Method and system for reducing personal security device latency

• US 20030097582A1
• Filed: 11/19/2001
• Published: 05/22/2003
• Est. Priority Date: 11/19/2001
• Status: Abandoned Application

• Current Assignee: ActivCard Co.
• Original Assignee: ActivCard Co.
• Inventors: Clemont, Olivier, Audebert, Yves
• Application Number:
  US09/988,301
• Publication Number:
  US 20030097582A1
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

This invention describes a system and method for reducing communications throughput latency caused by the low-level communications protocol and serial communications interface associated with the use of personal security devices. To improve the data throughput, a cache is created under the exclusive ownership of an API level program called a cache server. The cache server maintains access rights associated with the data transferred from the PSD into cache memory. Requests made by programs for cached PSD data are first verified for access rights and serviced by the cache server. Cryptographic techniques may be employed to prevent unauthorized monitoring of the contents of the cache.

Claims

1. A system for reducing PSD data throughput latency comprising;

a client including at least data storage means, data processing means, cryptography means, and an I/O port for functionally connecting to a PSD, wherein;

said data processing means includes means for allocating and reserving storage space in said data storage means of said client for use as a memory cache;

said data processing means further includes a cache server program for managing data stored inside said PSD, wherein said cache server program is assigned exclusive rights to said assigned I/O port and said memory cache and includes means for;

transferring at least a portion of said data stored inside said PSD to said memory cache;

retaining access rights associated with said transferred data;

receiving requests from at least one requesting program having access rights to at least a portion of said transferred data;

verifying access rights by at least one requesting program; and

transferring at least a portion of said cached data to said at least one requesting program.

2. The system according to claim 1, wherein said cache server program cryptographically protects said data transferred from said PSD to said memory cache using said cryptography means.

3. The system according to claim 2, wherein said cache server program removes said cryptographic protection from said data being transferred to said at least one requesting program.

4. The system according to claim 1, wherein said memory cached is flushed upon a status change.

5. The system according to claim 4, wherein said assigned exclusive rights to said assigned I/O port and said memory cache are released upon said status change.

6. The system according to claim 4, wherein said status change includes logout of an end user, attempted login of a second end user, rebooting of said client or upon encountering an error situation.

7. The system according to claim 1, wherein said cache server program is executed following successful end user validation by said PSD.

8. The system according to claim 1, where said memory is volatile memory.

9. A method for reducing PSD data throughput latency comprising;

functionally connecting a PSD including at least some data to a client, wherein said client includes at least data storage means, data processing means, cryptography means, and an I/O port,

executing a cache server program in said client,

allocating storage space in said data storage means for use in caching said at least some data in a memory cache,

accessing said PSD through said I/O port by said cache server program,

transferring said at least some data from said PSD to said memory cache,

retaining access rights to said at least some data by said cache server program,

receiving requests from at least one requesting program having access rights to at least a portion of said transferred data;

verifying said access rights by said at least one requesting program; and

transferring at least a portion of said cached data to said at least one requesting program.

10. The method according to claim 9 further including the steps of:

assigning exclusive rights to said I/O port and said memory cache to said cache server program,

cryptographically protecting said data transferred from said PSD to said memory cache,

removing said cryptographic protection from said data transferred to said at least one requesting program.

11. The method according to claim 9 or 10 wherein said cache server program is executed following successful PIN validation by said PSD.

12. The method according to claim 10 wherein memory cache is flushed upon a status change.

13. The method according to claim 12 wherein said assigned exclusive rights to said I/O port and said memory cache are released upon said status change.

14. The method according to claim 12 or 13 wherein said status change includes logout of an end user, attempted login of a second end user, rebooting of said client or upon encountering an error situation.