Portable Storage Device Authentication Using Host Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems for USB pen drives rely heavily on user passwords, which are often weak and easily guessable, leading to unauthorized access and data breaches, especially when combined with the risk of physical theft or loss, and existing solutions compromise on security, convenience, or performance.
Innovation Solution
A portable storage device that uses multiple credentials concurrently to authenticate and generate a cipher key for encrypting and decrypting data, combining a user credential with a computer signature to create a high-entropy authentication value, ensuring secure access while avoiding the need for expensive components like biometric readers or on-chip serial numbers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full-disk encryption based on hardware-based AES-256 is employed, then security is improved, but ease of operation deteriorates due to password management issues
Solution Approach 1:
The patent extracts the password from the authentication process by using passwordless authentication. The host system's unique identifier (such as MAC address or device fingerprint) serves as the credential instead of a user-managed password. This eliminates password creation, memorization, and management while maintaining security through the host's inherent unique characteristics.
Solution Approach 2:
The host system automatically provides its unique identifier for authentication without requiring user intervention. The authentication process leverages the host's own inherent characteristics (device fingerprints, hardware identifiers) to prove its identity, making the system self-authenticating and eliminating the need for manual password management.
2Reliability
If file-system-level encryption is used on top of full-disk encryption, then security is improved, but productivity deteriorates due to slow software-based encryption
Solution Approach 1:
The patent removes the need for software-based file-system-level encryption by implementing authentication at the block device level. The encryption/decryption operations are performed by the hardware encryption module in the pen drive itself, leveraging the USB 3.0 interface bandwidth without software intervention, thus maintaining both security and high data access speed.
Solution Approach 2:
The patent replaces software-based encryption mechanisms with hardware-based encryption. The pen drive contains a hardware encryption module that performs encryption/decryption operations in hardware, eliminating the performance bottleneck of software-based file-system encryption while maintaining security.
3Reliability
If a biometric reader is incorporated in the pen drive, then security is improved, but device complexity and cost deteriorate
Solution Approach 1:
Instead of incorporating physical biometric sensors, the patent uses a digital copy of the host system's unique identifier. The authentication process reads the host's device fingerprint or identifier and uses it for authentication, achieving the same security effect without the complexity of physical biometric readers.
Solution Approach 2:
The patent uses inexpensive software-based authentication mechanisms instead of expensive hardware biometric readers. The authentication relies on reading the host system's existing identifiers (MAC addresses, device fingerprints) which are already present in the system, eliminating the need for additional expensive hardware components.
4Ease of operation
If credential authentication data is stored separately for each credential, then ease of operation is improved, but security deteriorates due to increased attack surface
Solution Approach 1:
The patent merges multiple authentication factors into a single unified authentication process. Instead of storing and verifying credentials separately, the system combines the host identifier verification with the encryption key derivation in a single authentication step, reducing the attack surface while maintaining operational simplicity.
Solution Approach 2:
The authentication mechanism serves multiple functions simultaneously: it verifies the host's identity, derives the encryption key, and authorizes data access all in one process. This multi-functional approach eliminates the need for separate credential storage and verification steps, reducing security vulnerabilities while maintaining ease of operation.
Data Source
AI summary
A portable storage device has a storage peripheral interface connecting to a computer. An encrypted data storage is available to the computer connected to the interface. The encrypted data storage includes a first part accessible after an authentication. A controller has a first operation mode performing encryption and decryption of data of the first part after the authentication of a first combined credential. The encryption and the decryption rely on a cipher key derived from a second combined credential. The first combined credential and the second combined credential are derived from at least a computer signature of the computer connected to the interface and a user credential of a user of the computer connected to the portable storage device.