US20160259736A1 - Encryption bridge system and method of operation thereof - Google Patents

Abstract

A self-authenticating encryption bridge, and method of operation thereof, including: a user input module for remaining locked until a user has been authenticated; an encryption/decryption control module responsive to the user input module for encrypting or decrypting data when the user has been authenticated; a first communication channel for transferring encrypted data from a mass storage device to the encryption/decryption control module; and a second communication channel for transferring clear data to a computer from the encryption/decryption control module.

Description

CROSS-REFERENCE TO RELATED APPLICATION(S)
• This application is a Continuation of U.S. patent application Ser. No. 12/684,108 filed Jan. 7, 2010, which claims the benefit of U.S. Provisional Patent Application Ser. No. 61/143,155 filed Jan. 7, 2009, and the subject matter thereof is incorporated herein by reference thereto.
• The present application contains subject matter related to co-pending U.S. patent application Ser. No. 12/652,035 filed Jan. 4, 2010. The related application is assigned to ClevX, LLC and the subject matter thereof is incorporated herein by reference thereto.
TECHNICAL FIELD
• The present invention relates generally to mass storage devices, and more specifically to an apparatus and method of controlling encryption between a host computer system and a mass storage device.
BACKGROUND ART
• A critical issue with almost all aspects of computer system and mobile electronic device use, including portable memory storage, is security. This also applies to electronic products containing memory storage as an integral part of the design. For example, digital cameras, MP3 players, smart phones, palm computers, gaming devices, etc., that may have confidential information residing in memory. Whether it is an email account, financial information or corporate data, a user must be authenticated in order to gain access to this information.
• Encryption is typically the means to hide sensitive information. It is a complex process that hides data so that it cannot be interpreted until a correct decryption key is used to decode the data. A computer is generally used to access data in internal as well as external mass storage devices. Data is encrypted prior to storing and decrypted upon retrieval.
• Encryption, provided by a computer, consumes system resources whether the encryption is applied to internal or external storage devices. Thus, the computer requires higher performance hardware to reduce system burden. A better solution is to put the burden of encryption on the mass storage device to free up computer resources. It then becomes a simple matter of connecting the mass storage device to the computer with no complex formatting and partitioning required on the computer end.
• There are few self-encrypting mass storage devices on the market. If a user already has a mass storage device, the user must either purchase a new self-encrypting drive or purchase encryption software for the user's computer. Self-encrypting drives are typically more expensive than their non-encrypting counterparts.
• An encryption bridge may be used to connect a computer with an external mass storage device reduces the burden on computer resources and is more cost effective than purchasing multiple self-encrypting drives but allows access to secured data just by having possession of the encryption bridge.
• Solutions to these problems have been long sought but prior developments have not taught or suggested any solutions and, thus, solutions to these problems have long eluded those skilled in the art.
DISCLOSURE OF THE INVENTION
• The present invention provides a method of operation of a self-authenticating encryption bridge including: locking a user input module until a user has been authenticated; encrypting or decrypting data in an encryption/decryption control module when the user has been authenticated in the user input module; transferring encrypted data from a mass storage device to the encryption/decryption control module in a first communication channel; and transferring clear data to a computer from the encryption/decryption control module in a second communication channel.
• The present invention further provides a self-authenticating encryption bridge including: a user input module for remaining locked until a user has been authenticated; an encryption/decryption control module responsive to the user input module for encrypting or decrypting data when the user has been authenticated; a first communication channel for transferring encrypted data from a mass storage device to the encryption/decryption control module; and a second communication channel for transferring clear data to a computer from the encryption/decryption control module.
• Certain embodiments of the invention have other aspects in addition to or in place of those mentioned above. The aspects will become apparent to those skilled in the art from a reading of the following detailed description when taken with reference to the accompanying drawings.
BRIEF DESCRIPTION OF THE DRAWINGS
• FIG. 1 is a block diagram of the components of an encryption bridge system in accordance with an embodiment of the present invention.
• FIG. 2 is a block diagram of a self-authenticating encryption bridge in accordance with a further embodiment of the present invention.
• FIG. 3 shows a flow chart of a method for validating a user and transferring data in accordance with a still further embodiment of the present invention.
• FIG. 4 shows a block diagram of a self-authenticating encryption bridge with multiple encryption keys in accordance with an additional embodiment of the present invention.
• FIG. 5 is a block diagram of a mass storage device with an integrated self-authenticating encryption bridge in accordance with a further additional embodiment of the present invention.
• FIG. 6 is a flow chart of a method of operation of an encryption bridge system in a further embodiment of the present invention.
BEST MODE FOR CARRYING OUT THE INVENTION
• The following embodiments are described in sufficient detail to enable those skilled in the art to make and use the invention. It is to be understood that other embodiments would be evident based on the present disclosure, and that process or mechanical changes may be made without departing from the scope of the present invention.
• In the following description, numerous specific details are given to provide a thorough understanding of the invention. However, it will be apparent that the invention may be practiced without these specific details. In order to avoid obscuring the present invention, some well-known circuits, system configurations, and process steps are not disclosed in detail.
• Likewise, the drawings showing embodiments of the apparatus/device are semi-diagrammatic and not to scale and, particularly, some of the dimensions are for clarity of presentation and are shown greatly exaggerated in the drawing FIGS.
• Similarly, the drawings generally show similar orientations of embodiments for ease of description, but this is arbitrary for the most part. Generally, the various embodiments can be operated in any orientation.
• Referring now toFIG. 1, therein is shown a block diagram of the components of anencryption bridge system100 in accordance with an embodiment of the present invention. Theencryption bridge system100 is composed of a self-authenticating encryption bridge102 connected to ahost computer system104 on an unencrypted or a cleardata communication channel106 and to a storage system such as amass storage device108 on anencrypted data channel110.
• Thehost computer system104 sends unencrypted data to the self-authenticatingencryption bridge102. The data is intended to be stored on themass storage device108. The self-authenticating encryption bridge102 encrypts the data and forwards it on to themass storage device108.
• Likewise, themass storage device108 sends data to the self-authenticating encryption bridge102 intended to be received by thehost computer system104. The self-authenticating encryption bridge102 decrypts the data and forwards it on to thehost computer system104.
• The self-authenticating encryption bridge102 remains locked until an authorized user has been authenticated. The users must interact with the self-authenticatingencryption bridge102 in order to validate themselves as authorized users and enable the encryption/decryption process.
• If the self-authenticating encryption bridge102 is unable to authenticate the user, encrypted data is sent directly to thehost computer system104 where it will be useless because thehost computer system104 will not be able to decipher the encrypted data from themass storage device108.
• Referring now toFIG. 2, therein is shown a block diagram of a self-authenticating encryption bridge200 in accordance with a further embodiment of the present invention. The self-authenticating encryption bridge200 is a bridge than can be used to identify one or more users and is composed of two modules: an encryption/decryption control module202 (shortened to encryption control module in the FIGS.) and a user input module204.
• Within the encryption/decryption control module202 is anauthentication parameter module206 for releasing an encryption key in anencryption key module208.
• The user must identify himself or herself by entering authentication information using the user input module204. The authentication information can be a PIN (Personal Identification Number), radio frequency, light, biosignature, or other signal entered wirelessly or by wire to the user input module204. Then, the encryption/decryption control module202 verifies a user's identity against authentication parameters in theauthentication parameter module206. The verification process involves theauthentication parameter module206 providing a signal with authentication parameters to the user input module204 for comparison by the user input module204.
• If the user is authenticated when the signals for the authentication information and the authentication parameters match, the user input module204 unlocks and causes the release of the encryption key in the encryptionkey module208 to the encryption/decryption control module202. The encryption/decryption control module202 then encrypts data moving wirelessly or by wire from thehost computer system104 ofFIG. 1 through the cleardata communication channel106 to themass storage device108 ofFIG. 1 through theencrypted data channel110 and decrypts data wirelessly or by wire moving in the reverse direction. The encryption/decryption control module202 also uses the encryption key in the encryptionkey module208 to decrypt data moving from themass storage device108 to thehost computer system104.
• The user input module204 supplies the authentication interface between the user and the encryption/decryption control module202. For example, the user input module204 may consist of a series of buttons, that when pushed in certain order by a user, allow the encryption/decryption control module202 to authenticate the user. In one embodiment, the series of numerical buttons allows a user to enter a personal identification number (PIN), which can then be compared against a PIN, which is one of the numbers stored in theauthentication parameter module206.
• The user input module204 is used herein as a general term that encompasses any number of human input mechanisms that can interact with the user. Examples of these mechanisms are:
• Buttons—for entering a series of numbers like an ATM machine
• Thumb-wheel—for entering a series of numbers like a combination lock
• Fingerprint reader—for receiving and analyzing a user's fingerprint (or other biometric based input devices)
• RF module—for receiving an authentication signal from a key fob.
• The above is exemplary and not intended to be limiting.
• Referring now toFIG. 3, therein is shown aflow chart300 of a method for validating a user and transferring data in accordance with a still further embodiment of the present invention. The data flows between themass storage device108 and thehost computer system104 ofFIG. 1.
• The method starts when the user input module accepts input from a user in ablock302. From the above list of mechanisms, this can be a combination, PIN, fingerprint, etc. The encryption/decryption control module then verifies data sent from the user input module and compares this with an authentication parameter in the authentication parameter module in a block304.
• A check is then made to determine if the authentication parameter matches those supplied by the user in adecision block306. If YES, the encryption/decryption control module enables the encryption/decryption process and the mass storage device becomes accessible by the host computer system in ablock308. If NO, the self-authenticating encryption bridge remains locked and the method returns to user input module accepts input in theblock302.
• The self-authenticating encryption bridge waits for data sent either from the host computer system or the mass storage device in ablock310. Once the self-authenticating encryption bridge receives data, a decision is made if the data was sent from the host computer system in adecision block312.
• If data is received from the host computer system, the self-authenticating encryption bridge encrypts the data in ablock318 and sends the encrypted data on to the mass storage device in ablock320. If data is received from the mass storage device, the self-authenticating encryption bridge decrypts the data in ablock322 and sends it on to the host computer system in ablock324.
• From theblock320 or324, the method returns to the self-authenticating encryption bridge waits for data in theblock310.
• Referring now toFIG. 4, therein is shown a block diagram of a self-authenticatingencryption bridge400 with multiple encryption keys in accordance with an additional embodiment of the present invention.
• In the self-authenticatingencryption bridge400, a user may enter a first code, PIN A, in auser input module402 for an encryption/decryption control module404. The PIN A is associated with an authenticationparameter A module406. After a user is authenticated, the self-authenticatingencryption bridge400 is unlocked and an encryptionkey A module408 allows access to an encryption key A available for the encryption/decryption process. An encryptionkey B module410 remains inaccessible.
• Likewise, a user may enter the PIN B to unlock the self-authenticatingencryption bridge400. The PIN B is associated with an authenticationparameter B module412. After the user is authenticated, the self-authenticatingencryption bridge400 is unlocked and the encryptionkey B module410 allows access to an encryption key B to be used for the encryption/decryption process. The encryptionkey A module408 remains inaccessible.
• In this manner, a single self-authenticating encryption bridge may support multiple encryption keys for multiple users and multiple mass storage devices.
• Another embodiment includes an encryption/decryption control module containing a single encryption key associated with multiple authentication parameter modules. In this embodiment, multiple users with different codes may access the same mass storage device.
• Referring now toFIG. 5, therein is shown a block diagram of amass storage device500 with an integrated self-authenticatingencryption bridge502 in accordance with a further additional embodiment of the present invention.
• The integrated self-authenticatingencryption bridge502 is housed within the same package as themass storage device500. Anencrypted data channel504 is internal to themass storage device500 and connects internally with astorage media506. Aclear data channel508 connects the integrated self-authenticatingencryption bridge502 to thehost computer system104.
• A user input module510 is integral with the package of themass storage device500. Since the integrated self-authenticatingencryption bridge502 is embedded within themass storage device500, the user input module510 is placed so codes may be entered from outside themass storage device500. Thus, all possible modes of user input, as discussed inFIG. 2, are made available for themass storage device500.
• Referring now toFIG. 6, therein is shown a flow chart of amethod600 of operation of anencryption bridge system100 in a further embodiment of the present invention. Themethod600 includes: authenticating a user using a self-authenticating encryption bridge in ablock602; and controlling encryption using the self-authenticating encryption bridge disposed between a computer system and a storage system in response to the authenticating of the user in ablock604.
• Various embodiments of the present invention include the following aspects:
• An encryption bridge system including:
• providing a computer connected by way of a communication channel to the self-authenticating encryption bridge;
  a mass storage device connected by way of a communication channel to the self-authenticating encryption bridge; and
  a self-authenticating encryption bridge that encrypts data sent from the computer to the mass storage device and decrypts data sent from the mass storage device to the computer after a user has been authenticated.
• A self-authenticating encryption bridge including:
• a user input module for verifying user identity;
  an encryption/decryption control module;
  a communication channel for transferring clear data to the computer; and
  a communication channel for transferring encrypted data to the mass storage device.
• A self-authenticating encryption bridge as described above further including:
• authentication parameters for authenticating a user; and
  encryption key(s) used for encrypting/decrypting data.
• A self-authenticating encryption bridge as described above further including:
• a user input module capable of accepting keyed or manipulable input.
• A self-authenticating encryption bridge as described above further including:
• a user input module capable of accepting biometric input.
• A self-authenticating encryption bridge as described above further including:
• a user input module capable of accepting RF transmission input.
• A self-authenticating encryption bridge as described above further including:
• an encryption/decryption control module that prevents data on the mass storage device from being accessed until the user has been validated by analyzing parameters sent from the user input module.
• A self-authenticating encryption bridge as described above further including:
• an encryption/decryption control module containing multiple pairs of decryption keys and authentication parameters.
• A self-authenticating encryption bridge as described above further including:
• an encryption/decryption control module containing a single encryption key associated with multiple authentication parameters.
• A self-authenticating encryption bridge as described above further including:
• a self-authenticating encription bridge embodied in and integral to the mass storage device.
• A self-authenticating encryption bridge as described above further including:
• a self-authenticating encription bridge embodied in and integral to the communication channel (e.g. cable and/or connectors and/or casing).
• A self-authenticating encryption bridge as described above further including:
• a self-authenticating encription bridge embodied in and integral to the output connector on the computer.
• A self-authenticating encryption bridge as described above further including:
• an encrypted channel and a clear channel composed of termination points capable of plugging directly into a mass storage device and computer without the use of additional cables.
• A self-authenticating encryption bridge as described above further including:
• wireless communication used for either or both the encrypted and clear communication channels.
• A self-authenticating encryption bridge as described above further including:
• a power source that may be derived from the communication channel or an internal source.
• While the invention has been described in conjunction with a specific best mode, it is to be understood that many alternatives, modifications, and variations will be apparent to those skilled in the art in light of the aforegoing description. Accordingly, it is intended to embrace all such alternatives, modifications, and variations that fall within the scope of the included claims. All matters set forth herein or shown in the accompanying drawings are to be interpreted in an illustrative and non-limiting sense.

Claims (20)

What is claimed is:

1. A method of operation of a self-authenticating encryption bridge comprising:

locking a user input module until a user has been authenticated;

encrypting or decrypting data in an encryption/decryption control module when the user has been authenticated in the user input module;

transferring encrypted data from a mass storage device to the encryption/decryption control module in a first communication channel; and

transferring clear data to a computer from the encryption/decryption control module in a second communication channel.

2. The method as claimed inclaim 1 further comprising:

not encrypting or decrypting data in the encryption/decryption control module when the user is unable to be authenticated in the user input module.

3. The method as claimed inclaim 1 further comprising:

containing an authentication parameter for authenticating the user inside of the self-authenticating encryption bridge; and

containing an encryption key for encrypting and decrypting clear data in the encryption/decryption control module.

4. The method as claimed inclaim 1 further comprising:

containing a plurality of authentication parameters for authenticating a plurality of users inside of the self-authenticating encryption bridge; and

containing an encryption key for encrypting and decrypting clear data in the encryption/decryption control module.

5. The method as claimed inclaim 1 further comprising:

containing an authentication parameter for authenticating the user inside of the self-authenticating encryption bridge; and

containing a plurality of encryption keys for providing a plurality of ways of encrypting and decrypting clear data in the encryption/decryption control module.

6. A method comprising:

locking a user input module until a user has been authenticated;

unlocking the user input module when the user has been authenticated;

allowing a mass storage device to become accessible to a computer when the user has been authenticated in the user input module and the user input module has been unlocked;

transferring encrypted data wirelessly or by wire to and from a mass storage device to and from the encryption/decryption control module in a first communication channel;

encrypting or decrypting data in the encryption/decryption control module when the user has been authenticated in the user input module and the user input module has been unlocked;

decrypting encrypted data to the computer from the mass storage device in the encryption/decryption control module when and the user input module has been unlocked and the mass storage device is accessible to the computer;

transferring clear data wirelessly or by wire to and from a computer to and from the encryption/decryption control module in a second communication channel; and

encrypting clear data from the computer to the mass storage device in the encryption/decryption control module when and the user input module has been unlocked and the mass storage device is accessible to the computer.

7. The method as claimed inclaim 6 further comprising:

not encrypting or decrypting data in the encryption/decryption control module when the user is unable to be wirelessly or by wire authenticated in the user input module and the user input module is locked.

8. The method as claimed inclaim 6 further comprising:

powering the user input module from the second communication channel; and

powering the encryption/decryption control module from the second communication channel.

9. The method as claimed inclaim 6 further comprising:

powering the user input module and the encryption/decryption control module from a power source in the self-authenticating encryption bridge.

10. The method as claimed inclaim 6 further comprising:

containing a plurality of authentication parameters for authenticating a plurality of users in the self-authenticating encryption bridge; and

containing an encryption key for encrypting and decrypting clear data in the encryption/decryption control module.

11. A self-authenticating encryption bridge comprising:

a user input module for remaining locked until a user has been authenticated;

an encryption/decryption control module responsive to the user input module for encrypting or decrypting data when the user has been authenticated;

a first communication channel for transferring encrypted data from a mass storage device to the encryption/decryption control module; and

a second communication channel for transferring clear data to a computer from the encryption/decryption control module.

12. The self-authenticating encryption bridge as claimed inclaim 11 wherein:

the encryption/decryption control module is responsive to the user input module for not encrypting or decrypting data when the user is unable to be authenticated.

13. The self-authenticating encryption bridge as claimed inclaim 11 wherein:

the self-authenticating encryption bridge contains an authentication parameter for authenticating the user; and

the encryption/decryption control module contains an encryption key for encrypting and decrypting clear data.

14. The self-authenticating encryption bridge as claimed inclaim 11 wherein:

the self-authenticating encryption bridge contains a plurality of authentication parameters for authenticating a plurality of users; and

the encryption/decryption control module contains an encryption key for encrypting and decrypting clear data.

15. The self-authenticating encryption bridge as claimed inclaim 11 wherein:

the self-authenticating encryption bridge contains an authentication parameter for authenticating the user; and

the encryption/decryption control module contains a plurality of encryption keys for providing a plurality of ways of encrypting and decrypting clear data.

16. The self-authenticating encryption bridge as claimed inclaim 11 wherein:

the encryption/decryption control module is responsive to the user input module for allowing the mass storage device to become accessible to the computer when the user has been authenticated;

the encryption/decryption control module is for encrypting clear data from the computer to the mass storage device when the mass storage device is accessible to the computer wirelessly or by wire over a first channel; and

the encryption/decryption control module is for encrypting or decrypting data to the computer from the mass storage device when the mass storage device is accessible to the computer wirelessly or by wire over a second channel.

17. The self-authenticating encryption bridge as claimed inclaim 16 wherein:

the encryption/decryption control module is responsive to the user input module for not encrypting or decrypting data when the user is unable to be wirelessly or by wire authenticated.

18. The self-authenticating encryption bridge as claimed inclaim 16 wherein:

the user input module is powered from the second communication channel; and

the encryption/decryption control module is powered from the second communication channel.

19. The self-authenticating encryption bridge as claimed inclaim 16 further comprising:

a power source in the self-authenticating encryption bridge for powering the user input module and the encryption/decryption control module.

20. The self-authenticating encryption bridge as claimed inclaim 16 wherein:

the self-authenticating encryption bridge contains a plurality of authentication parameters for authenticating a plurality of users; and

the encryption/decryption control module contains an encryption key for encrypting and decrypting clear data.

Images