication with the host system;

the secure storage system comprising a crypto engine;

the crypto engine comprising a random number generator;

a hash function;

a general encryption engine;

a data encryption engine; and

a storage device coupled to the crypto engine;

the storage device including a storage array;

the storage array comprising a public partition, a secure partition and a system partition, wherein the public partition is accessible to the public, the secure partition is accessible through the password authentication and the system partition is accessible only by the secure storage system.

20. The processing system of claim 19 wherein the system partition is utilized to store a hashed password, an encrypted access key, a master hashed password and a master encrypted key.

21. The processing system of claim 20 wherein an access key within the system partition is generated by the random number generator and then encrypted to provide access gating to the secure partition.

22. The processing system of claim 20 wherein data can be recovered utilizing the master password.

23. The processing system of claim 21 wherein a two-level password authentication is utilized to allow the flow of data through the access gating.

24. The processing system of claim 23 wherein a first hashed password and a second hashed password are compared for the first level password authentication and the access key for access gating serves as the second level password authentication.

25. The processing system of claim 24 wherein the data encryption engine is further utilized to process data between a host system and the secure storage system and provides protection from a brute force attack of multiple attempts to decrypt the data without a proper access key.

26. The processing system of claim 20 wherein a unique and secure access key is utilized to associate with the change of password without reformatting the secure storage.

27. The processing system of claim 20 wherein the master password is utilized to recover data in the secure storage system.

28. The processing system of claim 20 wherein a password request utility can be implemented through a standard browser interface on a universal host platform to call home and allow for a change in the user password or the master password.

29. A computer readable medium containing program instructions for creating and storing passwords in a secure storage system comprising:

providing a user password from a host system;

retrieving a default master password from the secure storage system; and

hashing the user password and the default master password utilizing a hash function and encrypting an access key through an encryption engine utilizing the user password and the master password.

30. A computer readable medium containing program instructions for password authentication in a storage system, the method comprising:

requesting a first password;

hashing the first password;

retrieving a second password from the secure storage system;

comparing the first and second password;

retrieving an original access key from the secure storage system if the first and second passwords match; and

retrieving an encrypted access key and utilizing the decrypted access key for gating to the secure partition.