Secure Data Management Device Using Read-Write Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password management tools are insecure due to the risk of malware copying and decrypting master password files, as they are stored on general-purpose computers that can be vulnerable to attacks.
Innovation Solution
A read/write isolated security module is used to manage sensitive data, restricting access until physical user input is detected, and transmitting data only on an as-needed basis, with a user input device featuring a physical switch and local storage for encrypted passwords, allowing secure access and transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are stored in an encrypted master password file on the user's PC, then password management convenience is improved, but security deteriorates because malware can copy and decrypt the file
Solution Approach 1:
The system divides the password management functionality into two separate components: a security module that stores encrypted password data and a user input device that transmits decrypted passwords. This segmentation prevents malware on the host computer from accessing the encrypted data, as the data never resides on the vulnerable host system.
Solution Approach 2:
A portable security module serves as an intermediary between the user and the computing platform. The module contains encrypted password data and only transmits decrypted passwords when physically present and activated by the user, acting as a secure bridge that prevents direct access to the password database.
2Reliability
If a portable security device is used to store encrypted passwords, then security is improved, but device complexity increases
Solution Approach 1:
The security module is designed to work with multiple different user input devices (keyboards, mice, other input devices) through a universal interface. This multi-functionality allows the same security module to protect passwords across different computing platforms without requiring device-specific implementations.
3Reliability
If the security module is read/write isolated from the computing platform, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The system dynamically changes the isolation state of the security module based on user needs. When the user inserts the security module and activates it, the system transitions from an isolated state (when the module is not present) to a connected state (when the module is inserted and activated), allowing password transmission only when required and supervised by the user.
Data Source
AI summary
Methods, devices, and systems for managing sensitive data are provided. The management tool may be provided on a user input device, as opposed to being provided in memory or in a peripheral that can be read from a program running on a computing platform. The management tool may be maintained in a read/write isolation mode where no data is transmitted outside of the management tool unless the user input device is disengaged from the computing platform, at which point data may be transmitted from the management tool for ultimate delivery to the computing platform.