Access control to protected data areas

Abstract

The invention relates to a computer-implemented method for access control to protected data areas on a storage medium, said method comprising the following steps: receiving an authentication feature (4); searching for a protected data area (6, 7), associated with the received authentication feature (4), on the storage medium; determining that no protected data area (6, 7) is associated with the received authentication feature (4); initializing a new protected data area (8); and allowing access to the newly initialized protected data area (8).

Description

[0001] Access control to protected data areas

[0002] The invention relates to a computer-implemented method for access control to protected data areas on a storage medium. The invention also relates to the use of such a method for access control to user data of an application on an end device. Furthermore, the invention relates to an end device comprising a storage medium with at least one protected data area, wherein each of the at least one protected data area is assigned an authentication feature.

[0003] A procedure of the type mentioned above typically comprises the following steps:

[0004] - Receiving an authentication token;

[0005] - Search for a protected data area on the storage medium that corresponds to the received authentication token; and

[0006] - Determine that the received authentication attribute is not associated with a protected data area.

[0007] These steps address the use case where the entered or received authentication credential is invalid. Typical access control methods, such as passwords, hardware-based authentication, or biometrics, are used to grant or deny access after verification.

[0008] With conventional methods, after entering an invalid authentication factor (e.g., an incorrect password), the user is clearly informed of this. Often, an error message such as "Invalid password" or something similar is displayed; graphical or haptic indicators may also be used; usually, the user is then prompted to enter an authentication factor again (which in itself also clearly indicates an invalid entry).

[0009] The disadvantage of these methods is that information about the validity of the authentication credential is disclosed not only to the user but also to third parties. This can occur, for example, in the case of forced authentication or if an unauthorized third party tries different passwords.

[0010] It is an object of the invention to eliminate or at least alleviate these disadvantages of the prior art.

[0011] The invention provides a method in which, after determining that no protected data area is assigned to the received authentication feature, the following steps are performed: initializing a new protected data area; and allowing access to the newly initialized protected data area.

[0012] The invention provides for the use of such a method in such a way that, when the application is started, the authentication feature is entered and the application loads user data from that protected data area to which access has been granted.

[0013] Furthermore, and also accordingly, in an end device according to the invention, it is provided that the authentication features assigned to the various protected data areas are different, wherein the end device is configured, upon receiving an authentication feature that is not assigned to any of the protected data areas on the storage medium, to initialize a new protected data area and to allow access to the newly initialized protected data area.

[0014] This revelation differs significantly from conventional methods, as it reverses the authentication process: symbolically speaking, it is not the key that defines whether the lock opens the safe or not, but rather the key that defines which safe on the terminal device is accessed.

[0015] For example, if the user encrypts sensitive data with password "A" and gains access to it upon entering password "A", but enters password "B", no error message appears, instead sensitive data or protected storage space is created; the data protected with password "A" remains untouched and inaccessible.

[0016] This makes it more difficult for someone who has no information about the protected data to be forced to reveal the password: because the process itself does not recognize "wrong" passwords and consequently does not allow a distinction between "correct" and "wrong" passwords, neither can the person who knows the password be forced to give the "correct" password, nor can an algorithm approach the password via trial and error using computing power, since there is no error message.

[0017] The terminal device can be a computer, terminal, in particular a mobile device, e.g. a smartphone or a tablet computer, or any other storage location, e.g. a mobile data storage device, USB storage device, or contactless readable storage device.

[0018] Access control essentially governs whether and to which data a user has access. A typical access control system distinguishes between restricted access and unrestricted access. Access restrictions can be imposed, for example, by one or more authentication factors, such as a password or biometric feature, whereby the restriction can only be lifted by a correct user input. With access restrictions in place (restricted access), in the simplest case, access to all data (i.e., private and other data) on the device or to all data in a secure area of ​​the device is blocked.

[0019] According to one variant of the disclosed method, access to a shared data area on the storage medium can be permitted simultaneously with granting access to the newly initialized protected data area. One implementation of this is partial access restrictions, which differentiate between various access levels. For example, a first part of the data (the other data) may be accessible even with a partially active access restriction, while only a second part of the data (the private data) is protected, so that this second part becomes accessible only when the access restriction is completely lifted. In other words, access remains restricted when the access restriction is only partially lifted, namely to the other data, excluding the private data. Only when the access restriction is completely lifted is unrestricted access possible, namely to all data.Access levels can be differentiated using various authentication methods, e.g., password "A" for restricted access and password "B" for unrestricted access, or through multiple authentication methods, where only the first part is required to partially lift the access restriction, and the restriction is only fully lifted upon entering a second part. These parts can be authentication methods of different types (e.g., a biometric feature as the first part and a password as the second part) or they can be parts of the same type (e.g., a specific part of the password partially lifts the access restriction, but only the complete password lifts it completely).

[0020] The exposed storage medium can thus have a common data area in addition to the protected data area, whereby the terminal device can be configured to initialize a new protected data area upon receiving an authentication feature that is not assigned to any of the protected data areas on the storage medium, and to allow access to the newly initialized protected data area and to the common data area.

[0021] Optionally, the shared data area and all protected data areas on the storage medium can be stored encrypted. Generally, the new protected data area can be stored encrypted, and other data areas—protected or shared—can optionally also be stored encrypted. Preferably, the entire storage medium is encrypted so that the data areas cannot be identified (i.e., their existence cannot be known) without knowledge of the keys, let alone read.

[0022] Accordingly, in the terminal device disclosed here, at least one protected data area of ​​the storage medium can be optionally encrypted. Likewise, the shared data area of ​​the storage medium can be optionally encrypted. According to a specific variant of the terminal device, a key for decrypting a protected data area can be derived from the authentication feature assigned to that data area.

[0023] Regardless of whether different access levels are achieved or completely separate access points are used (i.e., without shared data), the method described here allows the input or transmission of the authentication factor to simultaneously serve, for example, as the selection of the encryption or the encryption area; that is, when the protection of the protected data area(s) is achieved (among other things) by means of encryption. It can thus be ensured that there is no way to knowingly circumvent the password protection (at least not without additional information about the data area being sought): neither can the forced disclosure of a password be verified due to the lack of an error message, nor can a reliable method for guessing the "correct" password be defined through computing power and trial and error.For example, after entering any possible password, the user has access to data created for that password or protected with that specific password, and (optionally) to other data not marked as private, which is stored on the terminal device.

[0024] A randomly correct password entry can be statistically ruled out by the chosen password complexity and the uniqueness of the attempt (because the attacker, even on the first attempt—as with every attempt—believes they have already guessed the password correctly). The newly protected data area created by the disclosed method can optionally be initialized according to a data area template. A data area template can, for example, contain sufficient and plausible data to prevent the data area from appearing empty. An empty data area would be implausible in some situations because it obviously cannot be associated with any value. A suitable data area template with information that is not obviously worthless can allow for a plausible denial of further information.

[0025] The authentication factor can be, for example, a password, a secret key, or a biometric characteristic. Generally, instead of a single authentication factor, a group of authentication factors (with or without a predefined order) can also be used and assigned to a protected data area.

[0026] For example, in one variant of the disclosed method, before granting access, an additional authentication factor can be received and compared with a common authentication factor to determine if a match is found. The common authentication factor can, for example, protect a shared data area and be satiable by different passwords; that is, this protected data area is associated with several alternative authentication factors. If one of these is found, access is granted.

[0027] According to one embodiment of the disclosed use, the method can be used for access control to user data of an operating system of an end device, wherein, when the operating system is started, the authentication factor is entered and the operating system loads user data from that protected data area to which access has been granted. If no existing protected data area is assigned to the entered authentication factor, a new protected data area suitable for starting the operating system is initialized and started from there. The invention is further explained below with reference to particularly preferred embodiments, to which it is not, however, limited, and with reference to the drawings. The drawings show, in detail:

[0028] Fig. 1 schematically shows the process of a simple variant of the method according to the invention;

[0029] Fig. 2 schematically illustrates the process of the method according to the invention;

[0030] Fig. 3 schematically shows the different variants of the protected data area;

[0031] Fig. 4 schematically shows another variant of the protected data area; and

[0032] Fig. 5 and Fig. 5a show access to protected content in the usual way compared to Fig. 6a and Fig. 6b, which show access to protected content in the way described here.

[0033] Figure 1 shows an example of a simple variant of the disclosed method. A user 1 enters a password as an authentication factor 4 (e.g., via a numeric keypad or keyboard) into an input field 2 of a device 3 with a storage medium and access control. An authentication module 5 of the device 3 receives the authentication factor 4 and searches the storage medium for a protected data area 6, 7 that is associated with the received authentication factor 4. If it is determined that no protected data area is associated with the received authentication factor 4, a new protected data area 8 is initialized and assigned to the received authentication factor 4. User 1 is then granted access to the (now) assigned protected data area 6, 7, 8. The protected data areas 6, 7, 8 are stored encrypted on the storage medium.

[0034] Fig. 2 illustrates the procedure described in connection with Fig. 1 in the form of a general flowchart. Password entry 9 triggers a check and search for a protected data area that is assigned to or associated with the entered authentication factor 4. The result of this search answers question 10 as to whether an assigned protected data area has been found, and depending on the answer, the procedure branches into "yes" 11 and "no" 12. If an assigned protected data area has been found ("yes"), access to it is granted in the final step 13. Otherwise, a new protected data area is first created and initialized 14 and assigned to the entered authentication factor 4. The procedure then continues with the final step 13 in this case as well.In this simple example, access to a protected data area is always permitted, regardless of the content of the entered authentication attribute 4.

[0035] Figure 3 schematically shows an overview of further alternative variants of the procedure according to Figure 1. Upon entering the "correct" authentication factor 15 (i.e., an authentication factor assigned to an already existing protected data area), user 1 gains access to the assigned protected data area 16 in its original, unaltered state. Upon entering an "incorrect" authentication factor 17, the user gains access to a newly initialized data area 18, 19, 20, the content of which, depending on the variant of the procedure, can be empty (data area 18), prepared with a data template or manually entered data (data area 19), or artificially populated (data area 20), e.g., with at least partially synthesized data.Depending on the configuration, data areas 18, 19 and 20 can be further enriched with non-confidential, shared data or information, resulting in the further variants 21, 22, 23.

[0036] Figure 4 schematically shows a variant of a storage medium 25 in which the protected data area 26 and a newly initialized data area 27 are provided within a common data area 28. The common data area 28 contains the data protected by the present process (both common data and data from multiple protected areas), regardless of which specific authentication feature X or Y is used, i.e., independent of any particular authentication feature. In contrast, the protected data areas 26 and 27 are assigned to a specific authentication feature (for example, data area 26 to authentication feature X and data area 27 to authentication feature Y), and access to these data areas can only be gained with a specifically assigned authentication feature.Accordingly, the protected data areas 26 and 27 are each specifically associated with a particular authentication feature. The shared data area 28 is configured so that it can be accessed with any authentication feature assigned to a protected data area 26 or 27 located within the shared data area 28. The shared data area 28 can optionally be encrypted, and a multi-key system can be used to decrypt and access the shared data area 28 with different keys (for example, authentication features X and Y).

[0037] Alternatively, encapsulation can also be achieved through a two- or multi-factor authentication system. For example, a first authentication factor Z can allow access to the shared area 28, and a second authentication factor X or Y can determine access to a protected data area 26, 27 within the shared data area 28. If the first authentication factor Z is entered incorrectly, a new shared data area 29 can be initialized, and access to it will be granted. After this, access to the protected data areas 26, 27 in the other shared data area 28 will no longer be possible, even with a correct (i.e., already assigned) second authentication factor X or Y.Upon receipt of a second authentication factor X or Y, even if it is assigned to a protected data area 26, 27 in another shared data area 28, a new protected data area 30 is initialized in the new shared data area 29 and access to it is granted. For the purposes of this disclosure, authentication factors can include, for example, passwords, biometric features, or hardware tokens, or combinations thereof.

[0038] According to an application example of the architecture shown in Fig. 4, on a storage medium 25, the user can protect all documents relating to a specific subject area, with all documents being stored directly or indirectly (i.e., via subordinate or encapsulated protected data areas 26, 27 above the common data area 28) in the common data area 25. The documents relating to a specific sub-area are accessible only with the authentication feature X; with the authentication feature Y, the user has manually replaced these documents, so that in the event of forced access by a third party, no suspicion of further encryption can arise, since the documents are complete in their entirety.

[0039] Figures 5 and 5a illustrate the traditional method of access restriction from the user's perspective: if an incorrect authentication factor is entered on the terminal device 24, the user is denied access (usually with a notification of the denied access); if the correct authentication factor is entered, the user has unrestricted access to the user data, which in this example is schematically represented as files A, B, C, D and E.

[0040] In contrast to Fig. 5, in the variants of the disclosed method shown in Fig. 6a-b, the user can define existing files as (i) non-sensitive (file A and file E) or (ii) sensitive (files B, C, and D). The non-sensitive files are accessible even with restricted access. They are stored in a common data area on the storage medium of the terminal device 24. If the correct authentication factor is entered, the user receives unrestricted access to all files, as shown in Fig. 5a.

[0041] The difference only becomes apparent when an incorrect authentication credential is entered. In the variant shown in Fig. 6a, if an incorrect authentication credential is entered, access to the non-sensitive files stored in a shared protected data area is still granted. The sensitive files stored in a different protected data area cannot be displayed, and access to these files is denied. In the variant shown in Fig. 6b, the sensitive files are replaced by other files (file F and file G), which, depending on the selected configuration, can be manually prepared (e.g., in a data area template) or artificially generated.

Claims

Patent claims 1. Computer-implemented method for access control to protected data areas on a storage medium (25) , the method comprising the following steps: - Receiving an authentication token (4) ; - Search for a protected data area on the storage medium (25) that is associated with the received authentication feature (4); - Determine that the received authentication feature is not associated with a protected data area (26); and characterized by the steps following these steps: - Initializing a new protected data area (27) ; and - Allowing access to the newly initialized protected data area (27) .

2. Method according to claim 1, characterized in that access to a common data area (28) on the storage medium is permitted simultaneously with allowing access to the newly initialized protected data area (27).

3. Method according to claim 2, characterized in that the common data area (28) and all protected data areas (26, 27) are stored encrypted on the storage medium.

4. Method according to one of claims 1 to 3, characterized in that the new protected data area (27) is initialized according to a data area template.

5. Method according to one of claims 1 to 4, characterized in that the authentication feature (4) is a password, a secret key or a biometric feature.

6. Method according to any one of claims 1 to 5, wherein characterized in that, before access is allowed, another authentication feature is received and compared with a common authentication feature, and a match is found.

7. Use of a method according to one of claims 1 to 6 for access control to user data of an application on an end device (24) , wherein when the application is started the authentication feature is entered and the application loads user data from that protected data area to which access has been permitted.

8. Use of a method according to one of claims 1 to 6 for access control to user data of an operating system of an end device (24) , wherein when the operating system is started the authentication feature is entered and the operating system loads user data from a protected data area to which access has been permitted.

9. Terminal device (24) comprising a storage medium with at least one protected data area, wherein each of the at least one protected data area is assigned an authentication feature, wherein the authentication features assigned to the various protected data areas (6, 7) are different, wherein the terminal device (24) is configured, upon receiving an authentication feature that is not assigned to any of the protected data areas (6, 7) on the storage medium, to initialize a new protected data area (8) and to allow access to the newly initialized protected data area (8).

10. Terminal device according to claim 9, characterized in that the at least one protected data area (6, 7) of the storage medium is encrypted.

11. Terminal device according to claim 10, characterized in that a key for decrypting a protected data area (6, 7) can be derived from the authentication feature assigned to this data area. 14 12. Terminal device according to one of claims 9 to 11, characterized in that the storage medium additionally has a common data area, wherein the terminal device (24) is configured, upon receiving an authentication feature not assigned to any of the protected data areas (6, 7) on the storage medium, to create a new protected data area (8) to initialize and allow access to the newly initialized protected data area (8) and to the common data area.

13. Terminal device according to claim 12, characterized in that the common data area of ​​the storage medium is encrypted.

Images