Back to results
US 10,374,806 B2Granted
2-factor authentication for network connected storage device
AssigneeHiddn Security AS
InventorsErik Solhjell, Atle Haga
Life of this patent
Estimating the term…
Abstract
The present invention relates to a method and system for 2-factor authentication for access to an encrypted storage device in a computer based on the use of a second communication unit, such as a smart mobile phone, and a network connected server. The second communication unit is configured for receiving an encryption control app for storage of an encrypted key file and for receiving a user PIN. The computer includes an encryption module which receives and decrypts the encrypted key file from the second communication unit for activation of encryption and decryption modules.
Claims13
A method for 2-factor authentication for access to an encrypted storage device in a computer system, the method comprising the steps, in response to initiating the computer for the encryption of the storage device, of:
- downloading from a network connected server an encryption control application (ECA) to a smart mobile phone (SMP);
- activating the ECA;
- establishing, by the ECA, a short range communication connection to the computer comprising an encryption module (CM);
- retrieving by the ECA from the computer, a unique ID, and then transferring the unique ID to the network connected server;
- receiving, by the SMP, an activation code from the network connected server, and the SMP transferring the activation code to the computer;
- receiving a Master Password and a PIN code from a user at the SMP, and the ECA transferring the Master Password and the PIN code to the CM;
- generating, by the CM, a Key File comprising encryption keys to be used by the CM in encryption and decryption operations, and then encrypting the Key File using the Master Password as a first encryption key, and then encrypting, by the CM, the Master Password using the PIN code as a second encryption key;
- transferring the encrypted Key File to the SMP;
- storing the encrypted Key File within the SMP;
- deleting the Key File and the Master Password in the computer;
- storing the encrypted Master Password in the computer;
- and the method further comprising the steps of, in response to the computer is attempted to be started up on subsequent occasions after the initiation of the computer for the encryption of the storage device:
- transferring the stored encrypted Key File from the SMP to the CM;
- receiving the PIN code at the SMP;
- transferring the PIN code from the SMP to the CM;
- decrypting, by the CM, the encrypted Master Password stored in the computer using the PIN code transferred from the SMP as the second encryption key;
- decrypting, by the CM, the stored encrypted Key File transferred from the SMP using the decrypted Master Password as the first encryption key;
- activating, by the CM, encryption and decryption modules with the encryption keys from the decrypted Key File;
- and
- deleting, by the computer, the stored encrypted Key File transferred from the SMP and the decrypted Master Password.
17 more elements
A system for 2-factor authentication for access to an encrypted storage device in a computer, comprising:
- an encryption control application (ECA);
- one or more storage devices (SDs);
- one or more encryption modules (CMs) for encryption/decryption of data to/from the one or more SDs;
- a smart mobile phone (SMP);
- a network connected server for transferring an activation code to the SMP via a communication channel, wherein the SMP is in communication contact with the network connected server for receiving the activation code;
- and
- wherein the system is configured to perform, in response to initiating the computer for the encryption of the storage device, the steps of:
- activating the ECA;
- establishing, by the ECA, a short range communication connection to the computer comprising a CM of the one or more CMs;
- retrieving by the ECA from the computer, a unique ID, and then transferring the unique ID to the network connected server;
- receiving, by the SMP, the activation code from the network connected server, and the SMP transferring the activation code to the computer;
- receiving a Master Password and a PIN code from a user at the SMP, and the ECA transferring the Master Password and the PIN code to the CM;
- generating, by the CM, a Key File comprising encryption keys to be used by the CM in encryption and decryption operations, and then encrypting the Key File using the Master Password as a first encryption key, and then encrypting, by the CM, the Master Password using the PIN code as a second encryption key;
- transferring the encrypted Key File to the SMP;
- storing the encrypted Key File within the SMP;
- deleting the Key File and the Master Password in the computer;
- storing the encrypted Master Password in the computer;
- and
- in response to the computer is attempted to be started up on subsequent occasions after the initiation of the computer for the encryption of the storage device:
- transferring the stored encrypted Key File from the SMP to the CM;
- receiving the PIN code at the SMP;
- transferring the PIN code from the SMP to the CM;
- decrypting, by the CM, the encrypted Master Password stored in the computer using the PIN code transferred from the SMP as the second encryption key;
- decrypting, by the CM, the stored encrypted Key File transferred from the SMP using the decrypted Master Password as the first encryption key;
- activating, by the CM, encryption and decryption modules with the encryption keys from the decrypted Key File;
- and
- deleting, by the computer, the stored encrypted Key File transferred from the SMP and the decrypted Master Password.
24 more elements
Dependencies are inferred from the claim text.