Portable Media Storage with Sequential Multi-Factor Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing portable memory storage devices lack robust security measures to protect data from unauthorized access, particularly in scenarios with multiple users, and existing authentication methods can be bypassed by attackers.
Innovation Solution
A method of configuring a controller with multiple authentication factors and encryption keys, where each factor requires sequential input of user credentials, and the encryption key is split into portions encrypted with different credentials, ensuring that an attacker must sequentially breach each layer to access the memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple authentication factors are implemented with sequential input screens, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The authentication system is segmented into multiple independent input screens, each requiring separate authentication factors. The encryption key is divided into portions, with each portion encrypted using different user credentials. This segmentation ensures that compromising one factor does not compromise the entire security system, while maintaining manageable complexity through modular design.
Solution Approach 2:
The authentication factors are nested within a hierarchical structure where each input screen contains authentication factors that must be sequentially revealed and validated. The encryption key portions are nested within encrypted containers that depend on previous authentication successes. This nested arrangement provides layered security while organizing complexity in a manageable hierarchy.
2Reliability
If the encryption key is divided into multiple portions encrypted with different credentials, then security against parallel attacks is improved, but the difficulty of legitimate access increases
Solution Approach 1:
The system performs preliminary actions by pre-encrypting portions of the encryption key with different user credentials during setup. This preliminary encryption establishes a secure framework where legitimate users can access their portions efficiently during actual use, while the complexity of key management is handled in advance during configuration.
Solution Approach 2:
The input screens act as intermediaries between the user and the encrypted key portions. Each screen presents a user-friendly interface for entering authentication factors, translating user inputs into the appropriate decryption operations. This intermediary layer simplifies the user experience by abstracting away the complex key division and encryption mechanisms.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of configuring a controller 14 for controlling access to a memory 12 is provided. The controller 14 has a display 18 configured to selectively display a plurality of different input screens, wherein each input screen has a unique code associated therewith and the input screens are for receiving user credentials from a user. The method comprises the steps: a) inputting to the controller 14 a plurality of authentication factors required to access at least a first portion of the memory 12; b) generating, by the controller 14, a first encryption key for encrypting data stored on the first portion of the memory 12; c) displaying a first input screen at the display 18; d) entering first user credentials to the first input screen and storing the first user credentials as a first factor of authentication; e) displaying a second input screen at the display 18; f) entering second user credentials to the second input screen and storing the user credentials as a second factor of authentication; g) encrypting the code for the second input screen using the first user credentials; and h) encrypting the first encryption key using at least one of the user credentials. A method of gaining access to the memory 12 is also provided in which the code for each subsequent input screen is decrypted using user credentials provided at the previous input screen. A method of authenticating a user and a device configured according to the method are also disclosed.