SECURE DATA STORAGE AND RETRIEVAL INCORPORATING HUMAN PARTICIPATION

• US 20080320554A1
• Filed: 03/23/2007
• Published: 12/25/2008
• Est. Priority Date: 03/23/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Guarraci, Brian J., Medvinsky, Gennady, Dutta, Tanmoy, Baker, Arthur H., Tucker, Andrew Stewart
• Granted Patent: US 8,683,549 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A computer related security mechanism requires that a human participate in an access verification sequence. Upon a request to access secure data, a puzzle is provided to the requester. Proper solution of the puzzle requires human participation. The puzzle is chosen such that its solution is within the capabilities of a human, but beyond the current state of the art for computer systems. The puzzled can be visually and/or audibly rendered to the user. In one configuration, the puzzle is obtained via a library of pluggable puzzle generators. Puzzle generators in the library can be replaced as the state of the art of computing technology improves.

Claims

1. A computer related security method incorporating human participation, the method comprising:

receiving a request for data stored in a storage medium;

responsive to the request, providing a puzzle, wherein human participation is intended to obtain a solution to the puzzle;

receiving a proposed solution to the puzzle;

determining if the proposed solution is correct; and

if the proposed solution is correct, allowing access to the data stored in the storage medium.

2. A method in accordance with claim 1, further comprising, if an amount of time between providing the puzzle and receiving the proposed solution is greater than a predetermined amount of time, not allowing access to the data.

3. A method in accordance with claim 1, further comprising:

prior to receiving the proposed solution, requesting a first secret;

receiving the first secret;

subsequent to receiving the request for data, requesting a second secret;

receiving the second secret;

comparing the first secret with the second secret; and

if the first secret does not match the second secret, not allowing access to the data.

4. A method in accordance with claim 1, wherein:

the puzzle is intended to be visually rendered; and

a solution to the puzzle is intended to be obtained via observation of the visually rendering of the puzzle.

5. A method in accordance with claim 1, wherein:

the puzzle is intended to be audibly rendered; and

a solution to the puzzle is intended to be obtained via observation of the audio rendering of the puzzle.

6. A method in accordance with claim 1, further comprising obtaining the puzzle from a library of pluggable puzzle generators.

7. A method in accordance with claim 1, further comprising:

encrypting the data with a first cryptographic key;

encrypting the first cryptographic key with a second cryptographic key;

storing in the storage medium, the encrypted data and the encrypted first cryptographic key; and

if the proposed solution is correct;

decrypting, with the second cryptographic key, the encrypted first cryptographic key; and

providing the decrypted first cryptographic key.

8. A system for implementing computer related security incorporating human participation, the system comprising:

an input/output portion configured to;

receive a request for data stored in a memory portion;

responsive to the request, provide a puzzle, wherein human participation is intended to obtain a solution to the puzzle; and

receive a proposed solution to the puzzle;

a processing portion configure to;

determine if the proposed solution is correct; and

if the proposed solution is correct, allow access to the data stored in the memory portion; and

the memory portion configured to store the data.

9. A system in accordance with claim 8, wherein the processing portion if further configured to, if an amount of time between providing the puzzle and receiving the proposed solution is greater than a predetermined amount of time, not allow access to the data.

10. A system in accordance with claim 8, wherein:

the processing portion is further configured to;

prior to receiving the proposed solution, request a first secret;

subsequent to receiving the request for data, request a second secret;

compare the first secret with the second secret; and

if the first secret does not match the second secret, not allow access to the data; and

the input/output portion is further configured to;

receive the first secret; and

receive the second secret.

11. A system in accordance with claim 8, wherein:

the puzzle is intended to be visually rendered; and

a solution to the puzzle is intended to be obtained via observation of the visually rendering of the puzzle.

12. A system in accordance with claim 8, wherein:

the puzzle is intended to be audibly rendered; and

a solution to the puzzle is intended to be obtained via observation of the audio rendering of the puzzle.

13. A system in accordance with claim 8, the processing portion further configured to obtain the puzzle from a library of pluggable puzzle generators.

14. A system in accordance with claim 8, wherein:

the processing portion is further configured to;

encrypt the data with a first cryptographic key;

encrypt the first cryptographic key with a second cryptographic key;

store in the memory portion, the encrypted data and the encrypted first cryptographic key; and

if the proposed solution is correct, decrypt, with the second cryptographic key, the encrypted first cryptographic key; and

the input/output portion is further configured to provide the decrypted first cryptographic key.

15. A computer-readable medium having stored thereon computer-executable instructions for performing computer related security incorporating human participation, by performing the steps of:

receiving a request for data stored in a storage medium;

responsive to the request, obtaining a puzzle from a library of pluggable puzzle generators;

providing the puzzle, wherein human participation is intended to obtain a solution to the puzzle;

receiving a proposed solution to the puzzle;

determining if the proposed solution is correct; and

if the proposed solution is correct, allowing access to the data stored in the storage medium.

16. A computer-readable medium in accordance with claim 15, further comprising, if an amount of time between providing the puzzle and receiving the proposed solution is greater than a predetermined amount of time, not allowing access to the data.

17. A computer-readable medium in accordance with claim 15, further comprising:

prior to receiving the proposed solution, requesting a first secret;

receiving the first secret;

subsequent to receiving the request for data, requesting a second secret;

receiving the second secret;

comparing the first secret with the second secret; and

if the first secret does not match the second secret, not allowing access to the data.

18. A computer-readable medium in accordance with claim 15, wherein:

the puzzle is intended to be visually rendered; and

a solution to the puzzle is intended to be obtained via observation of the visually rendering of the puzzle.

19. A computer-readable medium in accordance with claim 15, wherein:

the puzzle is intended to be audibly rendered; and

a solution to the puzzle is intended to be obtained via observation of the audio rendering of the puzzle.

20. A computer-readable medium in accordance with claim 15, further comprising:

encrypting the data with a first cryptographic key;

encrypting the first cryptographic key with a second cryptographic key;

storing in the storage medium, the encrypted data and the encrypted first cryptographic key; and

if the proposed solution is correct;

decrypting, with the second cryptographic key, the encrypted first cryptographic key; and

providing the decrypted first cryptographic key.