An external encrypted storage device for secure hardware-based data transfer between protected stationary and mobile data processing systems in any combination.

Abstract

An external data carrier (03) with integrated data encryption and two-factor authentication via smartcard and PIN entry, which has both a unique digital identity and a digital authentication mechanism for host authentication, and in combination with digital identities and digital authentication mechanisms for data carrier authentication of data processing systems (01, 07) forms a protected environment (15) for the secure hardware-based exchange of sensitive data (09, 12) between stationary and mobile data processing systems (01, 07) in any combination (collectively also referred to as a data defense zone), and thus enables the connection (04) of this data carrier (03) to data processing systems (05) outside the data defense zone (15) as well as the connection (08, 13) of external data carriers (14) without an authorized digital identity to the data processing systems (01, 07).07) within the Data Defence Zone (15) prevents as well as enforcing automatic write protection when connecting to predefined data processing systems, requiring repeated authentication of the data processing system at cyclical intervals, and blocking access to the confidential information in the event of failed authentication or logical or physical connection interruptions.

Description

Technical area

[0001] The invention relates to an external data storage device for storing data. In particular, it concerns the creation of a protected environment for sensitive data (data defense zone) for secure data exchange between stationary and mobile data processing systems in any combination using an external data storage device with integrated data encryption and access control. State of the art

[0002] With the constant development of the digital world, personal data volumes are also growing, as is the need to store, secure, and transport extensive information. External storage devices are often used for these purposes. If lost or stolen, unauthorized persons can access the stored sensitive information and thereby cause harm to the affected individuals or companies. To prevent this, data can be stored and transported using encryption.

[0003] There are currently various external storage devices on the market that enable secure encryption of stored data. The best solutions feature hardware-based integrated data encryption with external storage of the encryption key, as well as two-factor authentication mechanisms. These devices provide secure protection for stored data in the event of loss, theft, or misappropriation.

[0004] However, technical IT security is only as good as the people operating the data processing systems. Therefore, the human factor plays a crucial role in the implementation of current security concepts. Even the most well-encrypted data storage devices cannot prevent the loss of sensitive data if the data storage device user themselves fails to comply with established organizational regulations and uses, edits, or stores the stored confidential data on insecure systems.

[0005] Current technical measures allow the interfaces of data processing systems to be configured in such a way that external data storage devices cannot be connected. However, if data is to be transported using external data storage devices, the only option is to rely on organizational measures and the human factor of security. This is often necessary when data is to be processed on the move, at another location, or in a home office.

[0006] The underlying problem is that there is currently no solution that enables data transport on USB sticks or external hard drives between separate data processing systems within a secure area in such a way that this confidential data cannot leave the closed security area by means of technical measures.

[0007] There are already data storage devices that have a write-protection mechanism. However, this must be manually activated and deactivated by the user if data can be written to one data processing system and only read from another. Therefore, the correct use of write protection must rely on the human factor in this case as well. A technical solution that automatically detects whether write protection should be activated does not currently exist. Object of the invention

[0008] The invention is based on the object of developing an external data storage device with integrated data encryption that, in addition to standard user authentication, also requires authentication of the data processing system before access to the information to be protected is granted. The invention thus solves the known problem that external data storage devices can be connected to any data processing system without control, thus allowing the uncontrolled leakage of confidential information, and that the information to be protected can also be compromised by compromised data processing systems. If these data storage devices are subsequently reconnected to the protected data processing systems, they also face the risk of compromise, which the invention aims to prevent.

[0009] A fundamental objective of the invention is to equip the data storage device with cryptographic mechanisms that enable mutual authentication of the data processing systems and external data storage devices. Symmetric cryptographic algorithms such as AES, DES, asymmetric cryptographic algorithms such as RSA, ECC, ML-KEM (CRYSTALS-Kyber), ML-DSA (CRYSTALS-Dilithium), FrodoKEM, Classic McEliece, and hash-based authentication methods using cryptographic hash methods such as SHA256, SHA512, and SHA3 are used for this purpose. The algorithms mentioned are provided for clarity and do not represent an exhaustive list.

[0010] The data carrier should only provide access to the confidential information after the data processing system has successfully authenticated itself to the data carrier.

[0011] The data storage device must be able to be uniquely identified by data processing systems using cryptographic methods. For this purpose, a digital cryptographic identity certificate must be stored on the data storage device.

[0012] The data storage device should be uniquely identifiable by data processing systems using a UUID (Universally Unique Identifier) ​​and / or other secure identification methods. For this purpose, a UUID can be stored on the data storage device, for example.

[0013] The data storage device should be able to detect both logical and physical connection interruptions to an authenticated data processing system and lock itself as a result. In particular, if the data processing system has multiple virtual systems, switching between different virtual systems of the data processing system should be detected by the data storage device and lead to the locking of the data storage device.

[0014] The invention should have an interface that allows it to be connected to data processing systems. This interface can be contact-based, e.g., USB, Lightning, FireWire, Thunderbolt, PCI Express, or similar. The interface can also be contactless, e.g., WLAN / WiFi, Bluetooth, or similar.

[0015] The invention is intended to request the authentication of the data processing system again at cyclical intervals and to block access to the confidential information if authentication fails.

[0016] The invention is intended to be able to restrict access within the data processing system exclusively for certain applications running in the data processing system.

[0017] The invention is intended to encrypt confidential information during transmission to the data processing system. For this purpose, the invention provides a suitable key storage with key derivation and key calculation methods, as well as suitable encryption mechanisms.

[0018] The invention is intended to automatically and independently activate the write protection function on predefined data processing systems after activation. This helps to ensure that confidential information cannot be altered and also prevents the leakage of sensitive information from the data processing system to the external data storage device. Furthermore, it should be possible to automatically and independently activate the write protection function on all data processing systems not explicitly defined. For this purpose, the invention features a write protection mechanism and a list of the authentication features of various data processing systems, coupled with the write protection option.

[0019] Compared to conventional solutions, the invention is said to have the following advantages: - Authentication of the data processing system using cryptographic methods - Provision of a separate digital identity for the identification of the data carrier by data processing systems - Protection of confidential information against manipulation and leakage by unauthorized data processing systems despite activation of the data carrier by authorized users - Enforcing write protection when connecting the data carrier to certain or all unspecified data processing systems - Encrypted transmission of confidential information from the data carrier to the data processing system Short description of the drawings Fig. 1 Representation of the invention in the context of various data processing systems and conventional data carriers. Explanation of the invention

[0020] The invention and its embodiments are explained in more detail below with reference to the drawings. These drawings serve only to better illustrate the invention. However, the actual invention is not limited to them.

[0021] The Fig. Figure 1 shows a graphical representation of an embodiment of a computer-implemented invention. The invention comprises both an external encrypted data carrier (03) with the integrated digital authentication mechanism and digital identity, as well as the integrated digital authentication mechanisms and digital identities of the data processing systems (01, 07).

[0022] Thanks to these authentication mechanisms, this data carrier (03) together with one or more stationary data processing systems (01) and one or more mobile data processing systems (07) forms a protected environment (15) for the secure hardware-based exchange of sensitive data (collectively also referred to as a data defense zone).

[0023] Mutual authentication between the encrypted data carrier (03) and the data processing systems (01, 07) ensures that the data is exchanged exclusively between these data processing systems (01, 07) and the encrypted data carrier (03) and cannot under any circumstances leave this data defense zone (15).

[0024] To transfer data from the stationary data processing system (01) to the mobile data processing system (07), the external data storage device (03) is first connected to the stationary data processing system (01). After verifying the digital identity of the data storage device (02), the digital authentication mechanism of the data processing system grants internal approval for connecting the data storage device (03) to the respective interface.

[0025] In the next step, the digital authentication mechanism of the data storage device (03) verifies the digital identity of the stationary data processing system (01) and authorizes the data storage device (03) for data exchange (09). The data is transferred from the stationary data processing system (01) to the external data storage device (03). After logging out, access to these two devices is blocked.

[0026] From this point on, the external encrypted data carrier (03) ensures both secure storage, archiving and transport of the data as well as secure protection against unauthorized access in the event that this data carrier (03) is lost, stolen or misappropriated.

[0027] In the next step, the external data storage device (03) is connected to the mobile data processing system (07). After verifying (06) the digital identity of the data storage device (03), the digital authentication mechanism of the mobile data processing system (07) grants internal authorization to connect the data storage device (03) to the respective interface.

[0028] Consequently, the digital authentication mechanism of the data storage device (03) verifies (11) the digital identity of the mobile data processing system (07) and enables the data storage device for data exchange (12). The data is transferred from the external data storage device (03) to the mobile data processing system (07). After logging out, access to these two devices remains blocked.

[0029] The transport of data from the mobile data processing systems (07) to the stationary data processing systems (01) as well as between individual mobile data processing systems (07) or stationary data processing systems (01) within the data defense zone (15) takes place in a similar manner.

[0030] The attempt to connect the external data storage device (03) to a data processing system (05) outside the protected environment for sensitive data (15) is unsuccessful because the system has no digital identity or an unauthorized one. The sensitive data can therefore neither be stored nor processed outside the data defense zone (15).

[0031] It is also not possible to connect (08, 13) the data storage device (14) from outside the data defense zone (15) to the stationary or mobile data processing systems (01, 07) within the protected environment for sensitive data (15) and exchange data, since it also has no or an unauthorized digital identity. This ensures that the data stored on data processing systems (01, 07) cannot leave the data defense zone (15).

[0032] An advantageous effect of this invention is that only authorized and cryptographically identifiable external encrypted data storage devices can be connected to the data processing systems, and these external encrypted data storage devices can only be activated on the predefined data processing systems. This creates a kind of protected environment for the secure hardware-based exchange of sensitive data (data defense zone).

[0033] The creation of a data defense zone enables the various users (e.g. authorities and companies) to ensure the secure handling of confidential information on the basis of technical measures, even if this data is stored temporarily or permanently on external data carriers outside the central servers.

[0034] Accordingly, the invention simplifies the processing of confidential information outside the organization, for example while on the move or in the home office, as well as the exchange of information between physically separate data processing systems.

[0035] Furthermore, the invention is characterized in that the write protection of the external data carrier (03) is forced to be automatically switched on during connection to predefined data processing systems in order to prevent an unauthorized outflow of sensitive data from these data processing systems (01, 07).

[0036] Furthermore, the invention comprises a repeated authentication of the data processing system at cyclical intervals with respect to the external data carrier (03) and the automatic blocking of access to the confidential information from the external data carrier (03) in the event of failed authentication or logical or physical connection interruptions. DefinitionsData processing system

[0037] The term data processing system refers to technological solutions (consisting of hardware and software) that are used to collect, store, process and analyze information and data. Stationary data processing system

[0038] The term stationary data processing system refers to data processing systems that are permanently tied to one location (such as servers, permanently installed computers in the office and at home, etc.). Mobile data processing system

[0039] The term mobile data processing system refers to portable data processing systems (such as laptops, tablets, smartphones, etc.) External data storage device

[0040] The term external storage device refers to devices or media used to store data outside of a data processing system or other digital devices (such as external hard drives, USB sticks, memory cards, etc.). External encrypted data storage device

[0041] The term external encrypted storage refers to external storage devices that have hardware or software-based encryption for the stored data. Authentication

[0042] The term authentication refers to the process of verifying the stated identity of a user, data carrier, or data processing system. Two-factor authentication

[0043] Two-factor authentication is a process for proving a user’s identity by combining two different and, in particular, independent components (factors) in order to gain access to stored data or access to a data processing system. Digital Authentication Mechanism (DAM)

[0044] The term Digital Authentication Mechanism (DAM) refers to the mechanism integrated into a device for automatic or combined identity verification of a user or another device. DAM-D

[0045] The term DAM-D refers to the digital authentication mechanism of an external encrypted data carrier. DAM-DS

[0046] The term DAM-DS refers to the digital authentication mechanism of a data processing system. Digital Identity (DI)

[0047] The term Digital Identity (DI) refers to a collection of information and applications integrated into one device for the purpose of digital authentication on another device. (DI-D)

[0048] The term DI-D refers to the digital identity (DI) of an encrypted data carrier. (DI-DS)

[0049] The term DI-DS refers to the digital identity (DI) of a data processing system. Data Defense Zone (DDZ)

[0050] The term Data Defense Zone (DDZ) refers to a protected environment for the secure hardware-based exchange of sensitive data between stationary and mobile data processing systems in any combination using an external data carrier with integrated data encryption and access control.

[0051] Smart card: A smart card, often referred to as a SIM card, chip card, or integrated circuit card (ICC), is a special plastic card with a built-in integrated circuit (chip) containing hardware logic, non-volatile EPROM (EEPROM) memory, or a microprocessor. International standards define four form factors for SIM cards: standard SIM (1FF or ID-1), mini SIM (2FF or ID-000), micro SIM (3FF), and nano SIM (4FF). List of reference symbols 01 A stationary data processing system with the integrated digital authentication mechanism (DAM-DS) and digital identity (DI) within the protected environment (data defense zone). 02 Authentication of an encrypted data carrier on a mobile data processing system within the protected environment (data defense zone). 03 Encrypted data carrier with the integrated digital authentication mechanism (DAM-DS) and digital identity (DI) within the protected environment (data defense zone). 04 Connecting an encrypted data carrier from the protected environment to a data processing system outside the protected environment (data defense zone). 05 a data processing system outside the protected environment (data defense zone). 06 Authentication of the encrypted data carrier on a mobile data processing system within the protected environment (data defense zone). 07 A mobile data processing system with the integrated Digital Authentication Mechanism (DAM-DS) and Digital Identity (DI) within the protected environment (Data Defense Zone). 08 Connecting a data storage device from outside the protected environment (data defense zone) to a stationary data processing system within the protected environment (data defense zone). 09 Data exchange (reading and writing) between the stationary data processing system and an external encrypted data carrier. 10 Authentication of a stationary data processing system on the encrypted data carrier within the protected environment (data defense zone). 11 Authentication of a mobile data processing system to the encrypted data carrier within the protected environment (data defense zone). 12 Data exchange (reading and writing) between the mobile data processing system and an external encrypted data storage device. 13 Connection of a data storage device from outside the protected environment (data defense zone) to a mobile data processing system within the protected environment (data defense zone). 14 a data carrier outside the protected environment (data defense zone). 15 a protected environment for the secure hardware-based exchange of sensitive data (Data Defense Zone).

Claims

[1] An external data carrier (03) with integrated data encryption and 2-factor authentication by means of a smart card and PIN entry, which has both a unique digital identity and a digital authentication mechanism for host authentication and, in combination with digital identities and digital authentication mechanisms for data carrier authentication of data processing systems (01, 07), forms a protected environment (15) for the secure hardware-based exchange of sensitive data (09, 12) between stationary and mobile data processing systems (01, 07) in any combination (collectively also referred to as a data defense zone) and thus enables the connection (04) of this data carrier (03) to data processing systems (05) outside the data defense zone (15) as well as the connection (08, 13) of external data carriers (14) without an authorized digital identity to the data processing systems (01,07) within the data defence zone (15) and enforces the automatic activation of write protection when connected to predefined data processing systems, as well as requiring repeated authentication of the data processing system at cyclical intervals and, in the event of failed authentication, blocking access to the confidential information in the event of logical or physical connection interruptions. [2] An external data carrier (03) with integrated data encryption and 2-factor authentication by means of a smart card and PIN entry, which has a unique digital identity and a digital authentication mechanism for host authentication and, in combination with digital identities and digital authentication mechanisms for data carrier authentication of data processing systems (01, 07), forms a protected environment (15) for the secure hardware-based exchange of sensitive data (09, 12) between stationary and mobile data processing systems (01, 07) in any combination (collectively also referred to as a data defense zone). [3] An external data carrier (03) according to claim 1, characterized by that it has integrated data encryption and 2-factor authentication using a smart card and PIN entry. [4] An external data carrier (03) according to claim 1, characterized bythat, together with the authorised stationary and mobile data processing systems, it forms a data defence zone (15) (a protected environment for the secure hardware-based exchange of sensitive data between stationary and mobile data processing systems). [5] An external data carrier (03) according to claim 1, characterized by that he has a digital identity. [6] An external data carrier (03) according to claim 5, characterized by that he has a digital identity which enables this data carrier to be clearly identified in stationary (01) and mobile (07) data processing systems. [7] An external data carrier (03) according to claim 1, characterized by that it has a digital authentication mechanism for host authentication. [8] An external data carrier (03) according to claim 7, characterized bythat it has a digital authentication mechanism for host authentication, which only enables the activation of the data carrier (03) and access to the stored data (09, 12) once it is a data processing system (01, 07) authorized for this data carrier (03). [9] An external data carrier (03) according to claim 7, characterized by that it has a digital authentication mechanism for host authentication, which prevents the activation of the data carrier (03) and access (04) to the stored data as soon as it is not a data processing system (05) authorized for this data carrier (03). [10] An external data carrier (03) according to claim 1, characterized bythat the data processing systems (01, 07) within the data defense zone (15) have digital identities and digital authentication mechanisms for data carrier authentication of these data processing systems (01, 07) and enable mutual authentication of the data processing systems (01, 07) and the data carrier (03). [11] An external data carrier (03) according to claim 10, characterized by that the data processing systems (01, 07) within the data defense zone (15) have digital authentication mechanisms for data carrier authentication and only allow the data carrier with an authorized digital identity access (09, 12) to these data processing systems (01, 07). [12] An external data carrier (03) according to claim 10, characterized bythat the data processing systems (01, 07) within the data defense zone (15) have digital authentication mechanisms for data carrier authentication and prevent the data carrier (14) from accessing these data processing systems (01, 07) without an authorized digital identity. [13] An external data carrier (03) according to claim 1, characterized by that when connected to the predefined data processing systems within the data defense zone (15), an automatic activation of write protection of the data carrier (03) is enforced in order to prevent an unauthorized outflow of sensitive data from these data processing systems (01, 07). [14] An external data carrier (03) according to claim 1, characterized by that it requires repeated authentication of the data processing system at cyclical intervals and blocks access to the confidential information if authentication fails. [15] An external data carrier (03) according to claim 1, characterized by that it automatically blocks access to confidential information in the event of logical or physical connection interruptions.

Images