Mass storage device with automated credentials loading

• US 7,748,031 B2
• Filed: 12/27/2005
• Issued: 06/29/2010
• Est. Priority Date: 07/08/2005
• Status: Active Grant

• Current Assignee: SanDisk Technologies LLC (Western Digital Corporation)
• Original Assignee: SanDisk Corporation (Western Digital Corporation)
• Inventors: Gonzalez, Carlos J., Jogand-Coulomb, Fabrice, Ferchau, Joerg
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/319,835
• Publication Number:
  US 20070011724A1
• Time in Patent Office: 1,645 Days
• Field of Search: None
• US Class Current: 726/9
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06K 19/07 with integrated circuit chips
• CPC Class Codes: G06K 19/07732 the record carrier having a housing or construction similar to well-known portable memory devices, such as SD cards, USB or memory sticks housings for electrical equipment in general, see H05K5/02
• CPC Class Codes: G11C 7/24 Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A portable mass storage device for use in two factor authentication systems and methods. A secure portable mass storage device protects content from being freely copied with security mechanisms and firmware. The security functionality also protects confidential user credentials and passwords, as well as algorithms and seeds needed for two factor authentication or asymmetric authentication methods. A client application residing in the mass storage device acts as both a password manager and an authentication manager that seamlessly performs the authentication procedures in the background while signing a user into various institutions of his choosing. A very high level of security is integrated into a mass storage device the user has for purposes other than two factor authentication, and the convenience of highly secure password management also comes in a convenient pocket sized package easy for the user to transport. This facilitates the acceptance of two factor authentication, and increases security for a wide variety of online transactions.

Claims

1. A portable device capable of mass storage of user files and of user credential management, the portable device having a physical interface for removably coupling the device to a host device, and comprising:

mass storage solid state memory used to store user files and programs;

a micro controller that controls read and write operations of the mass storage solid state memory;

a one time password generator;

a client application residing in the mass storage solid state memory, the client application executable by a processor of the host to retrieve a one time password from the password generator of the device; and

a first seed and counter pair,

the first pair to authenticate the device to a first institution, wherein the portable device comprises a portable memory card or a portable USB drive, wherein the client application is launched, wherein the client application is executed by the processor of the host, and wherein the one time password generator is implemented within the portable device and generates the one time password within the portable device in response to the request.

2. A system for controlling access to data sites, the system comprising:

a mass storage device that can be removably coupled to a host computing device, wherein the mass storage device comprises a portable memory card or a portable USB drive;

a first electronic entity that loads a seed and a device identifier to the host computing device and mass storage device, while the mass storage device is coupled to the host computing device;

a one time password generator implemented within the portable mass storage device;

a client application; and

a second electronic entity with which the mass storage device passes a user identifier of a user of the mass storage device, the device identifier, and a one time password value, wherein the client application is launched, wherein the client application is executed by a processor of the host computing device, wherein the client application sends a request to the mass storage device, and wherein the one time password value is generated within the portable device by the one time password generator in response to the request.

3. The system of claim 2, further comprising a third electronic entity, and wherein the second electronic entity passes the user identifier and one time password value to the third electronic entity for verification of the user and mass storage device.

4. The system of claim 3, wherein the third electronic entity provides an indicator of whether verification was successful or unsuccessful.

5. The system of claim 2, wherein said first electronic entity is operable to establish a secure channel with the mass storage device and to load the seed and identifier over the secure channel.

6. The system of claim 2, further comprising an additional mass storage device, the system operable to transfer authentication rights from one mass storage device to another mass storage device.

7. The system of claim 6, wherein the authentication rights comprise the device identifier and the seed.

8. The system of claim 7, wherein transferring the authentication rights comprises transferring the seed and the device identifier.

9. The system of claim 8, wherein the first electronic entity transfers the authentication rights to the additional mass storage device.

10. The system of claim 9, wherein the system establishes a secure channel with the additional mass storage device and the transfer is completed over the secure channel.

11. The system of claim 6, wherein the system is further operable to remove the authentication rights from the device where the rights are transferred from.

12. The system of claim 11, wherein the authentication rights are removed upon successful verification of the user of the mass storage device where the rights are transferred from.

13. The system of claim 11, wherein the system is further operable to remove the device that had the authentication rights removed from a list of inactive devices.

14. The system of claim 2, wherein upon loss of the mass storage device by the user of the device the system is operable to invalidate the seed and identifier of the device at one or more of the electronic entities.

15. The system of claim 14, wherein upon loss of the mass storage device the identifier and seed of the lost device is transferred to a new device of the user.

16. The system of claim 14, wherein upon loss of the mass storage device a new identifier and seed are transferred to a new device of the user.

17. A portable device capable of mass storage of user files and of user credential management, the portable device having a physical interface for removably coupling the device to a host device, and comprising:

mass storage solid state memory used to store user files and programs;

a micro controller that controls read and write operations of the mass storage solid state memory;

a one time password generator;

an application residing in the mass storage solid state memory, the application executable by a processor of the host to retrieve a one time password from the password generator of the device; and

a first seed and counter pair,

the first pair to authenticate the device to a first institution, wherein the portable device comprises a portable memory card or a portable USB drive and wherein the one time password generator is implemented within the portable device and generates the one time password within the portable device, wherein the application is configured to present to the user plural institutions for the user to access and wherein the one time password generator is configured to generate one time passwords for each of the institutions.

18. A system for controlling access to data sites, the system comprising:

a mass storage device that can be removably coupled to a host computing device, wherein the mass storage device comprises a portable memory card or a portable USB drive;

a first electronic entity that loads a seed and a device identifier to the host computing device and mass storage device, while the mass storage device is coupled to the host computing device;

a one time password generator implemented within the portable mass storage device; and

a second electronic entity with which the mass storage device passes a user identifier of a user of the mass storage device, the device identifier, and a one time password value, wherein the one time password value is generated within the portable device by the one time password generator, wherein the mass storage device includes an application launched from the mass storage device, executable by the host computing device, and configured to present to the user plural institutions for the user to access and wherein the one time password generator is configured to generate one time password values for each of the institutions.