Secure mobile device with online vault

• US 20090228714A1
• Filed: 03/24/2009
• Published: 09/10/2009
• Est. Priority Date: 11/18/2004
• Status: Abandoned Application

• Current Assignee: Biogy, Inc.
• Original Assignee: Biogy, Inc.
• Inventors: Barangan, Alex, Fiske, Michael Stephen
• Application Number:
  US12/383,561
• Publication Number:
  US 20090228714A1
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G07C 9/00912 for safes, strong-rooms, vaults or the like
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Encrypted data is stored in an online vault. The data in the online vault requires one key from the user and one key from an administrator to decrypt the data. In an embodiment, the key from the user may be stored in a secure area of a portable device. In an embodiment, the key for the administrator is unique to the user. In an embodiment, a backup key is stored in a secure area in the portable device, and the users key may be constructed by applying a function to the backup key.

Claims

1. A security system comprising:

a machine having a computer-readable medium storing

an online vault including at least encrypted data, and

machine instructions for accessing the online vault via an Internet, and requiring at least independent two codes for decrypting the encrypted data;

the machine including a processor system that is configured to run the machine instructions for accessing the online vault via the Internet; and

for requiring the at least two codes.

2. The system of claim 1, wherein one independent code is not available online.

3. The system of claim 2 wherein one independent code is located on a mobile device.

4. The system of claim 3 wherein the mobile device is a mobile phone.

5. The system of claim 1 wherein one independent code, referred to as a vault code, is only accessible via the vault.

6. The system of claim 5 wherein the vault code is transmitted from the vault to a mobile device.

7. The system of claim 6 wherein public cryptography is used to securely transmit the vault code to the mobile device.

8. The system of claim 6 wherein public cryptography is used to securely transmit some of the encrypted data at the vault to the mobile device.

9. The system of claim 5 wherein the vault code is only transmitted to a mobile device after receiving a valid authentication from the mobile device.

10. The system of claim 9 wherein the valid authentication is a temporary passcode sent from the mobile device to the online vault.

11. The system of claim 1 wherein one of the independent codes is a cryptography key.

12. The system of claim 1 wherein one of the independent codes is a code stored on paper.

13. A secure mobile device comprising:

an acquisition mechanism;

a computer readable medium storing thereon

encrypted data that requires one or more authentication factors obtained by the acquisition mechanism on the mobile device;

the factors are transmitted to, and authenticated by, a hardware chip inside the device before access to the device is enabled.

14. The device of claim 13 wherein the hardware chip contains firmware to receive and validate the authentication factors, and the hardware chip does not execute an operating system.

15. The device of claim 13 wherein one of the authentication factors is a biometric print.

16. The device of claim 13 wherein one of the authentication factors is a password.

17. The device of claim 13 wherein one of the authentication factors is a Personal Identification Number (PIN).

18. The device of claim 13 wherein one of the authentication factors is an image.

19. The device of claim 13 wherein the user key for decrypting the data on the device is only generated after authentication factors are processed by the hardware chip.

20. The device of claim 19 wherein a vault key is also needed to decrypt the data, the vault key is an independent code that is only accessible via the vault.

21. The device of claim 20 wherein a temporary code must be sent from the mobile device to the vault and verified by the vault before the vault key is sent to the device.

22. The device of claim 20 wherein the vault key for each user is unique.

23. The device of claim 22 wherein public key cryptography is used to encrypt the vault key before sending it to the device.

24. The device of claim 22 wherein the temporary code is generated on said chip only after a valid authentication of authentication factors is determined by said chip.

25. The device of claim 13 wherein it contains a phone or flash memory.

26. The device of claim 13 wherein if said device contains a different chip executing an operating system, this chip does not have access to any user information received by the acquisition mechanism.

27. The device of claim 13, the hardware chip being a processor having firmware;

the computer readable medium including machine instructions, which when implemented by the processor causes the processor to generate a key after authenticating the biometric print;

the device further comprising a hardware encryption controller;

the firmware including at least a portion which when implemented cause the key to be sent from the processor to the hardware encryption controller.