2-factor authentication for network connected storage device

The present invention relates to a method and system for 2-factor authentication for access to an encrypted storage device in a computer based on the use of a second communication unit, such as a smart mobile phone, and a network connected server. The second communication unit is configured for receiving an encryption control app for storage of an encrypted key file and for receiving a user PIN. The computer includes an encryption module which receives and decrypts the encrypted key file from the second communication unit for activation of encryption and decryption modules.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a 35 U.S.C. § 371 National Phase of PCT Application No. PCT/NO2017/050013 filed Jan. 13, 2017 which claims priority to Norwegian Application No. NO 20160065 filed Jan. 13, 2016. The disclosure of these prior applications are hereby incorporated by reference herein.

To protect information stored on hard disks, solid state (non-volatile) disks and other form of storage devices, the computer industry has developed methods and devices for encrypting and decrypting the stored contents using various forms of encryption methods. The encryption/decryption operation may be controlled and executed by a dedicated software program or the encryption/decryption system may be implemented in hardware which may be operated in combination with an associated software program.

As computing power has increased significantly year for year, new and more powerful encryption methods have been developed to ensure adequate protection, depending upon the actual requirements. Storage devices used in highly sensitive environments like military, police and national security will typically require a higher degree of security that storage devices used in more regular environments like normal office and public environments. However, due to sophisticated and frequent attacks from internet hackers the need for more adequate and secure data protection is increasing also for regular business and private users. It is also a fact that since more and more mobile computing devices are deployed during the regular working days and when travelling, the number of lost and/or stolen devices is also rising rapidly, further elevating the need for secure data encryption.

The security level of an encryption method relies both on the actual encryption method as well as on the method used to authenticate the user. Even the most sophisticated encryption technology is of little value if the access to the system is not adequately protected. The simplest and least secure authentication method is based on the use of just a single pin code or password. A typical example is the standard file protection method implemented in various well-known programs used for text editing. A single password is often the only requirement to gain access to encrypted files (and access to most computers is also typically only controlled by a simple password). Many users also rely on using the same PIN code or password both to open the computer and for enabling file encryption. Anyone with access to the password can then read any files on the computer even if it has encryption protection.

The storage device(s) residing inside a computer is obviously one of the most important areas that need to be protected against harmful attacks. The computer industry has established a special group, the Trusted Computing Group (TCG), focusing on standards aimed at increasing the overall security level of encryption and associated authentication methods. The group has established security standards especially suitable for computing devices produced in high volumes for the mass (low end) market, by standardizing methods that avoid the use of special dedicated high cost items. This includes the decision to store critical security elements such as encryption keys, inside the computer in non-volatile memory (hard disk, solid state disk or other types of non-volatile memory. While this is assumed acceptable for computers aimed at the personal mass market, high security conscious users, in private and/or governmental sector, require encryption and authentication systems where the associated encryption keys are not stored inside the computer when it is powered down.

To improve the overall security of encryption systems the computer industry has implemented various forms of two-factor authentication methods requiring, not just a knowledge factor (PIN/Password), but also a possession factor. A typical two-factor authentication method is the use of credit card for shopping: the credit card is first slided or inserted into the reader (the possession factor) and thereafter the user key in the PIN code (knowledge).

In the computer industry a similar example is the use of smart cards. The user is provided with a personal smart card with one or more installed encryption keys. To enable the encryption or decryption operation, the user has to place the smart card in a special smart card reader integrated with or connected to the computer. The user must also key in a PIN code or password and this will allow encryption code(s) to be passed from the smart card to the computer, enabling data storage and the regular operation of the computer.

Thus this two-factor authentication method satisfies the requirement of both the knowledge factor (the PIN/password) and the possession factor (the smart card) to open up the encryption system.

While this form of two-factor authentication is significantly more secure than just using a single PIN/Password, it still has drawbacks, both from a security point and from a commercial point (product cost). Since the solution also requires loading of a PIN code or password via a keyboard, it means that at least a portion of the encryption key package must reside inside the computer. That is not an optimum solution from a security point of view. Alternatively, the computer may also be equipped with a dedicated key pad for providing the PIN/password; however, this represents another cost in addition to the cost of the smart card reader. Therefore, from a cost point of view, such additional system cost is normally only accepted in environments requiring very high security levels (military, hospital, oil industry, financial industry). But even here, an extra device is another device liable to malfunction, hence not fulfilling the user's requirement to access the data.

In addition to the problems mentioned above, the fact that a user needs to always bring the smart card in order to run the computer may also be considered a problem, especially for systems aimed to be used in more regular business environments. The problem to be solved by the present invention can be defined to be to provide a means for a high security system that is easy to use and still have a low additional cost compared to regular computing devices of the same class.

The present invention may be implemented in a computer consisting of a processing unit, one or more storage peripherals and at least one encryption/decryption device. The encryption device may either be built into the processing unit or into the storage peripheral unit(s) or residing as a separate unit linked to the processing unit and the storage peripheral(s). Furthermore, the encryption keys associated with the operation of the encryption/decryption device shall remain in the computer for maximum as long as it is powered on, or an optional emergency key erase mode is executed before power off. To enhance overall security no encryption keys shall be stored in non-volatile memory inside the computer.

The present invention comprise using a second communication unit, such as a smart mobile phones, or similar devices with connections to the a communication system, such as a phone communication network, like tablets, to facilitate the two-factor authentication procedure. In the case the second communication unit is a smart phone, the novel use of such mobile phone in the authentication process means that the user do not need to carry a dedicated device, like a smart card, to fulfill the possessing requirement of the authentication process. A user will not consider a mobile phone to be an additional item since today most people carry a mobile phone.

In a first embodiment of the invention a method and system is provided for the initial (one-time) setup of a computer device to enable the encryption/decryption process and to introduce a smart mobile phone as the possessing item required for a two-factor authentication. This involves an automated network based, such as internet, communication between the computer, the mobile phone and a dedicated server system set up or controlled by the computer supplier/manufacturer or a trusted party. The process may also involve a user payment to the computer supplier/manufacturer or a trusted party for the use of the encryption/decryption feature. A server system provides the basic program information to the mobile phone to initialize the phone for the authentication process. The process may comprise that an encrypted key file and the associated communication program is stored on the mobile phone. Furthermore, the exchange of information between the mobile phone and the computer may be based on a short range communication technology, for example Bluetooth, optical communication, Near Field Communication (NFC) or other, meaning that the mobile phone may need to reside close to the computer device for a defined period of time in order for the authentication procedure to be executed according to requirements.

In a second embodiment of the present invention a method and system is provided for the regular turn-on and turn-off of an encryption-enabled computer using a smart phone as the main vehicle to start up the computer. The method comprises a communication between the mobile phone and the computer where the mobile phone transfers a pre-installed encrypted key file to the computer. If the encryption device within the computer determines that the encrypted key file is the correct one, it will allow the computer to start up the regular boot process. The exchange of information between the mobile phone and the computer may be based upon Bluetooth, NFC, optical or similar short range communication technology.

In a third embodiment of the invention a method and system is provided for automatic turn-down of the computer in case the mobile phone is moved a longer distance away from the computer than the reach of the short range communication technology between the mobile phone and the computer.

Abbreviations and Expressions

The following abbreviations and expressions used in this document shall be understood to encompass, but not be limited by, the following descriptions:

AppA program especially suitable to operate inside a smart mobile phone, SMPBootThe code and process to start up the computer in regular operation (after PBC)BluetoothA wireless technology standard for exchanging data over short distances usingshort-wavelength radio wavesCMCrypto Module, a device that can perform encryption and decryption of datainformation transmitted to and from a storage deviceComputerAny computing device having at least one CPU, at least one storage device forthe data information and a CM deviceComputer IDA unique identification for each single computerCPUCentral Processing UnitECAEncryption Control AppECCEncryption Control CodeKey FileA unique pattern always stored in encrypted form and use to enable the regularencryption process within a computerKFKey FileNFCNear Field Communication - A communication technology standard thatenables devices like smart mobile phones to communicate with other similardevices and computers via radio communication by arranging the devices closeto each other.NWINetwork Interface - Connections via internetPBCPre Boot CodePIN codePersonal Identification Number codePasswordA string of letters, numbers and other symbols that may be used as theknowledge part of a TFA processSDStorage Device - Hard disks, Non-volatile solid state disksSMPSmart Mobile Phone - With the ability to run programs (apps) andcommunicate via internet and SRCISRCIShort Range Communication Interface - A short range communicationinterface and system either based upon the use of Bluetooth or NFC interfaceradio communication or based upon short range light (including IR (infrared))communicationTFA -Two Factor Authentication. A method to provide unambiguous identificationof a user by means of a combination of two different components, typically aknowledge component, a possessing component or a component inseparablefrom the user.

DETAILED DESCRIPTION OF THE FIGURES AND EMBODIMENTS

The following describes advantageous embodiments of the invention supported by the referenced figures.FIG. 1describes an overview of the basic concept. It outlines a computer enclosure1, that comprises a CPU module2, a crypto module CM4, a storage device SD6, two-ways interconnection3between the CPU2and the CM4; two-ways interconnection5between the CM4and the SD6and a short range communication interface SRCI9with two-ways interconnection10between the CPU2and the SRCI9. The figure also comprise a smart mobile phone SMP7with embedded short range communication interface SRCI12that can perform two-ways communication13using radio and/or light waves communication (optics including infrared) with the SRCI module9in the computer enclosure1. The mobile phone SMP7also has a storage area SD11where special encryption control app ECA8and an encrypted Key File KF14reside. The CPU module2contains a special preboot program PBC15which is immediately activated each time the computer is powered on. When the PBC15is activated it will communicate with embedded encryption control code ECC16in the CM4. The CPU module2also contains a regular BOOT code17that is activated when the PBC code15operation has completed.

The data path3,5between the CPU2and the Storage Module SD6goes via the crypto module CM4, if CM4is activated. CM4has the ability to encrypt all data being transferred from the CPU2to the SD6and decrypt all data being transferred from SD6to CPU2. In order to perform such encryption and decryption operation, the CM4must be enabled to do so.FIG. 2outlines one alternative concept scenario for this enabling procedure, whileFIG. 3shows this alternative scenario procedure schematically in more details.

In the concept scenario described inFIG. 2, the mobile phone SMP7, containing the special encryption control app ECA8and the encrypted key file KF14, is assumed turned on and the ECA8has asked for user PIN to verify that the user is the correct one. The ECA8is ready to communicate with the computer1. When the computer1is powered200the SMP7transfers the encrypted KF14to the CM4.

The CM4then verifies201that the encrypted KF14is correct and asks for a user PIN code. If the CM4determines201that both the KF14and the user PIN code are correct, it will turn on202the encryption/decryption engine within the CM4and activate the BOOT code17which comprise the regular boot operation for the computer1. The correctness of KF14and the PIN code may be verified by that a Master Password used for encrypting the KF14has been encrypted with the PIN code and been stored in the CM4or computer system1. When the CM4receives the KF14and the PIN code, it will first decrypt the Master Password using the PIN code, and then decrypt the KF14using the Master Password, hence when CM4uses the keys from the decrypted KF14to initiate boot process it will succeed only if the PIN code and the KF14has been correct. The system may provide a timer for maximum numbers of attempts for transferring KF14and PIN code. The encrypted Master Password may optionally only be stored on the SMP7, and transferred together with the encrypted KF14when starting operation of the computer (1).

FIG. 3describes the scenario inFIG. 2in more detail, again referring toFIG. 1. InFIG. 3it is assumed that the mobile phone SMP7has been turned on300and activated correctly. In order to activate the encryption operation in computer1, the user will start up the ECA app8. The ECA8may request302a first user PIN code in order to verify that the user is the correct user allowed to start up the computer1. If the PIN code is incorrect, the ECA will report an error message304and terminate the operation.

If the PIN code is correct the ECA will instruct305the user to turn on the computer1. When turned on the PBC15in the computer1will activate the CM4, the ECC code16and the short range communication interface SCRI9. The ECA8will then enable the SRCI12in the mobile phone SMP7and try to establish307contact with the computer1via the radio or light link13. It will check for contact308until it is established or a timer is timed out309. If the timer is timed out, an error message will be shown310.

Once the short range contact is established, the ECA will transfer311the encrypted KF14to the computer1. The encrypted KF14will be checked312in the CM4. If it is deemed incorrect313an error message will be displayed and the operation terminated.

If the KF14is deemed correct, CM4may ask314for a second user PIN code. If so, the CM will check the validity of the PIN code315and if it is not correct it will issue an error message316and terminate the operation. If the pin code is correct, the CM will decrypt an encrypted Master Password which is used to decrypt the encrypted KF, activate its encryption/decryption process318, remove317the encrypted KF from its internal memory, and let the CPU2turn on the regular BOOT code17operations319.

In another scenario, the first PIN code requirement302described inFIG. 3may be dropped if it is determined that the second PIN code requirement314in inFIG. 3together with the transfer of the encrypted KF has a security level high enough for the environment the computer1is designed to operate in. This is especially true if the second PIN code requirement314is replaced by a requirement to read the user's finger print, provided the computer1is equipped with a finger print reader, or one such can be associated with the computer. Alternatively, other means of unique biometric verification may also be used, for example: a reading device reading the user's iris.

In yet another scenario, the first PIN code requirement302inFIG. 3may be replaced by a requirement to read the user's finger print, provided the mobile phone SMP7is equipped with such a finger print reader. Alternatively, other means of unique biometric verification may also be used, for example: a reading device reading the user's iris.

Since the encrypted KF in the CM4is removed once it is verified as correct, it is impossible for an intruder to later get access to this KF through any interfaces of the computer. Also all data, when stored in the SD6, is encrypted and therefore protected against illegal intruders.

In yet another scenario, the computer1with the active ECC program16in the CM4may be set up so that it regularly checks that the mobile phone SMP7is within reach by the short range communication system defined by SRCI9, SRCI12and the link13and shut down the whole computer1operation if the link is not active or the mobile phone SMP7is beyond reach of the short range communication system.FIG. 4shows schematically one implementation of such feature.

InFIG. 4it is assumed400that the computer1has been turned on and that the CM4has been correctly activated. Furthermore, it is also assumed that the smart mobile phone SMP7is powered on and that the ECA8is actively running with the short range communication interface SRCI also active. Further, it is also assumed that a program timer module has been implemented as a part of the ECC16code in the CM4and that this timer program is activated401.

In order to define a valid time period for verifying that the SMP7is located close to the computer1, a preset time number T is loaded403into the timer module in ECC16. The time number T may be freely chosen. In a typical implementation a time number T representing a time between 2 and 10 minutes may be chosen.

The time counter in ECC16will then count down405the time number T. Infigure 405it is assumed that the timer counts down every second, but any time interval is supported by the present invention.

The time counter then checks406if the number T is above zero. If so, it will go back404and continue the process of counting down T.

When the counter discovers that T is not above zero it will activate407the SCRI9and check408if there is a correct communication with the ECA8via the SCRI9, the optical or radio link13and the SCM12in the SMP7. If the contact is OK, the system will go back402and reload403the time counter with the number T once more, repeating the complete process.

However, if the user has removed the mobile phone SMP7so far away from the computer1that there is no communication between the ECC16and the ECA8via the SRCI9, SCRI12and the optical or radio link13, the ECC code16will display409a warning to inform the user that it is necessary to bring the mobile phone SMP7into close contact with the computer1again in order to avoid that the operation of the computer1is not terminated and the computer1shut down. The user is given a (short) time to bring the mobile phone SMP7back into the proximity of the computer1. A second counter XT in the CM4is loaded410with the preset time number XT and the second counter is counting down412and checking413whether the second counter has reached zero. Of not it will continue411counting down.

Once the second counter XT has reached zero, it will once more check414if the communication with the ECA8is OK. If so, it will display a positive message415to the user of the computer1and go back to the beginning402of the loading403of the counter number T to the timer module in ECC16. Thereafter, the whole process is repeated.

However, if the communication with ECA8is not established414, the ECC16will terminate416the whole process in computer1and shut down computer1.

The procedure described inFIG. 4further improves the operational security level of the computer1in that it is impossible to operate the computer1for any length of time without the smart mobile phone SMP7residing in the proximity of the computer1all the time.

In order to use the smart mobile phone SMP7to control the secure operation of the computer1system as described byFIGS. 1, 2, 3 and 4and the associated text, the smart mobile phone SMP7and the computer1must initially go through a set up procedure to ensure that the associated TFA is properly set up and the encryption module CM4in the computer1is activated correctly. This is typically done when the user first start up computer1and will normally involves communication with an approved security software portal, typicallyrun by or approved by the manufacturer/supplier of the computer1. This initial security setup procedure may be implemented in different ways. One implementation scenario is shown inFIGS. 5 and 6.

FIG. 5shows one scenario to initiate the TFA setup procedure. It is assumed that the computer1and the smart mobile phone SMP7are the same as shown previously inFIG. 1and described in the associated text. However, at this initial stage, the encryption control app ECA8and the encrypted key file KF14have not yet been loaded into the memory SD11of the mobile phone SMP7.FIG. 5also shows that computer1, in addition to the features already shown inFIG. 1, is equipped with a network interface NWI19communicating internally with the CPU2via a communication bus18. Furthermore,FIG. 5also shows that the computer via NWI19is linked to a network20via the communication channel21. The network20may represent the whole internet network or the network20may be an internal network that further may be linked to the internet.

The smart phone7is also linked to the network20via communication channel24.

FIG. 5also shows a Manufacturer's Customer Support Server22with a portal to help communicate with customers. The Manufacturer's Customer Support server22is connected to the network20, allowing both computer1and the mobile phone SMP7to communicate with the Manufacturer's Portal22. The network22and the communication channels21,23,24can be of any type, including wired, wireless, fiber, radio or other.

To set up the computer1for data encryption and ensure a reliable and secure TFA process between the computer1and the smart mobile phone7, the user needs to go through a special setup procedure.FIG. 6shows one scenario for such a setup procedure.

In this scenario the computer1when powered up by a user for the first time600will begin a special start-up procedure601by asking602if the user wants to activate the encryption/decryption technology built into the computer. If the answer is NO, the computer will immediately go to a regular first time boot sequence603activating the booth process17and thereafter operate604without the CM device4enabled.

If the user accepts to activate the encryption/decryption mode, the computer1will present605the user with the network address to the manufacturer's customer support server22and ask the user to download606a dedicated Encryption Control App ECA8to the mobile phone SMP7via the network20and the associated gateways23and24. Once the ECA8is downloaded, it it may be started up and enable the short range communication interfaces SRCI2in order for a direct communication link13to be established between the computer1and the smart mobile phone SMP7. The ECA8will check608if the short range connection with the computer1is OK. If not, it will retry609until communication is established (or the process times out).

When the communication link is OK, the ECA8will ask that the computer's1unique ID to be transferred610to the mobile phone SMP7. Thereafter it will register611this ID at the Manufacturer's Customer Supply server22. If required, a payment process between the user and the Manufacturer's Server Site may take place.

The Manufacturer's Customer Support portal will then transfer612via network22and the associated gateways23,24a unique activation code to the user's smart mobile phone SMP7. The ECA8in the smart mobile phone SMP7will then transfer613this unique code to the computer1via the short range communication system defined by SRCI9,12and the link13.

Thereafter the CM4in the computer1will check614the validity of the activation code. If it is deemed not correct, CM4will instruct the CPU2to terminate the process and proceed to the regular boot process17without any activation of the CM4device.

However, if the CM4device determines that the received activation code is valid, it will proceed by asking617the user for a Master Password. The user inputs the chosen Master Password to the smart mobile phone SMP7and the ECA8program then transfers618this Master Password to the CM4in the Computer1.

The process proceeds by the computer1asking619the user for a new Pin Code. The ECA8will then transfer620this pin code to the CM4in the computer1via the short range communication setup SRCI9, SRCI12and channel13.

The CM4in the computer1will then generate621a new and unique Key File14and perform an encryption on this file using very strong encryption techniques.

One option is to encrypt the Key File14using the Master Password, and then encrypt the Master Password using the New Pin Code. The encrypted Master Password is stored in the CM using or SD in the computer1.

The computer1will then transfer622this encrypted Key File14to the smart mobile phone SMP7and the ECA8will then store the encrypted Key File14within its own non-volatile memory SD11.

If the computer1is equipped with a Smart Card interface, the user may choose to back up623the encrypted Key File, and optional the encrypted Master Password, on a Smart Card via the Smart Card interface. The CM4will then remove624the encrypted Key File from the Computer1and instruct625the computer1to open up for regular use. All data from the CPU2to the storage device6will be encrypted by the CM4device. Likewise, all data read from SD6will be decrypted by CM4before transferred to CPU2.

Since all communication between the computer1and the mobile phone SMP7during this encryption setup procedure is handled by the short range communication interfaces SRCI9and12over the link13the process is very secure and very difficult to interfere for an outside party. Also, once the Crypto Module CM4is enabled, the encrypted Key File is removed from the computer1, making it impossible for an outside intruder to penetrate the computer1and get access to the CM4operation. And data is always stored securely encrypted in the SD6.

When present invention discusses storage disk, and storage peripherals it is to be understood that it also comprise any network- or output/input-interface connected storage devices, such as for example a USB connected storage disk.

A further method according to the present invention for using a mobile phone to authenticate an encrypted disk system embedded in a Laptop, Tablet or PC may be provided for a stand-alone (external) encrypted disk system.FIGS. 7-10show various alternatives of such embodiments.FIG. 7describes a block diagram for an external (stand-alone) disk system with a built in encryption/decryption module.

FIG. 7shows the principle build-up of an external unit/disk system700that may be connected to a PC, Laptop, Tablet or similar device via a USB or similar data transfer connection interface/system. The external unit700may be equipped with a USB or similar data transfer controller701, a controller module702with built-in encryption/decryption technology, a hard disk drive or solid state disk drive703for storing the encrypted data and the external unit700may optionally have some form of keyboard704and/or display705to enable a user to interface with the external disk system700.

To activate and utilize this external unit/disk system700in a secure, controlled manner, it is necessary to transfer the specific Password/Pin and Key information from the mobile phone to the controller702.

FIG. 8shows one method embodiment where the external disk700inFIG. 7is connected to a computer system (PC/Laptop or Tablet)810and the necessary Password/PIN and Key information is transferred as previously described from the mobile phone (cell phone)811to the computer system810via close range wireless system like NFC or Bluetooth. In a further embodiment even a type of WLAN may be used, and then the connection range will potentially be longer. Once the necessary key information is transferred to the computer system the key information required to activate the encryption/decryption system inside the controller702is transferred via the (USB) interface701.

For many application, a further improved method embodiment is shown inFIGS. 9 and 10.

FIG. 9shows the same external disk system700as described inFIG. 7, a further external wireless transmitter/receiver906is comprised in the external disk system909. The further external wireless transmitter/receiver906may be an NFC or Bluetooth or other similar short range system, or for longer range systems, a type of WLAN may be used.

The external disk drive system909with its built-in wireless connection module906may then communicate directly with the mobile phone (Cell phone)811as shown inFIG. 10. The necessary key information (Password/PIN etc.) may be transferred directly from the mobile phone811to the external disk system909in order to control the activation of the encryption/decryption module within the controller702. With this system it is possible to avoid any transfer of key information from the mobile phone via the computer810to the external disk909.

Once activated directly from the mobile phone811, the external disk909may be connected to a computer810to facilitate the transfer of data between the encrypted external disk909and the computer810.

As previously described, the encrypted external disk drive909may comprise a built in keyboard and/or display for providing two-way communication between the mobile phone811and the user of the disk system909during the authentication process. However, it is also possible to envision a system where the external disk drive909have no keyboard and display and the all communication with the user is handled by mobile phone811interfaces, and thus enabling control of the complete 2-way authentication process from the mobile phone811.

The invention can also be described as a first embodiment of a method for 2-factor authentication for access to an encrypted storage device6in a computer system1comprising the steps, when initiating the computer system1for encryption of the storage device, of:

a user downloading from a network connected server22an encryption control app8, ECA, to a smart mobile phone7, SMP;

the user activating the ECA8;

the ECA8establishing a short range communication connection13to a computer1comprising an encryption module4, CM;

the ECA8retrieving from the computer1a unique ID, and then transferring this ID to the network connected server22;

the network connected server22transferring an activation code to SMP7, and the SMP7transferring the activation code to the computer1;

the user inputting a Master Password and a PIN code to the SMP7, and the ECA8transferring the Master Password and the PIN code to the CM4;

the CM4generating a Key File14comprising keys to be used by the CM4in encryption and decryption operations, and then encrypting Key File14using the Master Password as the encryption key, and then encryption the Master Password using the PIN code as encryption key;

transferring the encrypted Key File14to the SMP7and storing it within the SMP7;

deleting the Key File14and the Master Password in the computer1,

storing the encrypted Master Password in the computer1; and

the method further comprises the steps of, when the computer system is attempted started up on subsequent occasions after the initiation of the computer system for encryption of the storage device:

transferring the stored encrypted KF14from the SMP7to the CM4;

the user typing the PIN code on the SMP7;

transferring the PIN code from the SMP7to the CM4;

CM4decrypting the encrypted Master Password using PIN code as encryption key;

CM4decrypting the Key File14using Master Password as encryption key;

CM4activating encryption and decryption modules with encryption keys from Key File14;

A second method embodiment according to the first method embodiment, wherein the network connected server22initiating and receiving a payment from the user before transferring the activation code to SMP7.

A third method embodiment according to the first or second method embodiment, wherein the computer1transferring the encrypted KF14, and optionally the encrypted Master Password to a connected Smart Card.

A fourth method embodiment according to the first method embodiment, wherein the computer1will boot with encrypted SD6when successful initiating procedure has been performed, and will boot with unencrypted SD6when initiating procedure has not been performed or have unsuccessfully been performed.

A fifth method embodiment according to the first method embodiment, wherein the computer1will boot with encrypted SD6when successful 2-factor authentication has been performed, and fail to boot when one or more of the following steps occur:SMP7is not running with an ECA8,wrong encrypted KF14has been transferred to CM4wrong PIN code has been transferred to CM4

A sixth method embodiment according to the first method embodiment, wherein the CM4is running, will subsequently be terminating operation once an embedded encryption control code ECC16in the CM4via a short range communication interface9, SCRI, comprised in the computer1loose contact for longer than a preset timer value with the ECA8in the SMP7via a short range communication interface12, SCRI, comprised in the SMP7.

The invention can also be described as a first system embodiment for 2-factor authentication for access to an encrypted storage device6in a computer system according to the method defined in claims1,2and4to6, comprising:

a computer system1comprising one or more storage devices6, SD, and one or more encryption modules4, CM, for encryption/decryption of data to/from the respective SD6;

a smart mobile phone7, SMP;

a server22for transferring an activation code to SMP7;

wherein the SMP7is in communication contact with the server22for receiving the activation code.

A second system embodiment according to the first system embodiment, wherein the computer system1and the SMP7comprises short range communication interfaces9,13, SCM, for communication between the two.

A third system embodiment according to the first system embodiment, wherein the communication channel between the computer system1and the SMP7is an encrypted communication channel.

A fourth system embodiment according to the first system embodiment, wherein the communication channel between the server22and the SMP7is Internet.

A fifth system embodiment according to the first system embodiment, wherein the communication channel between the server22and the SMP7is an encrypted communication channel.

A sixth system embodiment according to the first system embodiment, wherein the system further comprises a smart card, and the computer system1comprise a smartcard interface, for transferring an encrypted Key File14from the CMs4to the smart card via the smart card interface.

A seventh system embodiment according to the first to sixth system embodiment wherein the computer system1,700comprising one or more storage devices6,703, is further connected to a second computer810, the second computer810using the computer system1,700as an external unit/disk system700once the external unit/disk system700has been authenticated and activated.