# US 10,374,806 B2 · 2-factor authentication for network connected storage device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,374,806 B2
- Document ID: US10374806B2
- Status: Granted
- Kind: B2
- Application number: 16/069,843
- Filed: 2017-01-13
- Published: 2019-01-31
- Granted: 2019-08-06
- Earliest claimed: 2016-01-13
- Assignees: Hiddn Security AS
- Applicants: Hiddn Security AS
- Inventors: Erik Solhjell; Atle Haga
- Web page: https://patentgrep.com/patent/US10374806B2

## CPC

- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- G06F 21/31: User authentication
- G06F 21/35: communicating wirelessly
- G06F 21/575: {Secure boot}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0822: {using key encryption key}
- H04L 9/0827: {involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- G06F 2221/2107: File encryption
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- G06F 2221/2139: Recurrent verification
- H04L 2209/80: Wireless
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present invention relates to a method and system for 2-factor authentication for access to an encrypted storage device in a computer based on the use of a second communication unit, such as a smart mobile phone, and a network connected server. The second communication unit is configured for receiving an encryption control app for storage of an encrypted key file and for receiving a user PIN. The computer includes an encryption module which receives and decrypts the encrypted key file from the second communication unit for activation of encryption and decryption modules.

## Claims

### Claim 1

A method for 2-factor authentication for access to an encrypted storage device in a computer system, the method comprising the steps, in response to initiating the computer for the encryption of the storage device, of:
downloading from a network connected server an encryption control application (ECA) to a smart mobile phone (SMP);
activating the ECA;
establishing, by the ECA, a short range communication connection to the computer comprising an encryption module (CM);
retrieving by the ECA from the computer, a unique ID, and then transferring the unique ID to the network connected server;
receiving, by the SMP, an activation code from the network connected server, and the SMP transferring the activation code to the computer;
receiving a Master Password and a PIN code from a user at the SMP, and the ECA transferring the Master Password and the PIN code to the CM;
generating, by the CM, a Key File comprising encryption keys to be used by the CM in encryption and decryption operations, and then encrypting the Key File using the Master Password as a first encryption key, and then encrypting, by the CM, the Master Password using the PIN code as a second encryption key;
transferring the encrypted Key File to the SMP;
storing the encrypted Key File within the SMP;
deleting the Key File and the Master Password in the computer;
storing the encrypted Master Password in the computer; and the method further comprising the steps of, in response to the computer is attempted to be started up on subsequent occasions after the initiation of the computer for the encryption of the storage device:
transferring the stored encrypted Key File from the SMP to the CM;
receiving the PIN code at the SMP;
transferring the PIN code from the SMP to the CM;
decrypting, by the CM, the encrypted Master Password stored in the computer using the PIN code transferred from the SMP as the second encryption key;
decrypting, by the CM, the stored encrypted Key File transferred from the SMP using the decrypted Master Password as the first encryption key;
activating, by the CM, encryption and decryption modules with the encryption keys from the decrypted Key File; and
deleting, by the computer, the stored encrypted Key File transferred from the SMP and the decrypted Master Password.

### Claim 2 (depends on 1)

The method according to claim 1, further comprising initiating and receiving, by the network connected server, a payment from the user before the receiving of the activation code by the SMP.

### Claim 3 (depends on 1)

The method according to claim 1, further comprising transferring, by the computer system, the Key File encrypted by the CM or both the Key File encrypted by the CM and the encrypted Master Password, to a connected Smart Card.

### Claim 4 (depends on 1)

The method according to claim 1, further comprising booting the computer with encrypted storage device when an initiating procedure has been successfully performed, and booting the computer with an unencrypted storage device when the initiating procedure has not been performed or was unsuccessfully performed.

### Claim 5 (depends on 1)

The method according to claim 1, further comprising booting the computer with an encrypted storage device when the 2-factor authentication has been successfully performed, and failing to boot the computer in response to one or more of the following steps occur:
the SMP is not running with the ECA,
a wrong encrypted Key File has been transferred to the CM, or
a wrong PIN code has been transferred to the CM.

### Claim 6 (depends on 1)

The method according to claim 1, in response to the CM is running, further comprising subsequently terminating an operation once an embedded encryption control code (ECC) in the CM via a first short range communication interface (SRCI) comprised in the computer loses contact for longer than a preset timer value with the ECA in the SMP via a second short range communication interface, SRCI, comprised in the SMP.

### Claim 7

A system for 2-factor authentication for access to an encrypted storage device in a computer, comprising:
an encryption control application (ECA);
one or more storage devices (SDs);
one or more encryption modules (CMs) for encryption/decryption of data to/from the one or more SDs;
a smart mobile phone (SMP);
a network connected server for transferring an activation code to the SMP via a communication channel, wherein the SMP is in communication contact with the network connected server for receiving the activation code; and
wherein the system is configured to perform, in response to initiating the computer for the encryption of the storage device, the steps of:
activating the ECA;
establishing, by the ECA, a short range communication connection to the computer comprising a CM of the one or more CMs;
retrieving by the ECA from the computer, a unique ID, and then transferring the unique ID to the network connected server;
receiving, by the SMP, the activation code from the network connected server, and the SMP transferring the activation code to the computer;
receiving a Master Password and a PIN code from a user at the SMP, and the ECA transferring the Master Password and the PIN code to the CM;
generating, by the CM, a Key File comprising encryption keys to be used by the CM in encryption and decryption operations, and then encrypting the Key File using the Master Password as a first encryption key, and then encrypting, by the CM, the Master Password using the PIN code as a second encryption key;
transferring the encrypted Key File to the SMP;
storing the encrypted Key File within the SMP;
deleting the Key File and the Master Password in the computer;
storing the encrypted Master Password in the computer; and
in response to the computer is attempted to be started up on subsequent occasions after the initiation of the computer for the encryption of the storage device:
transferring the stored encrypted Key File from the SMP to the CM;
receiving the PIN code at the SMP;
transferring the PIN code from the SMP to the CM;
decrypting, by the CM, the encrypted Master Password stored in the computer using the PIN code transferred from the SMP as the second encryption key;
decrypting, by the CM, the stored encrypted Key File transferred from the SMP using the decrypted Master Password as the first encryption key;
activating, by the CM, encryption and decryption modules with the encryption keys from the decrypted Key File; and
deleting, by the computer, the stored encrypted Key File transferred from the SMP and the decrypted Master Password.

### Claim 8 (depends on 7)

The system according to claim 7, wherein the computer and the SMP each comprises short range communication interfaces (SRCI) for communication between the computer and the SMP.

### Claim 9 (depends on 7)

The system according to claim 7, wherein a communication channel between the computer system and the SMP is an encrypted communication channel.

### Claim 10 (depends on 7)

The system according to claim 7, wherein the communication channel between the network connected server and the SMP is Internet.

### Claim 11 (depends on 7)

The system according to claim 7, wherein the communication channel between the network connected server and the SMP is an encrypted communication channel.

### Claim 12 (depends on 7)

The system according to claim 7, further comprises:
a smart card including a smartcard interface for transferring the Key File encrypted by the CM using the Master Password as the first encryption key from the one or more CMs associated with the one or more SDs to the smart card via the smart card interface.

### Claim 13 (depends on 7)

The system according to claim 7, wherein the computer is further connected to a second computer, the second computer using the computer as an external unit/disk system once the external unit/disk system has been authenticated and activated.