Source: http://www.google.com/patents/US7743409?dq=5708422
Timestamp: 2015-05-29 02:31:35
Document Index: 743616440

Matched Legal Cases: ['Application No. 60', 'Application No. 06', 'Application No. 06814655', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2', 'art 2', 'art 2', 'art 2', 'Application No. 2006800089822', 'Application No. 200680008989', 'Application No. 200680009222', 'Application No. 200680032990', 'art 1']

Patent US7743409 - Methods used in a mass storage device with automated credentials loading - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsA portable mass storage device for use in two factor authentication systems and methods. A secure portable mass storage device protects content from being freely copied with security mechanisms and firmware. The security functionality also protects confidential user credentials and passwords, as well...http://www.google.com/patents/US7743409?utm_source=gb-gplus-sharePatent US7743409 - Methods used in a mass storage device with automated credentials loadingAdvanced Patent SearchPublication numberUS7743409 B2Publication typeGrantApplication numberUS 11/319,259Publication dateJun 22, 2010Filing dateDec 27, 2005Priority dateJul 8, 2005Fee statusPaidAlso published asUS7748031, US8220039, US20070011724, US20070016941, US20100162377Publication number11319259, 319259, US 7743409 B2, US 7743409B2, US-B2-7743409, US7743409 B2, US7743409B2InventorsCarlos J. Gonzalez, Joerg Ferchau, Fabrice Jogand-CoulombOriginal AssigneeSandisk CorporationExport CitationBiBTeX, EndNote, RefManPatent Citations (124), Non-Patent Citations (171), Referenced by (23), Classifications (34), Legal Events (3) External Links: USPTO, USPTO Assignment, EspacenetMethods used in a mass storage device with automated credentials loading
US 7743409 B2Abstract
A portable mass storage device for use in two factor authentication systems and methods. A secure portable mass storage device protects content from being freely copied with security mechanisms and firmware. The security functionality also protects confidential user credentials and passwords, as well as algorithms and seeds needed for two factor authentication or asymmetric authentication methods. A client application residing in the mass storage device acts as both a password manager and an authentication manager that seamlessly performs the authentication procedures in the background while signing a user into various institutions of his choosing. A very high level of security is integrated into a mass storage device the user has for purposes other than two factor authentication, and the convenience of highly secure password management also comes in a convenient pocket sized package easy for the user to transport. This facilitates the acceptance of two factor authentication, and increases security for a wide variety of online transactions.
1. A method of accessing accounts of a user with a portable mass storage device, the method comprising:
detecting a connecting of the portable mass storage device with a computer, the portable mass storage device comprising a portable memory card or a portable USB drive; and thereafter
causing a connection to be established between the computer and a first entity; and thereafter
causing a seed, to be used with a one time password generator implemented within the portable mass storage device, to be loaded into the portable mass storage device while it is connected to the computer;
launching a client application;
executing the client application using the computer;
sending a request from the client application to the portable mass storage device;
generating, in response to the request and within the portable mass storage device using the one time password generator, a one time password with the loaded seed;
causing the one time password to be transmitted to an institution along with user identifying information, thereby logging the user into one of said accounts so that the user can access his account.
2. The method of claim 1, further comprising causing additional seeds that are to be used with the one time password generator to be loaded into the portable mass storage device while it is connected, each additional seed to be used with a particular account or institution, each seed stored in a hidden partition of the mass storage device not accessible through standard read write commands used by file system of the connected computer to access data within the storage volume of the device.
3. The method of claim 2, wherein in order for an entity to load a seed it must establish that it has permission to load a seed in order to load the seed and access the hidden partition.
4. The method of claim 1, wherein generating comprises computing a value with an algorithm, and wherein generating comprises utilizing a different algorithm for each account or institution to be accessed.
5. The method of claim 1, further comprising causing binding of the portable mass storage device with a slot of the portable mass storage device.
6. The method of claim 1, further comprising causing the slot to be activated.
7. The method of claim 1, further comprising causing the user and the portable mass storage device to be authenticated.
8. The method of claim 5, wherein binding comprises:
selecting an account;
receiving a slot identifier;
retrieving a device identifier within the device; and
creating a unique identifier based upon the slot identifier and the device identifier.
9. The method of claim 8, further comprising using the unique identifier to bind the mass storage device to a validation server.
10. The method of claim 8, wherein the slot identifier is received from a client stored on the portable mass storage device and executed by a processor of the computer.
11. The method of claim 8, wherein the slot identifier is received from a client stored on the portable mass storage device and executed by a processor of the portable mass storage device.
12. The method of claim 6, wherein activating the slot comprises:
causing user identifying information to be entered by the user;
causing the user to select an account;
correlating the account and user with the slot.
13. The method of claim 1, further comprising receiving the seed from a first entity prior to loading of the seed.
14. A method of automated credentials loading, comprising:
causing a portable mass storage device comprising a portable memory card or a portable USB drive to perform a one time password generation sequence that generates a one time password value, wherein causing the portable mass storage device to perform a one time password generation sequence includes launching a client application, executing the client application using a host to which the portable mass storage device is connected, sending a request from the client application to the portable mass storage device and wherein the one time password value is generated, in response to the request and within the portable mass storage device by a one time password generator implemented within the portable mass storage device;
obtaining the one time password value from the portable mass storage device;
retrieving one or more user credentials from a list of credentials stored in a secure memory area of the mass storage device;
accessing a web site of an institution;
entering into the web site of the institution the one or more user credentials and the one time password value.
15. The method of claim 14, wherein the entering is triggered by the portable mass storage device, and performed automatically without participation of a user of the device.
16. The method of claim 14, wherein the entering is triggered by an action of the user of the device.
17. The method of claim 14, further comprising loading a seed into the portable mass storage device.
18. The method of claim 14, further comprising loading an identifier of the portable mass storage device into the device.
19. The method of claim 17, wherein one or more institutions are accessed, and wherein for each institution a unique seed is loaded, wherein for a seed to be loaded the entity wishing to load the seed must establish that it has permission to do so.
20. The method of claim 14, wherein one or more institutions are accessed, and wherein for each institution a unique password generation process is utilized in performing the one time password generation sequence.
21. The method of claim 14, wherein entering comprises dragging and dropping.
22. The method of claim 14, wherein entering comprises associating fields stored in the portable mass storage device with appropriate web page fields of the web site.
23. The method of claim 14, wherein entering is triggered by a user's selection of an institution from the list.
24. The method of claim 14, wherein entering is triggered by detection of the opening of a particular web page with a web browser.
25. The method of claim 14, wherein entering is performed by a third party.
26. The method of claim 14, wherein entering is performed by the client application stored on the portable device and executed by the host device.
27. The method of claim 14 wherein entering the credentials into the web site comprises entering the credentials into web page fields of the web site.
28. A sign on method comprising:
inserting a portable mass storage device into a socket of a host device, said socket having electronic contacts and disposed for frequent insertion and removal of the portable mass storage device by a user of the device, the portable mass storage device comprising a portable memory card or a portable USB drive;
launching a client application residing on the portable mass storage device;
entering user identifying information and user secret information;
selecting an institution in which to sign on;
connecting to an authority;
receiving, in the host device, a seed from the authority;
receiving, in the host device, a device identifier from the authority;
storing the seed in the mass storage device;
storing the device identifier in the mass storage device;
storing an institution identifier in the mass storage device;
storing a count for use with the seed; and
executing the client application using the host device;
generating, in response to the request and within the portable mass storage device using a one time password generator within the portable mass storage device a one time password value based on the seed.
29. The method of claim 28, further comprising presenting the user a list of institutions in which to sign on.
30. The method of claim 28, wherein selecting an institution comprises entering an institution identifier.
31. The method of claim 28, wherein selecting an institution comprises selecting the institution from a list.
32. The method of claim 30, wherein the institution identifier comprises a universal resource locator.
33. The method of claim 30, wherein the institution identifier comprises the name or an alias of the institution.
34. The method of claim 28, wherein the seed is stored in an encrypted format.
35. The method of claim 28, wherein the device identifier is stored in the mass storage device by the client application.
36. The method of claim 28, wherein the user identifying information comprises biometric information.
37. The method of claim 28, wherein entering user identifying information and user secret information is done on a form of the client application.
38. The method of claim 28, further comprising learning the placement of the security credentials and identifying information.
39. The method of claim 28, further comprising associating user identifying information and user secret information with the institution identifier.
40. The method of claim 33, further comprising associating the seed with the institution identifier.
41. The method of claim 28, wherein the portable mass storage device has a universal serial bus interface.
42. The method of claim 28, wherein the portable mass storage device has form factor of a memory card.
43. The method of claim 28, wherein the seed is stored in the mass storage device in an encrypted format.
44. The method of claim 28, wherein the seed is stored in a secure portion of the memory used for mass storage in the mass storage device.
45. The method of claim 44, wherein the seed can only be stored while the mass storage device is in certain operating states.
46. A method of logging into an institution, comprising:
sensing the insertion of a portable mass storage device in a socket of a host device, said socket designed for frequent insertion and removal of the portable mass storage device by a user of the device, the portable mass storage device comprising a portable memory card or a portable USB drive;
launching a client application residing on the portable mass storage device and executing the client application on the host device;
retrieving a list of enrolled institutions stored in the mass storage device;
selecting an institution from the list;
retrieving a user identity, user secret, and an institution identifier stored in a memory of the mass storage device;
generating, in response to the request, a one time password value within the portable mass storage device using a one time password generator implemented within the portable mass storage device;
opening a user interface of the institution whose identifier was retrieved;
causing the host device to enter the user identity, credentials, and the one time password value into the user interface of the institution,
triggering the institution to pass a device identifier, and the one time password value to an authenticating entity,
said authenticating entity thereafter passing an authentication status of the device to the institution.
47. The method of claim 46, further comprising entering the user identity and user secret.
48. The method of claim 46, wherein the entering is performed once, and wherein thereafter it stored within and retrieved from a memory of the mass storage device.
49. The method of claim 46, wherein the list is retrieved by the launched client application.
50. The method of claim 46, wherein the single action comprises a keystroke.
51. The method of claim 46, wherein selecting an institution comprises a single user activation of a cursor control device.
52. The method of claim 46, wherein the user interface comprises one or more world wide web pages.
53. A method of logging into an institution with a portable mass storage device and a computer, the method comprising:
inserting the device into a receptacle of the computer;
executing instructions residing in mass storage memory of the portable mass storage device, wherein the portable mass storage device comprises a portable memory card or a portable USB drive, wherein executing instructions residing in the mass storage device includes launching a client application and executing the client application using the computer,
said client application causing the computer to request a one time password value from the portable mass storage device;
said portable mass storage device generating, within the portable mass storage device using a one time password generator implemented within the portable mass storage device, a one time password value in response to the request from the computer, said instructions client application further causing the computer to provide a user identifier, a user secret, and the one time password value to the server to the institution, thus logging the user into the institution.
54. A method of accessing accounts of a user with a portable mass storage device, the method comprising:
generating within the portable mass storage device using the one time password generator, a one time password with the loaded seed;
causing the one time password to be transmitted to an institution along with user identifying information, thereby logging the user into one of said accounts so that the user can access his account; and
launching an application from the portable mass storage device and executing the application with the computer, wherein the application is configured to present to the user plural institutions for the user to access and wherein the one time password generator is configured to generate one time passwords for each of the institutions.
55. A method of automated credentials loading, comprising:
causing a portable mass storage device comprising a portable memory card or a portable USB drive to perform a one time password generation sequence that generates a one time password value, wherein the one time password value is generated within the portable mass storage device by a one time password generator implemented within the portable mass storage device;
obtaining the time password value from the portable mass storage device;
entering into the web site of the institution the one or more user credentials and the time password value; and
launching an application from the portable mass storage device and executing the application on a host system to which the portable mass storage device is coupled, wherein the application is configured to present to a user plural institutions for the user to access and wherein the one time password generator is configured to generate, within the portable mass storage device, one time password values for each of the institutions.
56. A sign on method comprising:
launching an application residing on the portable mass storage device;
entering user identifying information and user secret information:
storing a count for use with the seed;
generating within the portable mass storage device using a one time password generator within the portable mass storage device a one time password value based on the seed; and
presenting, using the application, plural institutions for a user to access and wherein the one time password generator is configured to generate, within the portable mass storage device, one time passwords for each of the institutions.
57. A method of logging into an institution, comprising:
generating a one time password value within the portable mass storage device using a one time password generator implemented within the portable mass storage device;
opening a user interface of the institution whose identifier was retrieved; causing the host device to enter the user identity, credentials, and the one time password value into the user interface of the institution,
said authenticating entity thereafter passing an authentication status of the device to the institution; and
presenting, using the application, plural institutions for the user to access and wherein the one time password generator is configured to generate, within the portable mass storage device, one time password values for each of the institutions to generate within the portable mass storage device.
58. A method of logging into an institution with a portable mass storage device and a computer, the method comprising:
executing instructions residing in mass storage memory of the portable mass storage device, wherein the portable mass storage device comprises a portable memory card or a portable USB drive,
said instructions causing the computer to request a one time password value from the portable mass storage device;
said portable mass storage device generating, within the portable mass storage device using a one time password generator implemented within the portable mass storage device, a one time password value in response to the request from the computer,
said instructions further causing the computer to provide a user identifier, a user secret, and the one time password value to the server to the institution, thus logging the user into the institution; and
wherein said instructions further cause the computer to present to the user plural institutions for the user to access and wherein the one time password generator is configured to generate, within the portable mass storage device, one time passwords for each of the institutions. Description
This application is related to and claims priority from Provisional Application No. 60/697,906, filed on Jul. 8, 2005 entitled “Mass Storage Device With Automated Credentials Loading” to Carlos J. Gonzalez et al.
This application is also related to: application Ser. No. 11/319,385, filed Dec. 27, 2005, entitled “Mass Storage Device With Automated Credentials Loading” to Carlos J. Gonzalez et al., application Ser. No. 11/285,600, filed Nov. 21, 2005, entitled “Hardware Driver Integrity Check of Memory Card Controller Firmware” to M. Holtzman et al., application Ser. No. 11/317,390, filed Dec. 22, 2005, entitled “Methods Used in a Secure Memory Card With Life Cycle Phases” to M. Holtzman et al., application Ser. No. 11/317,862, filed Dec, 22, 2005, entitled “Secure Memory Card with Life Cycle Phases” to M. Holtzman et al., application Ser. No. 11/317,341, filed Dec. 22, 2005, entitled “Methods Used in a Secure Yet Flexible System Architecture for Secure Devices With Flash Mass Storage Memory” to M. Holtzman et al., application Ser. No. 11/317,339, filed Dec. 22, 2005, entitled “Secure Yet Flexible System Architecture for Secure Devices With Flash Mass Storage Memory” to M. Holtzman et al., All of the aforementioned applications and each application referred to in this application are hereby incorporated by this reference in their entireties.
The present invention relates generally to portable mass storage devices such as the memory cards and portable universal serial bus (“USB”) flash memory drives used to store and transfer large files to and from digital devices, and more specifically to security and access control mechanisms implemented within the devices to access the devices and also other institutions.
Remembering passwords is a hassle. The computer at the office requires a user name and password. Each email account requires a user name and password, as does each online account. If security were not an issue, a person would likely have only one username and password for all accounts.
One approach is the one time password (“OTP”). A one time password is, generally speaking, a value that can be used to access a system once before it is changed. In other words, it is regularly updated (at a certain defined frequency) without the user having to change it. This means that the user submits a unique (password) value that is used only once and the system that he wishes to access verifies that the value is what it should be. Typically this is accomplished with a small device or “token” that generates the password for the user based upon a predictable algorithm. The same predictable algorithm is utilized by a validating entity in the system, and when the algorithms are given the same seed value, the system therefore “knows” what the user's ever changing one time password value should be at any instant (or count). The most common form of the tokens to date requires that the user read the value from a screen and enter it into a computer. Another recently developed form allows the token to transmit the value directly to the computer. Both of these implementations, and the one time password concept generally, provide a high level of security, but require that the user carry around a token for generation of the one time password values. The tokens are a form of two factor authentication, the user's secret (password or pin) being one factor, and the OTP value and the hardware (token) necessary to produce it being the second factor.
Another approach utilizes a password management device. Such a device can keep track of a user's various passwords and account numbers and submit the proper password(s) for each user account. For example, the user may have a master password for accessing the device, and after the device has verified the user's master password, it can then submit the actual password for a given account when it is connected to a host computer. The user can either enter his various passwords or passwords can be pushed to the password management device. One such device from SafeNet� (formerly thought to be Rainbow Technologies) is known as the iKey™ and is also capable of encryption and the associated key generation.
The present invention integrates robust security and the convenience of password management into a portable mass storage device. Since a user typically already has a portable mass storage device for use with his digital camera, music player, PDA, or the like, the added security and convenience impose little burden on the user. This facilitates greater penetration of very secure one time password schemes, and results in significantly less risk for sensitive applications such as on-line banking. Because a secure portable mass storage device can store programs and other secure data, OTP generation and password management can be integrated into one convenient platform.
One of the barriers to adoption of such two-factor authentication systems in the consumer space is the need for a user to carry a token specifically for the purpose of performing the authentication operation. One way to eliminate this burden of having to carry multiple dedicated devices is to integrate such functionality into a device that a person may possess and/or carry with them for other reasons. An example of such a mass storage device is a USB flash storage device or a mass storage flash memory card such as a compact flash “CF” card, SD card, MMC card, XD card, Memory Stick, TransFlash card, or the like, which is commonly used to store data, and more recently to store and carry applications. Such a device, according to the present invention, performs the basic OTP functionality and carries a client application that could be launched from the mass storage device and executed on the host computer. The client application is responsible for interacting with the device to perform the OTP operation, and to get the OTP value from the device. In another embodiment, the client itself performs the OTP functionality and stores and retrieves information such as the count to and from the device as needed. In either case, the information would be stored in a secure manner, and protected appropriately by some means such as encryption.
In another embodiment, the client may be active on the host computer and detect when the user accesses a web page within the list of enrolled institutions in order to activate the log on sequence. The Institution list may be displayed on a graphical user interface (“GUI”) as a list, a drop-down list, a group of icons, a group of corporate logos, or other such representations. The user identity and credentials, and the institution Uniform Resource Locator (“URL”) or other form of web address are also ideally already stored on the removable storage authentication mass storage device, and are retrieved for the authentication. If the device supports a number of independent OTP seeds, or even if it supports a number of independent institutions using the same OTP seeds, then the user identity, credentials, and URL are ideally selected from a list stored on the device according to the particular institution to which the person is authenticating. This system combines the functions of a traditional password manager and an OTP authentication system seamlessly, and performs the log on and authentication operation all with a single click of a button. Although performing all these actions with a single click is preferable in some scenarios, multiple clicks or other user input may be utilized and preferable in other scenarios.
In one embodiment, the client may provide the user and authentication information to a web server that will upon receiving valid user credentials and authentication information, will automatically fill out the traditional log-in web page entries that are normally used to log on without the two-factor authentication. This embodiment would enable a given institution to maintain a single web log-on page, while adding a separate system component to handle the two factor authentication. In this case, the two-factor authentication may consist of forms of authentication that do not easily lend themselves to form-filling, as OTP does, but instead may be authentication schemes, such as the public key infrastructure (“PKI”), which typically involve challenge-responses operations.
One common method of hacking, commonly referred to as ‘phishing’, is one in which a user is tricked into providing confidential information to a web site disguised as a valid web site. There are a number of ways to counter this form of hacking. The list of participating institutions may be used as a means to provide additional information to the system, such as the valid URLs pertaining to a given institution, the form of authentication or specific protocols employed for authentication, and so on. In one embodiment, the URL embedded in the list of participating institutions may be used to limit the URLs to which a user may enroll with the system. In such an implementation, the list would be preferentially downloaded to the device from a remote server via a secure channel to avoid snooping by third parties. In another implementation, the client may request validation of a URL by establishing a link to a remote server and, preferentially through a secure channel, requesting validation of the URL. The remote server may in one embodiment be an authority server or validation entity such as those seen in FIGS. 1-3. In yet another embodiment, the validation of the website may be performed by some form of authentication using a common method such as PKI with certificates, etc. In one implementation, security is added to the web server to ensure a valid device is connected prior to initiating the authentication process. In another embodiment, the web page may activate services on the PC, which on a Microsoft Windows OS may be ActiveX technology, to interact with the authentication client to determine the presence to the device. In a preferred solution, all validation happens logically between the remote server and the device itself, with the local client performing only facilitation of communication.
FIG. 1 is a schematic illustration of a first system according to the present invention.
Portable mass storage devices are widely used to store digital content such as photographs, music, videos, and documents. They are also sufficiently large to store large software applications. Typically, the portable mass storage devices now use flash memory for storage purposes, and have a form factor of a memory card or portable USB drive. These mass storage devices are distinct from other portable devices that are intended to store very little information such as that required for transaction or identification purposes. Mass storage devices are also distinct from other dedicated purpose devices such as key cards and the tokens used for authentication, because while the dedicated devices may have small amounts of memory to store pertinent user identification information, they are not designed to frequently store and transfer what are comparatively massive and often encrypted files in a rapid, reliable, and repeatable manner.
For example, a memory card, one embodiment of a portable mass storage device, must be capable of rapidly storing pictures on the order of 5-20 megabytes or more. One single picture from a digital camera may require orders of magnitude more storage than is present in a dedicated purpose device such as a smart card, key card, or token. Furthermore, such a dedicated purpose device is generally not capable of quickly reading and writing files, let alone the relatively large files used with cameras and music players etc. Portable mass storage devices have controllers and firmware with routines that are optimized to read and write to the memory banks very quickly. Furthermore, many of the portable mass storage devices have security and encryption routines to thwart unauthorized copying of the frequently updated content. While dedicated tokens may have some form of security (to protect the seed and/or algorithm), the data on the token is generally static and the security is not designed to protect against unauthorized copying of frequently updated user files. The mass storage device of the present invention may also store the seeds and other information needed for validation and authentication in an area of the mass storage memory that is not subject to logical to physical mapping, in order for the information to be more reliably and quickly retrieved. For more information on this, please refer to application Ser. No. 11/317,341, filed Dec. 22, 2005, entitled “Methods Used in a Secure Yet Flexible System Architecture for Secure Devices With Flash Mass Storage Memory” to M. Holtzman et al., application Ser. No. 11/317,339, filed Dec. 22, 2005, entitled “Secure Yet Flexible System Architecture for Secure Devices With Flash Mass Storage Memory” to M. Holtzman et al., which are hereby incorporated by this reference in their entireties. The seeds may also be loaded into hidden partitions of the device. Loading of the seeds, wherever they are stored, may also only be possible if the entity wishing to load the seeds has adequate permission and/or credentials to do so. In certain embodiments, this permission is contained in an access control record, which will be discussed later.
The present invention utilizes a portable mass storage device for security purposes. The device has security features built into the device that i) limit access to information stored on the device, and ii) make the device function as a type of “key” that allows access to other secure systems and data. The present invention also includes a system that uses a portable mass storage device to verify the credentials of a user. Once verified the user will be allowed access to information he would otherwise not be able to access.
Typically static passwords have been used to verify the credentials of a user. However, a static password is easy to pilfer and affords little protection, especially given the widespread “phishing” for passwords and other personal information today. As discussed previously in the Background, dedicated OTP token systems have also been implemented. These dedicated tokens are a burden to carry, are costly, and have not been widely accepted in the marketplace. These tokens also do not have the mass storage functionality of a memory card or USB drive.
Today, almost everybody who has a digital camera, video recorder, PDA, portable music player, or personal computer has a memory card or a pocket sized USB drive, sometimes referred to as a “thumb” drive. The present invention removes the barrier to entry of requiring a separate dedicated token (or other dedicated device) for implementing an OTP. If a user need not carry multiple devices, but can instead utilize something he already has, the acceptance and usage of OTP and two factor authentication should grow substantially. This results in better security measures and less risk of fraud in electronic commerce and other areas.
The present invention includes cryptographic functionality. In a preferred embodiment it includes a hardware-based cryptographic engine, although the cryptographic functionality can alternatively be primarily firmware based. It is advantageous to include some form of cryptography to increase the effort that would be required to hack the system. An advantage of using a hardware based cryptographic engine is that the firmware can be tied to the cryptographic engine in such a way that the firmware won't be executed unless singed by the hardware. This means that both the authentic firmware and hardware need to be present for the device to work. One or the other cannot be replaced with pieces designed to compromise the security of the device and allow unauthorized copying of the contents. For more information please refer to U.S. patent application Ser. No. 11/285,600, filed Nov. 21, 2005, entitled “Hardware Driver Integrity Check of Memory Card Controller Firmware” to Holtzman et al, which is hereby incorporated by this reference in its entirety.
A PC or cell phone has an open architecture which is vulnerable to all forms of hacking. An advantage of the present invention is that by placing the cryptographic capabilities within the mass storage device, a very secure and limited API can be utilized as compared to what would be present on a typical personal computer (“PC”) or electronic device such as a cellular telephone. The secure API of the mass storage device is such that there is no way for hackers to use a normal logical interface to attempt to discern the cryptographic secrets contained within the mass storage device. In essence the mass storage device of the present invention is made to be much more secure than the host to which it is coupled.
Reference will now be made to the figures. FIG. 1 illustrates a system with which the portable mass storage device (“MSD”) can be used for authentication and password management. MSD 100 is connected to a host computing device 110 via connection 102. Connection 102 can be any type of direct or wireless connection. Some examples of a wireless connection include: OTA—over the air—which uses standard phone communication link; radio frequencies some of which involved selected ranges and protocols such as wi-fi (802.11x) and Bluetooth; inductive near field communications (“NFC”); and infrared. In the currently preferred embodiments, MSD 100 takes the form of a USB drive or a memory card, and therefore the connection is direct and the MSD will interface with a receptacle 104 of the host device. As will be discussed in greater detail later, MSD 100 has a mass storage memory used to frequently and rapidly store and retrieve large user files. These user files can be any type of file and commonly include digital photos and music, as well as executable software programs. In the case of a wireless connection 102, receptacle 104 would not be a physical receptacle but would instead be a wireless transceiver.
Host computing device 110 can be any type of smart electronic device, and will for convenience be simply referred to as the host. Some examples of host 110 would include a personal computer, cellular telephone, or handheld organizer/email device (“PDA”). In fact, the host can be any electronic device that can be used to access a user's accounts and/or sites of interest. Host 110 is connected to a network that is in turn connected with various institutions 118 and other entities. Only one institution 118 is shown for simplicity. The network may comprise any type of wide area network such as the Internet, and various types of cellular telephone networks. Certain networks may also utilize satellite communications. One type of entity connected to the network is a validating or authenticating entity 124. Entity 124 comprises one or more servers. In the case where host 110 is a PC, a virtual private network (“VPN”) connection may be established if desired. In addition to network connection 114 that connects the host to the institution 118, and network connection 116, that connects the host to the validating entity 124, there may also exist a separate, non-network connection 122 between institution 118 and validating entity 124. Certainly institutions 118 can also communicate with entities 124 over the network as well.
FIG. 3A illustrates some of the physical components of MSD 100. Interface 304 sends and receives data and commands to and from MSD 100 and communicates the information with controller 306. As mentioned previously, interface 304 in some embodiments comprises the electrical contacts and/or connector of the mass storage device, while in other embodiments it comprises a wireless transceiver. In certain of the embodiments, power for MSD 100 may also be received via device interface 304. Controller 306 comprises a microprocessor and it controls all of the data storage operations of MSD 100. This means that it orchestrates all of the read and write operations to and from the mass storage memory 308, which is preferably of the flash variety. Although the controller and mass storage memory are illustrated as being connected serially, they are in reality normally connected via a bus. Also on the bus may be various other components including read only memory (“ROM”) and random access memory (“RAM”). MSD 100 is capable of reading and writing encrypted files in mass storage memory 308, and this is accomplished in the preferred embodiments with an encryption engine within controller 306. The controller executes firmware in order to run MSD 100, and this firmware can be located on a dedicated ROM, or alternatively stored in the flash memory 308. The firmware is preferably stored in mass storage memory 308, in order to eliminate the cost of a ROM to store the firmware. Storing the firmware that runs the MSD in the flash memory 308, which lacks the intrinsic protection of a ROM, requires extensive protection mechanisms in MSD 100 that ensure that the copy protection routines in the firmware cannot be tampered with or that the firmware cannot be entirely replaced with malicious/unsecure firmware.
As seen in FIG. 3B, flash memory 308 has a secure area 308A where the firmware and other information essential to the operation of the MSD is located. In some embodiments, the firmware is encrypted and will not be executed unless it is first determined to be authentic. For more information on authentication of firmware please refer to application Ser. No. 11/285,600, filed Nov. 21, 2005, entitled “Hardware Driver Integrity Check of Memory Card Controller Firmware” to Holtzman et al., incorporated by reference in its entirety. Also, in some embodiments, writing to the secure area 308 can only be performed in certain operating states of the device. Generally speaking, this also serves to protect from tampering or replacement of the firmware, and for more information on operating states of the mass storage device, please see application Ser. No. 11/053,273, filed Feb. 7, 2005, entitled “Secure Memory Card with Life Cycle Phases” to M. Holtzman et al., incorporated by reference in its entirety. These protections need to be in place because the mass storage device is used for general purpose file storage, and in particular to store copyrighted works that cannot be freely available for copying. For example, music on the MSD must be protected from unauthorized copying (this is not an issue with dedicated tokens that cannot be used to store user files). This is of particular importance when the firmware for controlling the device resides in the same mass storage memory as the user files, rather than on a dedicated storage device such as a ROM, that is intrinsically more difficult to hack.
Logical slots 310A, 310B . . . 310x. are located in the secure area 308A. These slots can also be in the file storage area 308B. A slot is a protected logical memory area that is used to store the information necessary to log a user into an institution. The information is encrypted as one security measure. This can include the user's identifying information such as his name address account number etc . . . , the user's secret such as a password or PIN, and the information necessary to generate OTP values, including the algorithms and seed values for each institution. Each institution will have its own slot. In certain embodiments, each account within an institution may have its own slot. Login and the use of slots will be explained in more detail later. In an embodiment of the invention, the slots of the MSD may be located in a system area of the mass storage memory that is not subject to logical to physical mapping, in order for the information to be more reliably and quickly retrieved. The seeds used for OTP generation may also be stored in an area of memory 308 that is hidden from a computer that has access to the files in file storage area 308B. This may be done within a hidden partition located anywhere in memory 308.
As mentioned previously, seeds can be loaded into MSD 100 at different times. It is important that an entity wishing to load seeds into the card be verified before loading takes place. In one embodiment, this is managed with a secure storage application (“SSA”), which is a security module of the mass storage device. This can interact with the client application 320 or through a management layer within the device. The SSA and other related information is described in patent application Ser. No. 11/313,536, entitled “Control Structure for Versatile Content Control,” to Fabrice Jogand-Coulomb et al, which is hereby incorporated by this reference in its entirety. The SSA system sits atop the storage system of the MSD and adds a security layer for stored files and other data, including, in one embodiment, the seeds.
SSA partitions are hidden (from the host operating system or OS and all other entities) partitions that can be accessed only through the SSA. The SSA system will preferably not allow the host device or other entity to access an SSA partition, other than through a session established by logging onto an access control record (“ACR”). Similarly, preferably the SSA will not provide information regarding the existence, size and access permission of an SSA partition, unless this request is coming through an established session by an appropriate authority or entity.
FIG. 10C illustrates the process of user and device authentication (step 915 of FIG. 9) in more detail. This is also shown in FIG. 5B. When the device gets activated it is bound and associated to an institution or account. This is done by using the device ID and slot information. The institution then needs to associate the device and its contents to the user name and password so that it can authenticate the user with device presented information plus the user specific information (user identifying information and secret). In step 960, the MSD is connected to the host if it is not already connected. Next in step 962, the client is launched if it is not open and running, and in step 964 the user enters in his identifying information (e.g. user name, account number etc.) and his secret (e.g. password or PIN). Next, in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot. In step 968, the OTP value, user identifying information and user secret are submitted to the institution. Then, in step 970 the institution validates that the user for access to the institution. This involves steps 970A and 970B. In step 970A the institution validates the user identifying information and secret with the institutions database(s). It also, in step 970B, validates OTP value and token ID of MSD 100 with validation server 124. If then user has been successfully validated in step 970 he is then logged into the institution in step 974.
PKI is an authentication technology. Using a combination of secret key and public key cryptography, PKI enables a number of other security services including data confidentiality, data integrity, and key management. The foundation or framework for PKI is defined in the ITU-TX.509 Recommendation [X.509] which is incorporated by this reference it is entirety.
Public keys are distributed in the form of public key certificates by CA 550. A certificate could be required from MSD 100 so that an institution 118 or validating entity would allow a user of MSD 100 to sign on. A certificate from an institution 118 could also be utilized to prove that the institution is authentic before the MSD would sign the user into the institution. Public key certificates are digitally signed by the issuing CA 520 (which effectively binds the subject name to the public key). CAs are also responsible for issuing certificate revocation lists (“CRLs”) unless this has been delegated to a separate CRL Issuer. CAs may also be involved in a number of administrative tasks such as end-user registration, but these are often delegated to a separate registration authority (“RA”) which is optional and not shown in FIG. 5C. In practice, CA 520 or another CA can also serve as the key backup and recovery facility although this function can also be delegated to a separate component. CAs are often thought of as the “source of trust” in a PKI. Typically, End Entities are configured with one or more “trust anchors” which are then used as the starting point to validate a given certification path. Once trust is established via the PKI interface, login can take place.
FIGS. 11A-I and 12A-B are interface screens of different embodiments of client 320. These screens serve to illustrate the convenience of the present invention. To a user, the login process becomes very simple, although relatively complex calculations and interactions are taking place “behind the scenes.” For example, the user is unaware that the device is seeded for each institution selected, that the seed is used by a complex algorithm to generate a new (OTP) value for each login that is validated along with the user's other information automatically. The present invention combines a very high level of security with seamless automation in password management. This can also include a single sign on in certain embodiments, where the user's master information is automatically correlated with all the individual passwords and usernames for different institutions. There are a number of other methods of user identification that can be used with the present invention, such as biometrics, answering questions, etc. In one embodiment, the system may be employed to provide user information for more general two-factor authentication and/or password management operations, some of which information may be more sensitive than other information. The system may be designed to segregate such sensitive information and request user verification, additional entry of a PIN/password, or other action to ensure the user is aware of and authorizes such information to be provided by the system. One example of this may be for credit card authorization and payment.
FIG. 11A shows a welcome screen, and FIG. 11B is an interface where the user can fill out his password and user name to access a particular institution. The user can enter a new institution or access an institution that has previously been configured. In this screen the user can enter the device ID of his MSD, although in the preferred embodiments the client will retrieve this information without the user having to enter it. In FIG. 11C a user interface informs the user that the system is binding the MSD to his account(s). In this case the selected institution is a financial institution or broker. As seen in FIG. 11D, the user can access multiple accounts he may have at a particular institution, and can add, edit, and delete accounts. In FIG. 11E, the user is asked to enter his master password. This is a password that is later correlated by the system with all the user's other passwords and account info. Once the user has been bound, in one embodiment, he need only enter this master password and in order to access his account the process will begin at FIG. 11D, rather than 11A or 11B. In FIG. 11F, the user is asked to wait as the system connects to his account. Next, the user is informed that he is securely connected to his account in FIG. 11G. At this stage, the web page or other interface of the institution will be opened on the host device of the user. When the user is finished accessing his account(s) he can then click the exit button of the user interface screen shown in FIG. 11H. The user can then connect to additional accounts, as seen in FIG. 11 i. FIGS. 12A-B depict user interface screens of another embodiment of client 320. In FIG. 12A, icons representing a number of different institutions are simultaneously displayed on one user interface screen. The user can add an institution, also referred to as an “account,” and edit or remove an account. The institutions can be manually added by the user, or alternatively the user could select from a list maintained by the MSD. Such a list would be updated remotely to the MSD from a server, either upon request by the user or automatically based on some schedule of update. The list could also be updated based upon based upon any number of events such as upon request for user enrollment. By clicking on buttons within each of the icons, the user can also access or log into the account and close or log off the account. As seen in FIG. 12B, when the user clicks on a particular account to open it, the client will allow the user to choose between his accounts at the particular institution, which can also be referred to as “sub-accounts.”
The operations described in detail earlier in the application that facilitate sign on would then take place seamlessly behind the scenes. This would simultaneously make dealing with logon and password management very convenient for the user, while at the same time providing for a very high level of security that would benefit users and institutions alike. All of this convenience and security are incorporated into a device a user most likely already owns. This is possible, because, unlike in dedicated tokens, the client can be added to the mass storage memory of a pocket sized mass storage device. The portable mass storage device has security, both physical and logical, that are more robust than in an open environment such as a PC, and hacking or “phishing” for information is therefore much more difficult. Also, unlike some mass storage devices that may correlate different passwords or other information, the present invention utilizes algorithms and processes that can generate unique password values that are constantly changing yet instantly verifiable.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS4549896Aug 27, 1984Oct 29, 1985Owens-Corning Fiberglas CorporationApparatus and method for removing gaseous inclusions from molten materialUS4590552Jun 30, 1982May 20, 1986Texas Instruments IncorporatedSecurity bit for designating the security status of information stored in a nonvolatile memoryUS4697072Aug 27, 1985Sep 29, 1987Casio Computer Co., Ltd.Identification card and authentication system thereforUS4713753Feb 21, 1985Dec 15, 1987Honeywell Inc.Secure data processing system architecture with format controlUS4780905Nov 26, 1984Oct 25, 1988Nightwatch, Inc.Computer data encryption systemUS4797853Nov 15, 1985Jan 10, 1989Unisys CorporationDirect memory access controller for improved system security, memory to memory transfers, and interrupt processingUS4907268Mar 15, 1989Mar 6, 1990Enigma Logic, Inc.Methods and apparatus for controlling access to information processed a multi-user-accessible digital computerUS5006823Oct 23, 1989Apr 9, 1991Thomson-CsfMicrowave phase shifter with 0 or π phase shiftUS5052040May 25, 1990Sep 24, 1991Micronyx, Inc.Multiple user stored data cryptographic labeling system and methodUS5065429Oct 14, 1990Nov 12, 1991Lang Gerald SMethod and apparatus for protecting material on storage mediaUS5129074Sep 20, 1989Jul 7, 1992Hitachi Vlsi Engineering CorporationData string storage device and method of storing and retrieving data stringsUS5235641Mar 12, 1991Aug 10, 1993Hitachi, Ltd.File encryption method and file cryptographic systemUS5237609Mar 26, 1990Aug 17, 1993Mitsubishi Denki Kabushiki KaishaPortable secure semiconductor memory deviceUS5268870Aug 6, 1990Dec 7, 1993Eliyahou HarariFlash EEPROM system and intelligent programming and erasing methods thereforUS5293424Oct 14, 1992Mar 8, 1994Bull Hn Information Systems Inc.Secure memory cardUS5311595Jun 7, 1990May 10, 1994Kommunedata I/SMethod of transferring data, between computer systems using electronic cardsUS5319765Nov 27, 1991Jun 7, 1994Mitsubishi Denki Kabushiki KaishaSemiconductor memory unit utilizing a security code generator for selectively inhibiting memory accessUS5327563Nov 13, 1992Jul 5, 1994Hewlett-PackardMethod for locking software files to a specific storage deviceUS5404485Mar 8, 1993Apr 4, 1995M-Systems Flash Disk Pioneers Ltd.Flash file systemUS5438575Nov 16, 1992Aug 1, 1995Ampex CorporationData storage system with stale data detector and method of operationUS5442704Jan 14, 1994Aug 15, 1995Bull Nh Information Systems Inc.Secure memory card with programmed controlled security access controlUS5455862Dec 2, 1993Oct 3, 1995Crest Industries, Inc.Apparatus and method for encrypting communications without exchanging an encryption keyUS5473692Sep 7, 1994Dec 5, 1995Intel CorporationRoving software license for a hardware agentUS5477039Dec 14, 1993Dec 19, 1995Gemplus Card InternationalMethod and device to increase the protection of a chip cardUS5509120Nov 30, 1993Apr 16, 1996International Business Machines CorporationMethod and system for detecting computer viruses during power on self testUS5530862Nov 18, 1992Jun 25, 1996Canon Kabushiki KaishaIn an interactive network board, method and apparatus for loading independently executable modules in promUS5596738Apr 12, 1995Jan 21, 1997Teac CorporationPeripheral device control system using changeable firmware in a single flash memoryUS5604801Feb 3, 1995Feb 18, 1997International Business Machines CorporationPublic key data communications system under control of a portable security deviceUS5606660Oct 21, 1994Feb 25, 1997Lexar Microsystems, Inc.Method and apparatus for combining controller firmware storage and controller logic in a mass storage systemUS5629513Mar 3, 1995May 13, 1997Gemplus Card InternationalMethod for the functioning of a chip card, and chip card in accordance therewithUS5684742Jun 12, 1996Nov 4, 1997International Business Machines CorporationDevice and method for the simplified generation of tools for the initialization and personalization of and communication with a chip cardUS5687235Oct 26, 1995Nov 11, 1997Novell, Inc.Certificate revocation performance optimizationUS5710639Jan 25, 1996Jan 20, 1998Kuznicki; William JosephScan line compressed facsimile communication systemUS5742616Jun 7, 1995Apr 21, 1998International Business Machines CorporationSystem and method testing computer memoriesUS5825880Jun 4, 1997Oct 20, 1998Sudia; Frank W.Multi-step digital signature method and systemUS5825882Nov 19, 1993Oct 20, 1998Gemplus Card InternationalEncryption and authentication method and circuit for synchronous smart cardUS5841871 *Nov 18, 1996Nov 24, 1998Bull S.A.Method for authenticating a user working in a distributed environment in the client/server modeUS5857020Dec 4, 1995Jan 5, 1999Northern Telecom Ltd.Timed availability of secured content provisioned on a storage mediumUS5860082Mar 28, 1996Jan 12, 1999Datalight, Inc.Method and apparatus for allocating storage in a flash memoryUS5886926Jan 20, 1998Mar 23, 1999Motorola Inc.Circuit and method of measuring the negative threshold voltage of a non-volatile memory cellUS5896398Oct 15, 1997Apr 20, 1999Advantest Corp.Flash memory test systemUS5903651May 14, 1996May 11, 1999Valicert, Inc.Apparatus and method for demonstrating and confirming the status of a digital certificates and other dataUS5917909Dec 22, 1993Jun 29, 1999Gao Gesellschaft Fur Automation Und Organisation MbhSystem for testing the authenticity of a data carrierUS5930167Jul 30, 1997Jul 27, 1999Sandisk CorporationMulti-state non-volatile flash memory capable of being its own two state write cacheUS5933854Oct 10, 1995Aug 3, 1999Mitsubishi Denki Kabushiki KaishaData security system for transmitting and receiving data between a memory card and a computer using a public key cryptosystemUS5937425Oct 16, 1997Aug 10, 1999M-Systems Flash Disk Pioneers Ltd.Flash file system optimized for page-mode flash technologiesUS5943423Dec 15, 1995Aug 24, 1999Entegrity Solutions CorporationSmart token system for secure electronic transactions and identificationUS5949877Jan 30, 1997Sep 7, 1999Intel CorporationContent protection for transmission systemsUS5956405Jan 17, 1997Sep 21, 1999Microsoft CorporationImplementation efficient encryption and message authenticationUS5987134Feb 24, 1997Nov 16, 1999Fuji Xerox Co., Ltd.Device and method for authenticating user's access rights to resourcesUS5995623Jan 27, 1997Nov 30, 1999Fuji Xerox Co., Ltd.Information processing apparatus with a software protecting functionUS5995965Nov 18, 1996Nov 30, 1999Humetrix, Inc.System and method for remotely accessing user data recordsUS6026402Jan 7, 1998Feb 15, 2000Hewlett-Packard CompanyProcess restriction within file system hierarchiesUS6028933Apr 17, 1997Feb 22, 2000Lucent Technologies Inc.Encrypting method and apparatus enabling multiple access for multiple services and multiple transmission modes over a broadband communication networkUS6067621 *Oct 6, 1997May 23, 2000Samsung Electronics Co., Ltd.User authentication system for authenticating an authorized user of an IC cardUS6073234Apr 27, 1998Jun 6, 2000Fuji Xerox Co., Ltd.Device for authenticating user's access rights to resources and methodUS6094724Nov 26, 1997Jul 25, 2000Atmel CorporationSecure memory having anti-wire tappingUS6101588Sep 25, 1997Aug 8, 2000Emc CorporationDevice level busy arrangement for mass storage subsystem including a plurality of devicesUS6134550Mar 18, 1998Oct 17, 2000Entrust Technologies LimitedMethod and apparatus for use in determining validity of a certificate in a communication system employing trusted pathsUS6148354Apr 5, 1999Nov 14, 2000M-Systems Flash Disk Pioneers Ltd.Architecture for a universal serial bus-based PC flash diskUS6154544Jun 11, 1997Nov 28, 2000The Chamberlain Group, Inc.Rolling code security systemUS6158004Nov 25, 1997Dec 5, 2000Mitsubishi Denki Kabushiki KaishaInformation storage medium and security method thereofUS6181252Aug 22, 1997Jan 30, 2001Denso CorporationRemote control system and method having a system-specific codeUS6182229Nov 30, 1999Jan 30, 2001Sun Microsystems, Inc.Password helper using a client-side master password which automatically presents the appropriate server-side password in a particular remote serverUS6189097Mar 24, 1997Feb 13, 2001Preview Systems, Inc.Digital CertificateUS6209099Jul 14, 1997Mar 27, 2001Ncr CorporationSecure data processing method and systemUS6223271Jul 15, 1998Apr 24, 2001Compaq Computer Corp.System and method for detecting system memory size using ROM based paging tablesUS6230223Jun 1, 1998May 8, 2001Compaq Computer CorporationDual purpose apparatus method and system for accelerated graphics or second memory interfaceUS6230233Sep 13, 1991May 8, 2001Sandisk CorporationWear leveling techniques for flash EEPROM systemsUS6236280Sep 20, 1999May 22, 2001Advanced Micro Devices Inc.Low-noise voltage controlled oscillatorUS6243816Apr 30, 1998Jun 5, 2001International Business Machines CorporationSingle sign-on (SSO) mechanism personal key managerUS6253328Feb 12, 1998Jun 26, 2001A. James Smith, Jr.Method and apparatus for securing passwords and personal identification numbersUS6343291Feb 26, 1999Jan 29, 2002Hewlett-Packard CompanyMethod and apparatus for using an information model to create a location tree in a hierarchy of informationUS6353888Jul 6, 1998Mar 5, 2002Fuji Xerox Co., Ltd.Access rights authentication apparatusUS6356941Feb 22, 1999Mar 12, 2002Cyber-Ark Software Ltd.Network vaultsUS6370251Jun 8, 1998Apr 9, 2002General Dynamics Decision Systems, Inc.Traffic key access method and terminal for secure communication without key escrow facilityUS6371377Jun 16, 1998Apr 16, 2002Fujitsu LimitedCard type recording medium and access control method for card type recording medium and computer-readable recording medium having access control program for card type recording medium recordedUS6385729May 26, 1998May 7, 2002Sun Microsystems, Inc.Secure token device access to services provided by an internet service provider (ISP)US6389542May 3, 2000May 14, 2002Terence T. FlyntzMulti-level secure computer with token-based access controlUS6393565Aug 3, 1998May 21, 2002Entrust Technologies LimitedData management system and method for a limited capacity cryptographic storage unitUS6422460Jan 29, 1999Jul 23, 2002Verisign, Inc.Authorization system using an authorizing deviceUS6434700Dec 22, 1998Aug 13, 2002Cisco Technology, Inc.Authentication and authorization mechanisms for Fortezza passwordsUS6445794Jun 24, 1998Sep 3, 2002Benyamin RonSystem and method for synchronizing one time pad encryption keys for secure communication and access controlUS6456528Sep 17, 2001Sep 24, 2002Sandisk CorporationSelective operation of a multi-state non-volatile memory system in a binary modeUS6457126Jul 20, 2000Sep 24, 2002Tokyo Electron Device LimitedStorage device, an encrypting/decrypting device and method of accessing a non-volatile memoryUS6481632Oct 26, 1999Nov 19, 2002Visa International Service AssociationDelegated management of smart card applicationsUS6490680Dec 4, 1998Dec 3, 2002Tecsec IncorporatedAccess control and authorization systemUS6510501May 11, 1999Jan 21, 2003National Semiconductor CorporationNon-volatile memory read/write security protection feature selection through non-volatile memory bitsUS6513116Sep 29, 1998Jan 28, 2003Liberate TechnologiesSecurity information acquisitionUS6522655May 11, 1999Feb 18, 2003Telefonaktiebolaget Lm Ericsson (Publ)Method and apparatus in a telecommunications systemUS6571335Apr 1, 1999May 27, 2003Intel CorporationSystem and method for authentication of off-chip processor firmware codeUS6577734Oct 31, 1995Jun 10, 2003Lucent Technologies Inc.Data encryption key management systemUS6615347Jun 30, 1998Sep 2, 2003Verisign, Inc.Digital certificate cross-referencingUS6615352Jul 20, 1998Sep 2, 2003Fuji Xerox Co., Ltd.Device and method for authenticating user's access rights to resourcesUS6629192Dec 30, 1999Sep 30, 2003Intel CorporationMethod and apparatus for use of a non-volatile storage management system for PC/AT compatible system firmwareUS6671808Mar 30, 1999Dec 30, 2003Rainbow Technologies, Inc.USB-compliant personal keyUS6678741Apr 9, 1999Jan 13, 2004Sun Microsystems, Inc.Method and apparatus for synchronizing firmwareUS6678828Jul 22, 2002Jan 13, 2004Vormetric, Inc.Secure network file access control systemUS6694436May 19, 1999Feb 17, 2004ActivcardTerminal and system for performing secure electronic transactionsUS6714921Feb 7, 2001Mar 30, 2004Contentguard, Inc.System for controlling the distribution and use of digital works using digital ticketsUS7409705 *Jun 9, 2006Aug 5, 2008Computer Systems Engineering Co., Ltd.System and method for user authenticationUS7519989 *Jul 15, 2004Apr 14, 2009Av Thenex Inc.Token device that generates and displays one-time passwords and that couples to a computer for inputting or receiving data for generating and outputting one-time passwords and other functionsUS20050015588 *Jul 15, 2004Jan 20, 2005Paul LinToken device that generates and displays one-time passwords and that couples to a computer for inputting or receiving data for generating and outputting one-time passwords and other functionsUS20060083228 *Oct 20, 2004Apr 20, 2006Encentuate Pte. Ltd.One time passcode systemUS20060106606 *Oct 17, 2005May 18, 2006Labaton Isaac JMethod and apparatus for the secure identification of the owner of a portable deviceUS20060107063 *Apr 11, 2005May 18, 2006Michael FiskeGenerating requests for access to a passcode protected entityUS20060107064 *Apr 14, 2005May 18, 2006Michael FiskeAPI for a system having a passcode authenticatorUS20060107312 *Apr 7, 2005May 18, 2006Michael FiskeSystem for handing requests for access to a passcode protected entityUS20060107316 *Apr 6, 2005May 18, 2006Michael FiskeDetermining whether to grant access to a passcode protected systemUS20070067828 *Aug 11, 2006Mar 22, 2007Msystems Ltd.Extended one-time password method and apparatusUS20070113294 *Nov 3, 2006May 17, 2007John FieldPassword Presentation for Multimedia DevicesUS20070130472 *Sep 21, 2006Jun 7, 2007Broadcom CorporationSystem and method for securely provisioning and generating one-time-passwords in a remote deviceUS20070234064 *Mar 28, 2007Oct 4, 2007Casio Computer Co., Ltd.Identification information output deviceUS20070250920 *Apr 23, 2007Oct 25, 2007Jeffrey Dean LindsaySecurity Systems for Protecting an AssetUS20080077799 *Nov 30, 2007Mar 27, 2008Labaton Isaac JMethod and apparatus for the secure identification of the owner of a portable deviceUS20080082447 *Aug 8, 2006Apr 3, 2008Fabrice Jogand-CoulombPortable Mass Storage Device With Virtual Machine ActivationUS20080276098 *Sep 10, 2007Nov 6, 2008Microsoft CorporationOne-time password access to password-protected accountsUS20080313719 *Oct 31, 2007Dec 18, 2008Kaliski Jr Burton SMethods and Apparatus for Delegated AuthenticationUS20090125997 *Oct 31, 2008May 14, 2009Debra L CookNetwork node with one-time-password generator functionalityUS20090205036 *Feb 8, 2008Aug 13, 2009Intersections, Inc.Secure information storage and delivery system and methodUS20090249076 *Apr 1, 2009Oct 1, 2009Allone Health Group, Inc.Information server and mobile delivery system and methodUS20090259588 *Jun 22, 2009Oct 15, 2009Jeffrey Dean LindsaySecurity systems for protecting an assetUSRE36181Nov 8, 1996Apr 6, 1999United Technologies Automotive, Inc.Pseudorandom number generation and crytographic authenticationEP1933252A1 *Dec 13, 2006Jun 18, 2008Axalto S.A.Dynamic OTP Token* Cited by examinerNon-Patent CitationsReference1Akagi, A., "SD Format Verification," Matsushita Technical Journal Apr. 2002 vol. 49, No. 2 pp. 11-14 ISSN: 1343-9529.2Allard, J.J., "Dynamic Memory Array Card Burn In and High Speed Functional Card Testing," 1981 International Test Conference, Testing in the 1980's pp. 244-248.3Barsness, A.R. et al.,"ECC Memory Card with Built In Diagnostic Aids and Multiple Usage," IBM Technical Disclosure Bulletin, Apr. 1982 vol. 24, No. 11B pp. 6173-6174.4Black, John, "Comments to NIST concerning AES Modes of Operations: A Suggestion for Handling Arbitrary-Length Messages with the CBC MAC," University of Nevada, Reno, Phillip Rogaway, University of California at Davis http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/xcbc-mac/xcbc-mac-spec.pdf, 3 pages.5Buhse, "Implications of Digital Rights Management for Online Music—A Business Perspective," T. Sander (Ed.), Security and Privacy in Digital Rights Management, ACM CCS-8 Workshop DRM, LNCS 2320, pp. 201-212, (2001).6Communication pursuant to Article 94(3) EPC corresponding to European Patent Application No. 06 786 405.2 (Jul. 30, 2008).7Communication Relating to the Results of the Partial International Search for International Application No. PCT/US2006/026241 mailed Dec. 18, 2006, 3 pages.8Deepakumara, Janaka, et al., "Performance Comparison of Message Authentication Code (MAC) Algorithms for the Internet Protocol Security (IPSEC) Electrical and Computer Engineering," Memorial University of Newfoundland, St. John's, NL, Canada, A1B3S7 http://www.engr.mun.ca/~howard/PAPERS/necec-2003b.pdf, 7 pages.9Deepakumara, Janaka, et al., "Performance Comparison of Message Authentication Code (MAC) Algorithms for the Internet Protocol Security (IPSEC) Electrical and Computer Engineering," Memorial University of Newfoundland, St. John's, NL, Canada, A1B3S7 http://www.engr.mun.ca/˜howard/PAPERS/necec—2003b.pdf, 7 pages.10Dialog OneSearch, 5 pages, http://www.dialog.com/dwpi/ (Jun. 26, 2006).11Dialog OneSearch, 50 pages, http://www.dialog.com/dwpi/ (Jun. 2006).12Dialog OneSearch, 55 pages, http://www.dialog.com/dwpi/ (Sep. 15, 2006).13Dialog OneSearch, 56 pages, http://www.dialog.com/dwpi/ (Sep. 12, 2006).14Dialog Search, Oct. 3, 2005 (31 pages).15Dialog Search, Oct. 6, 2004 (15 pages).16Discretix Technologies Ltd. "Secure Flash(TM) System Specification", Version 1.05, Jul. 15, 2004, Netanya, Israel (36 pages).17Discretix Technologies Ltd. "Secure Flash™ System Specification", Version 1.05, Jul. 15, 2004, Netanya, Israel (36 pages).18Donnan, R.A., "Transmission Synchronizing Method," IBM Technical Bulletin, vol. 11, No. 11, pp. 1570, (Apr. 1969).19Engelbrecht, R., et al., ByMedCard-An Electronic Patient Record with Chip Card Functionality, Health Cards '97 Fourth International Congress pp. 313-317, 1997.20European Examination Report in Application No. 06814655.4, (Feb. 9, 2009).21Federal Information Processing Standards Publications 180-2, "Secure Hash Standard", pp. 1-75, http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf, (Aug. 1, 2002).22Final Official Action for U.S. Appl. No. 11/053,273 (Nov. 9, 2009).23Final Official Action for U.S. Appl. No. 11/313,536 (Apr. 14, 2008).24Final Official Action for U.S. Appl. No. 11/313,538 (Apr. 9, 2008).25Final Official Action for U.S. Appl. No. 11/313,538 (Jun. 8, 2009).26Final Official Action for U.S. Appl. No. 11/313,870 (Apr. 1, 2008).27Final Official Action for U.S. Appl. No. 11/314,055 (Apr. 1, 2008).28Final Official Action for U.S. Appl. No. 11/317,341 (Nov. 28, 2008).29Final Official Action for U.S. Appl. No. 11/317,862 (Jul. 6, 2009).30Final Official Action for U.S. Appl. No. 11/319,835 (Jan. 7, 2010).31Final Official Action for U.S. Appl. No. 11/342,168 (Nov. 19, 2009).32Frankel, Sheila, "RFC 3566-The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec," NIST-National Institute of Standards and Technology, 820 West Diamond Ave., Room 677, Gaithersburg, MD 20899, http://www.faqs.org/rfcs/rfc3566.html, 10 pages.33Frankel, Sheila, "RFC 3566—The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec," NIST-National Institute of Standards and Technology, 820 West Diamond Ave., Room 677, Gaithersburg, MD 20899, http://www.faqs.org/rfcs/rfc3566.html, 10 pages.34Gemplus, Employee Smart Badge, One Integrated and Secure Smart Badge to Manage All Access, 2 pages.35Guibert, H.; Gamache, A., Optical Memory Card Applicability for Implementing a Portable Medical Record, Medical Informatics Jul.-Sep. 1993 vol. 18, No. 3 pp. 271-278 ISSN: 0307-7640.36Haller et al., "A One-Time Password System," IETF Standard-Working-Draft, Internet Engineering Task Force, IETF,No. 1, Mar. 24, 1997, XP015024796, pp. 1-8.37Hinarejos et al, "Revocation Scheme for PMI Based Upon the Tracing of Certificates Chains," Computational Science and its Applications—ICCSA 2006, International Conference, Proceedings (Lecture Notes in Computer Science, vol. 3983), pp. 1098-1106, (Publication Date Unknown).38Hoornaert, Vasco Data Security Enables Secure Communications Over the Internet, IS Audit & Control Journal, vol. IV, 1999, 3 pages.39Housley et al., "Internet X.509 Public Key Infrastructure Certificate and CRL Profile," Network Working Group, RFC 2459, The Internet Society, 137 pages, (Jan. 1999).40Identification Cards-Contactless Integrated Circuit(s) Cards-Proximity Cards-Part 1: Physical Characteristics, ISO-IEC-1444-1-2000-PDF, 10 pages, 2000.41Identification Cards—Contactless Integrated Circuit(s) Cards—Proximity Cards—Part 1: Physical Characteristics, ISO—IEC—1444-1—2000—PDF, 10 pages, 2000.42Identification Cards-Contactless Integrated Circuit(s) Cards-Proximity Cards-Part 1: Physical Characteristics, ISO-IEC-14443-1-2000-PDF, 10 pages.43Identification Cards—Contactless Integrated Circuit(s) Cards—Proximity Cards—Part 1: Physical Characteristics, ISO—IEC—14443-1—2000—PDF, 10 pages.44Identification Cards-Contactless Integrated Circuit(s) Cards-Proximity Cards-Part 2: Radio Frequency Power and Signal Interface, ISO-IEC-14443-2-2001-PDF, 18 pages, 2001.45Identification Cards—Contactless Integrated Circuit(s) Cards—Proximity Cards—Part 2: Radio Frequency Power and Signal Interface, ISO—IEC—14443-2—2001—PDF, 18 pages, 2001.46Identification Cards-Contactless Integrated Circuit(s) Cards-Proximity Cards-Part 2: Radio Frequency Power and Signal Interface, ISO-IEC-14443-2-2001-PDF, 18 pages.47Identification Cards—Contactless Integrated Circuit(s) Cards—Proximity Cards—Part 2: Radio Frequency Power and Signal Interface, ISO—IEC—14443-2—2001—PDF, 18 pages.48iKey 1000, Workstation Security and Secure Remote Access, SafeNet, 2004, 2 pages.49iKey 2032, Personal USB Authentication and Encryption Token, SafeNet, 2005, 2 pages.50International Search Report and Written Opinion for PCT/US2007/015301 (Jan. 10, 2008).51International Search Report and Written Opinion for PCT/US2007/015304 (Mar. 25, 2008).52International Search Report and Written Opinion for PCT/US2007/015431, 14 pages, (Apr. 16, 2008).53International Search Report and Written Opinion for PCT/US2007/015432 (Jan. 17, 2008).54International Search Report and Written Opinion form PCT Application Serial No. PCT/US2007/015430 (Jan. 17, 2008).55International Telecommunication Union, "Series X: Data Networks, Open System Communications and Security (Information Technology-Open Systems Itnerconnection-The Directory: Public-Key and Attribute Certificate Frameworks)," ITU-T, X.509, pp. 1-170, (Aug. 2005).56Interview Summary for U.S. Appl. No. 11/313,538 (Oct. 23, 2009).57Interview Summary for U.S. Appl. No. 11/314,052 (Oct. 27, 2009).58Interview Summary for U.S. Appl. No. 11/314,411 (Nov. 3, 2009).59Interview Summary for U.S. Appl. No. 11/557,052 (Nov. 18, 2009).60Invitation to Pay Additional Fees for International Application No. PCT/US2005/046478, (Jul. 11, 2006).61Invitation to Pay Additional Fees in corresponding Int'l. App. No. PCT/US2006/03589, (Jan. 26, 2007).62Invitation to Pay Additional Fees, for Interntational Application No. PCT/US2005/046689, (Jul. 11, 2006).63ISA/EPO, "Invitation to Pay Additional Fees", mailed on Jan. 26, 2007 in corresponding Int'l. App. No. PCT/US2006/035839, 2 pages.64ISA/EPO, "Invitation to Pay Additional Fees", mailed on1Dec. 18, 2006 in corresponding Int'l. App. No. PCT/US2006/026241, 7 pages.65ISA/EPO, "Invitation to Pay Additional Fees," mailed on Mar. 8, 2007 in corresponding Int'l. App. No. PCT/US2006/003876, 7 pages.66ISA/EPO, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," mailed on Aug. 17, 2007 in corresponding Int'l. App. No. PCT/US2006/003876, 19 pages.67ISA/EPO, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," mailed on Feb. 8, 2007 in corresponding Int'l. App. No. PCT/US2006/026241, 9 pages.68ISA/EPO, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," mailed on Mar. 29, 2007 in corresponding Int'l. App. No. PCT/US2006/035840, 6 pages.69ISA/EPO, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," mailed on May 25, 2007 in corresponding Int'l. App. No. PCT/US2006/035839, 9 pages.70ISA/EPO, "Written Opinion of the International Searching Authority," mailed on Feb. 8, 2007 in corresponding Int'l. App. No. PCT/US2006/026241, 15 pages.71ISA/EPO, "Written Opinion of the International Searching Authority," mailed on Mar. 29, 2007 in corresponding Int'l. App. No. PCT/US2006/035840, 8 pages.72ISA/EPO, "Written Opinion of the International Searching Authority," mailed on Sep. 13, 2006 in corresponding Int'l. App. No. PCT/US2006/035839, 12 pages.73Johnson, D., "Bus Emulation Drives Production Testing," Test & Measurement World Feb. 1995 vol. 15, No. 2 pp. 41-42, 44, 46, 48 ISSN: 0744-1657.74Kikuchi et al., "Performance Evaluation of Public-Key Certificate Revocation System with Balanced Hash Tree," Parallel Processing, 1999 International Workshop on Aizu-Wakamatsu, pp. 204-209, (1999).75Kocher, "On Certificate Revocation and Validation," Lecture Notes in Computer Science, Financial Cryptography (1998).76Lee et al., Modified Token-Update Scheme for Site Authentication, School of Computer Science and Engineering, Inha University, Incheon, 402-751, Korea, 6 pages.77Lloyd et al., "Understanding Certification Path Construction," PKI Forum, pp. 1-14, (Sep. 2002).78Notice of Abandonment for U.S. Appl. No. 11/313,536 (Jan. 2, 2009).79Notice of Abandonment for U.S. Appl. No. 11/313,870 (Oct. 14, 2008).80Notice of Abandonment for U.S. Appl. No. 11/314,053 (Apr. 8, 2009).81Notice of Abandonment for U.S. Appl. No. 11/314,055 (Nov. 10, 2008).82Notice of Abandonment for U.S. Appl. No. 11/317,339 (Feb. 10, 2009).83Notice of Abandonment for U.S. Appl. No. 11/557,056 (Oct. 28, 2009).84Notice of Allowance and Fee(s) Due for U.S. Appl. No. 11/284,623 (Jan. 15, 2009).85Notice of Allowance and Fee(s) Due for U.S. Appl. No. 11/284,623 (Sep. 23, 2008).86Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2005/046478, (Sep. 25, 2006).87Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2005/046689, (Sep. 6, 2006).88Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2005/046793, (Jun. 7, 2006).89Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for Interntational Application No. PCT/US2005/046795, (Jun. 7, 2006).90Nystrom RSA Security M: "The Protected One-Time Password Protocol (EAP-POTP)," IETF Standard-Working-Draft, Internet Engineering Task Force, IETF, CH No. 2, Jun. 30, 2005, XP015040287.91O.J. Horak, "Means and Measures for Data Security," Armed Forces Data Processing Agency, Stifgasse 2a, A-1070 Wien, Austria, IFAC SAFECOMP '89, Vienna, Austria, 1989, 9 pages.92Oasis, "Web Services Security X.509 Certificate Token Profile," OASIS Standard 500401, 16 pages, (Mar. 15, 2004).93Office Action for U.S. Appl. No. 11/313,538 (Oct. 29, 2007).94Office Action for U.S. Appl. No. 11/313,870 (Oct. 29, 2007).95Office Action for U.S. Appl. No. 11/314,052 (May 12, 2009).96Office Action for U.S. Appl. No. 11/314,053 (Nov. 9, 2007).97Office Action for U.S. Appl. No. 11/314,055 (Oct. 29, 2007).98Office Action for U.S. Appl. No. 11/314,410 (May 13, 2009).99Office Action for U.S. Appl. No. 11/314,411 (Jun. 23, 2009).100Office Action for U.S. Appl. No. 11/557,056 (Mar. 16, 2009).101Official Action for Chinese Application No. 2006800089822.0 (Aug. 5, 2009).102Official Action for Chinese Application No. 200680008989.4 (Apr. 24, 2009).103Official Action for Chinese Application No. 200680009222.3 (Jul. 22, 2009).104Official Action for Chinese Application No. 200680032990.0 (Jul. 30, 2009).105Official Action for U.S. Appl. No. 11/053,273 (Nov. 19, 2008).106Official Action for U.S. Appl. No. 11/284,623 (Apr. 30, 2008).107Official Action for U.S. Appl. No. 11/285,600 (Mar. 24, 2009).108Official Action for U.S. Appl. No. 11/313,536 (Oct. 17, 2007).109Official Action for U.S. Appl. No. 11/313,538 (Nov. 20, 2008).110Official Action for U.S. Appl. No. 11/314,053 (Feb. 7, 2008).111Official Action for U.S. Appl. No. 11/317,339 (Aug. 1, 2008).112Official Action for U.S. Appl. No. 11/317,341 (Feb. 21, 2008).113Official Action for U.S. Appl. No. 11/317,341 (Jun. 18, 2009).114Official Action for U.S. Appl. No. 11/317,390 (Apr. 30, 2009).115Official Action for U.S. Appl. No. 11/317,862 (Nov. 19, 2008).116Official Action for U.S. Appl. No. 11/319,835 (May 12, 2009).117Official Action for U.S. Appl. No. 11/557,028 (Nov. 10, 2009).118Official Action for U.S. Appl. No. 11/557,039 (Oct. 13, 2009).119Official Action for U.S. Appl. No. 11/557,041 (Oct. 13, 2009).120Official Action for U.S. Appl. No. 11/557,049 (Dec. 17, 2009).121Official Action for U.S. Appl. No. 11/557,051 (Sep. 29, 2009).122Official Action for U.S. Appl. No. 11/557,052 (Sep. 29, 2009).123Open Specifications Integrate One-Time Passwords with Enterprise Applications, RSA Security, Feb. 2005, 10 pages.124Oritz, "An Introduction to Java Card Technology—Part 1," 17 pages. http://developers.sun.com/techtopics/mobility/javacard/articles/javacard1/, (May 29, 2003).125Orlowski, Andrew, "Everything You Ever Wanted to Know About CPRM, But ZDNet Wouldn't Tell You . . . ," The Register.co.UK, Jan. 10, 2001, 6 pages.126Pinkas, Benny, "Efficient State Updates for Key Management," STAR Lab, Intertrust Technologies, Princeton, NJ, DRM 2001, LNCS 2320 pp. 40-56, 2002.127PNY Technologies Attache Flash Product, http://www.pny.com/products/flash/attache.asp (Copyright 2003).128Random Number Generator, Seed. InWebster's New World(TM) Computer Dictrionary, Wiley Publishing, Inc. (2003), Cited in U.S. Appl. No. 11/557,049 OA.129Random Number Generator, Seed. InWebster's New World™ Computer Dictrionary, Wiley Publishing, Inc. (2003), Cited in U.S. Appl. No. 11/557,049 OA.130Renesas, X-Mobile Card, Digital Rights Management, Authentication and Secure Storage for Mobile Devices, Providing Remote Access and Secure Storage Solutions for IT, Advanced Solutions Group, 2005, 4 pages.131Restriction Requirement for U.S. Appl. No. 11/053,273 (Jun. 8, 2009).132Restriction Requirement for U.S. Appl. No. 11/314,053 (Jul. 1, 2008).133Restriction Requirement for U.S. Appl. No. 11/317,339 (Dec. 14, 2007).134RSA Laboratories, "PKCS#1: RSA Encryption Standard," An RSA Laboratories Technical Note, Version 1.5, 17 pages, Revised Nov. 1, 1993.135RSA Security Inc.: "A CryptoAPI Profile for One-Time Password Tokens V1.0 Draft 2" One-Time Password Specifications (OTPS), Jun. 27, 2005, XP002416270.136RSA Security Inc.: "OTP-WSS-Token: Web Services Security One-Time-Password (OTP) Token Profile, Version 1-0d3", One-Time Password Specifications (OTPS), Jul. 6, 2005, XP002416269.137RSA Security Inc.: "PKCS#11 Mechanisms for One-Time Password Tokens V1.0 5th Draft", One-Time Password Specifications, Jun. 27, 2005, XP002415773.138RSA Security, Federated Identity Management and Return on Investment, White Paper, 2004-2005, 12 pages.139RSA Security, Federated Identity Manager, A Technical Overview, Technology Backgrounder, 2005, 16 pages.140RSA Specification, Cryptographic Token Key Initialization Protocol, V1.0 Draft 3, RSA Security, Jun. 14, 2005, 29 pages.141Rubin, Independent One-Time Passwords, USENIX Association, Proceedings of the Fifth USENIX UNIX Security Symposium, Jun. 5-7, 1995, 13 pages.142Rubin, Independent One-Time Passwords, USENIX, A Quarterly dedicated to the analysis and understanding of advanced computing systems, vol. 9, No. 1, Winter 1996, 15 pages.143SafeNet AXIS, Strong Authentication and Single Sign-On, AXIS Instant Logical & Physical Access Security, 2005, 2 pages.144Sandhu et al., "Access Control: Principles and Practice," IEEE Communications Magazine, IEEE Service Center, New York, NY, vol 32, No. 9, pp. 40-48 (2-5) (Sep. 1, 1994).145SanDisk Corporation "BE2 Architecture", Revision 1.1, Jun. 9, 2003 (21 pages).146SanDisk Corporation I, "CryptoFlash Integration in BE2", Revision 1.21, Oct. 19, 2004, (34 pages).147SanDisk Israel Discloser #SDK0570 "Flash Memory Card with In Stream data Encryption/Decryption", (4 pages).148Secure Business-to-Business Single Sign-On (B2B SSO) Based on Federated Identity Management, RSA Security, 2004-2005, 6 pages.149Seitz et al., Key Management for Encrypted Data Storage in Distributed Systems, Proceeding of the Second IEEE International Security in Storage Workshop (SISW'03), 11 pages.150ST Microelectronics: "Trusted Platform Module (TPM)"; May 2004; XP-002345888; 5 pages.151Supplemental Notice of Allowability and Interview Summary for U.S. Appl. No. 11/284,623 (Oct. 31, 2008).152Thomas, T., "A Mandatory Access Control Mechanism for the Unix� File System," Proceedings of the Aerospace Computer Security Applications Conference, Orlando, Dec. 12-16, 1988, Washington, IEEE Comp. Soc. Press, US, pp. 173-177, (Dec. 12, 1988).153Tsuchida, S., "Test and Repair of Non-Volatile Commodity and Embedded Memories," Proceedings International Test Conference 2002 (Cat. No. 02CH37382) p. 1223 ISBN: 0 7803 7542 4.154U.S. Appl. No. 11/053,273, "Secure Memory Card With Life Cycle Phases", filed Feb. 7, 2005, Holtzman et al.155U.S. Appl. No. 11/284,623, "Method of Hardware Driver Integrity Check of Memory Card Controller Firmware", filed Nov. 21, 2005, Michael Holtzman et al.156U.S. Appl. No. 11/285,600, "Hardware Driver Integrity Check of Memory Card Controller Firmware", filed Nov. 21, 2005, Holtzman et al.157U.S. Appl. No. 11/313,536, "Control Structure for Versatile Content Control", filed Dec. 20, 2005, Fabrice Jogand-Coulomb et al.158U.S. Appl. No. 11/317,339, "Secure Yet Flexible System Architecture for Secure Devices With Flash Mass Storage Memory", filed Dec. 22, 2005, Holtzman et al.159U.S. Appl. No. 11/317,341, "Methods Used in a Secure Yet Flexible System Architecture for Secure Devices With Flash Mass Storage Memory", filed Dec. 22, 2005, Holtzman et al.160U.S. Appl. No. 11/317,390, "Methods Used in a Secure Memory Card With Life Cycle Phases", filed Dec. 22, 2005, Holtzman et al.161U.S. Appl. No. 11/317,862, "Secure Memory Card with Life Cycle Phases", filed Dec. 22, 2005, Holtzman et al.162U.S. Appl. No. 11/319,835, "Mass Storage Device with Automated Credentials Loading", filed Dec. 27, 2005, Gonzalez et al.163U.S. Appl. No. 60/717,163, "Secure Yet Flexible System Architecture for Secure Devices with Flash Mass Storage Memory," filed Sep. 14, 2005, Micky Holtzman.164U.S. Appl. No. 60/717,164, "Secure Yet Flexible System Architecture for Secure Devices with Flash Mass Storage Memory," filed Sep. 14, 2005, Holtzman et al.165U.S. Appl. No. 60/717,347, "Hardware Driver Integrity Check of Memory Card Controller Firmware," filed Sep. 14, 2005, Holtzman et al.166Van Moffaert et al., "Digital Rights Management: DRM is a Key Enabler for the Future Growth of the Broadband Access Market, and the Telecom/Networking Marking in General," Alcatel Telecommunications Review, Alcatel, Paris Cedex, FR, 8 pages (Apr. 2003).167VeriSign, Extending Managed PKI Services to Smart Cards for Greater Convenience and Security, 2001, 14 pages.168VeriSign, Trusted Federated Identity Solution Architecture, 2004, 16 pages.169Weippl, Edgar, "An Approach to Role-Based Access Control for Digital Content," Software Competence Center Hagenberg Hauptstr. 99 A4232 Hagenberg, Austria, 2001, 5 pages.170Wu, D.M., Doney, R., "A Universal Self-Test Design for Chip, Card and System," Proceedings 1992 IEEE International Workshop on Defect and Fault Tolerance in VLSI Systems (Cat. No. 92TH0481-2) pp. 305-314 ISBN: 0 8186 2837 5.171Yang et al., CD-Rom Versus Web-Access to External Databases-Experiences and Insights, Rider University Libraries, pp. 193-200.Referenced byCiting PatentFiling datePublication dateApplicantTitleUS7861015 *Apr 27, 2007Dec 28, 2010Feitian Technologies Co., Ltd.USB apparatus and control method thereinUS8068011Oct 8, 2010Nov 29, 2011Q Street, LLCSystem and method for interactive user-directed interfacing between handheld devices and RFID mediaUS8276196Aug 18, 2008Sep 25, 2012United Services Automobile Association (Usaa)Systems and methods for implementing device-specific passwordsUS8688971 *Feb 8, 2008Apr 1, 2014Ntt It CorporationRemote access methodUS8707049 *Aug 14, 2008Apr 22, 2014Feitian Technologies Co., Ltd.Authentication method and key deviceUS8812860 *Dec 3, 2010Aug 19, 2014Symantec CorporationSystems and methods for protecting data stored on removable storage devices by requiring external user authenticationUS8839385Sep 25, 2012Sep 16, 2014United Services Automobile Association (Usaa)Systems and methods for implementing device-specific passwordsUS8843757 *Nov 10, 2010Sep 23, 2014Ca, Inc.One time PIN generationUS8850218Oct 14, 2013Sep 30, 2014Ca, Inc.OTP generation using a camouflaged keyUS8909708Sep 10, 2012Dec 9, 2014Google Inc.System and method for confirming authorship of documentsUS20070050621 *Aug 30, 2005Mar 1, 2007Kevin YoungMethod for prohibiting an unauthorized component from functioning with a host deviceUS20080082699 *Sep 25, 2007Apr 3, 2008Sandisk Il Ltd.Devices and methods for device-mapping connectivity hubUS20090055892 *Aug 14, 2008Feb 26, 2009Feitian Technologies Co., Ltd.Authentication method and key deviceUS20090328168 *Apr 18, 2007Dec 31, 2009Initech Co., Ltd.Method for registering and certificating user of one time password by a plurality of mode and computer-readable recording medium where program executing the same method is recordedUS20110099636 *Mar 2, 2010Apr 28, 2011Innostor Technology CorporationRead-only protection method for removable storage mediumUS20110113245 *Nov 10, 2010May 12, 2011Arcot Systems, Inc.One time pin generationUS20110191416 *Apr 26, 2010Aug 4, 2011Google, Inc.Content Author BadgesUS20110265156 *Dec 21, 2009Oct 27, 2011Gemalto SaPortable security device protection against keystroke loggersUS20120066749 *Mar 2, 2010Mar 15, 2012Encap AsMethod and computer program for generation and verification of otp between server and mobile device using multiple channelsUS20120216047 *Oct 13, 2011Aug 23, 2012Walton Advanced Engineering Inc.digital key featuring encryption and web guideUS20130132628 *Jun 5, 2012May 23, 2013Universal Scientific Industrial (Shanghai) Co.,LtdPlug-in module, electronic system, and judging method and querying method thereofUS20140101747 *Aug 28, 2012Apr 10, 2014Feitian Technologies Co., Ltd.System and method for communication between dynamic token and toolUS20140282985 *Mar 15, 2013Sep 18, 2014Google Inc.Remote Access Authentication* Cited by examinerClassifications U.S. Classification726/9, 726/20, 713/185, 713/184International ClassificationG06F21/20, G06F7/04, H04L9/32, G06F15/16Cooperative ClassificationH04L2209/56, H04L9/3226, H04L2209/805, H04L9/3263, G06F2221/2115, G06K19/07732, H04L9/3271, G06K19/07, H04L63/0838, H04L63/0853, G06F21/79, G11C7/24, H04L63/0815, G06F21/34, G06F21/31European ClassificationG06K19/07, G11C7/24, H04L9/32T, H04L9/32R, G06K19/077E7, G06F21/31, G06F21/79, G06F21/34, H04L63/08E, H04L63/08D1, H04L9/32Legal EventsDateCodeEventDescriptionNov 20, 2013FPAYFee paymentYear of fee payment: 4Jun 1, 2011ASAssignmentOwner name: SANDISK TECHNOLOGIES INC., TEXASFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SANDISK CORPORATION;REEL/FRAME:026370/0568Effective date: 20110404Mar 21, 2006ASAssignmentFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GONZALES, CARLOS J.;FERCHAU, JOERG;JOGAND-COULOMB, FABRICE;SIGNING DATES FROM 20051220 TO 20051221;REEL/FRAME:017358/0179Owner name: SANDISK CORPORATION, CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GONZALES, CARLOS J.;FERCHAU, JOERG;JOGAND-COULOMB, FABRICE;REEL/FRAME:017358/0179;SIGNING DATES FROM 20051220 TO 20051221Owner name: SANDISK CORPORATION, CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GONZALES, CARLOS J.;FERCHAU, JOERG;JOGAND-COULOMB, FABRICE;REEL/FRAME:017358/0179;SIGNING DATES FROM 20051220 TO 20051221Owner name: SANDISK CORPORATION,CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GONZALES, CARLOS J.;FERCHAU, JOERG;JOGAND-COULOMB, FABRICE;SIGNING DATES FROM 20051220 TO 20051221;REEL/FRAME:017358/0179Owner name: SANDISK CORPORATION,CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GONZALES, CARLOS J.;FERCHAU, JOERG;JOGAND-COULOMB, FABRICE;SIGNED BETWEEN 20051220 AND 20051221;REEL/FRAME:17358/179RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services