Portable encryption and authentication service module

• US 10,171,427 B2
• Filed: 01/29/2016
• Issued: 01/01/2019
• Est. Priority Date: 01/29/2015
• Status: Active Grant

• Current Assignee: Webcloak LLC
• Original Assignee: Webcloak LLC
• Inventors: Dawson, Martin
• Primary Examiner(s): Pearson, David J
• Application Number:
  US15/011,068
• Publication Number:
  US 20160226833A1
• Time in Patent Office: 1,068 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

Portable, hand-held electronic devices and methods to allow a user to anonymously utilize a host device are presented. The host device includes a processor to communicate with an application having a target network address. The portable, hand-held electronic devices includes an onboard database that stores user credential information and a portable encryption and authentication service module (PPEASM) that allows to make a secure communication channel with the host device. The PPEASM configures the processor of the host device to instantiate a virtual machine and render an encrypted messaging interface for communicating between the virtual machine and the application in the host device. Then, PPEASM can also configure the processor to negotiate authentication of the user with the application by utilizing the user credential information and information received through the encrypted messaging interface.

Claims

1. A portable, hand-held electronic device, through which a user can anonymously utilize a host device comprising a processor to communicate with a target application having a target network address, wherein the host device includes a native operating system (OS), the portable, hand-held electronic device comprises:

an onboard database that stores user credential information; and

an onboard memory storing software instructions that, when executed by the processor, configure the processor to perform the steps of

(a) receiving IP addresses associated with the host device;

(b) instantiating a virtual machine that runs on top of the native OS, wherein the virtual machine comprises a Transmission Control Protocol/Internet Protocol (TCP/IP) messaging server having an IP address different from any of the received IP address of the host device,

(c) rendering an encryption and decryption service on the virtual machine for encrypting and decrypting data between the onboard database and the virtual machine,

(d) rendering an encrypted messaging interface on the host device that utilizes the TCP/IP messaging server for encrypting and decrypting data between the virtual machine and the target application over a TCP/IP networking layer,

(e) negotiating a data encryption protocol with the target application through a private portable encryption authentication and service module (PPEASM) interface associated with the application to enable encrypting and decrypting data between the target application and a PPEASM application, and

(f) negotiating authentication of the user with the target application by utilizing the user credential information and information received at the encrypted messaging interface from the PPEASM application with user credential information on the onboard database accessed via the encryption and decryption service.

2. The portable, hand-held electronic device of claim 1, wherein the target application runs on top of the native OS.

3. The portable, hand-held electronic device of claim 1, wherein the target application runs on a remote device communicatively coupled to the host device over a network.

4. The portable, hand-held electronic device of claim 1, wherein the software instructions further configure the processor to send the user credential information to the target application through the PPEASM interface.

5. The portable, hand-held electronic device of claim 4, wherein the software instructions further configure the processor to encrypt the user credential information before sending the encrypted user credential to the target address.

6. The portable, hand-held electronic device of claim 1, wherein the host device further comprises a network card, wherein the software instructions further configure the processor to enable the virtual machine to utilize the network card to communicate with the target application via an interface of the native OS.

7. The portable, hand-held electronic device of claim 1, wherein the user credential comprises at least one of the following:

a password, a challenge phrase, and a challenge phrase hash.

8. The portable, hand-held electronic device of claim 1, wherein the virtual machine comprises a secure operating system kernel.

9. The portable, hand-held electronic device of claim 1, wherein the onboard database further comprises a static read-only data volume for certificate storage and a read/write data volume for runtime work.

10. The portable, hand-held electronic device of claim 1, wherein the software instructions further configure the processor to decrypt the information.

11. The portable, hand-held electronic device of claim 1, wherein the software instructions further configure the processor to provide a user interface that enables the user to interact with the target application via the virtual machine.

12. A method of authenticating a user to access a target application having a target network address, comprising:

causing a processor of a host device to instantiate a virtual machine on top of a native operating system (OS) running on the host device, wherein the virtual machine stores user credential information associated with the user;

receiving IP addresses associated with the host device;

instantiating, by the virtual machine, a Transmission Control Protocol/Internet Protocol (TCP/IP) messaging server having an IP address different from any of the received IP address associated with the host device;

rendering, by the virtual machine, an encryption and decryption service for encrypting and decrypting data between an onboard database storing the user credential information and the virtual machine,

rendering, by the host device, an encrypted messaging interface that utilizes the TCP/IP messaging server to encrypt and decrypt data with the target application over a TCP/IP networking layer;

negotiating a data encryption protocol with the target application through a private portable encryption authentication and service module (PPEASM) interface associated with the application to enable encryption and decryption of data between the target application and a PPEASM application; and

negotiating, by the virtual machine, authentication of the user with the target application by utilizing the user credential information and information received at the encrypted messaging interface from the PPEASM application with user credential information on the onboard database accessed via the encryption and decryption service.

13. The method of claim 12, wherein the target application runs on top of the native OS.

14. The method of claim 12, wherein the target application runs on a remote device communicatively coupled to the host device over a network.

15. The method of claim 12, further comprising sending, by the virtual machine, the user credential information to the target application through the PPEASM interface.

16. The method of claim 15, wherein the software instructions further configure the processor to encrypt the user credential information before sending it the target address.

17. The method of claim 15, wherein sending the user credential information comprises utilizing a network card of the host device to send the user credential information to the target application via an interface of the native OS.

18. The method of claim 12, wherein the user credential comprises at least one of the following:

a password, a challenge phrase, and a challenge phrase hash.

19. The method of claim 12, wherein the virtual machine comprises a secure operating system kernel.

20. The method of claim 12, further comprising decrypting the information received through the encrypted messaging interface.

21. The method of claim 12, further comprising enabling the user to interact with the target application via the virtual machine.