In-circuit security system and methods for controlling access to and use of sensitive data

• US 20050081040A1
• Filed: 06/01/2004
• Published: 04/14/2005
• Est. Priority Date: 05/30/2003
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Privaris, Inc.
• Inventors: Olvera, Kristen R., Johnson, Barry W., Russell, David C., Tillack, Jonathan A.
• Granted Patent: US 7,587,611 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 16/51 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 18/22 Matching criteria, e.g. proximity measures
• CPC Class Codes: G06F 21/1076 Revocation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06V 40/13 Sensors therefor
• CPC Class Codes: G06V 40/1365 Matching; Classification
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/4415 using biometric characteristics of the user, e.g. by voice recognition or fingerprint scanning cryptography using biological data H04L9/3231; authentication in networks using biometric H04L63/0861

Abstract

The invention disclosed herein is an in-circuit security system for electronic devices. The in-circuit security system incorporates identity credential verification, secure data and instruction storage, and secure data transmission capabilities. It comprises a single semiconductor chip, and is secured using industry-established mechanisms for preventing information tampering or eavesdropping, such as the addition of oxygen reactive layers. This invention also incorporates means for establishing security settings, profiles, and responses for the in-circuit security system and enrolled individuals. The in-circuit security system can be used in a variety of electronic devices, including handheld computers, secure facility keys, vehicle operation/ignition systems, and digital rights management.

Claims

1. An in-circuit security system for electronic devices, comprising:

a processor;

a memory, coupled to the processor;

a real-time clock, coupled to the processor;

a cryptographic subsystem, coupled to the processor and the real-time clock;

a random number generator, coupled to the cryptographic subsystem;

an identity credential verification subsystem, coupled to the processor;

at least three input/output interfaces;

wherein, said processor provides means for load and execution of instructions and associated data;

wherein, said memory provides means for storage of instructions and data, including security settings and profiles;

wherein, said real-time clock provides means for generating an accurate time;

wherein, said cryptographic subsystem provides means for performing encryption, decryption, digital signing, and digital signature verification;

wherein, said random number generator provides means for randomly producing a number with statistical randomness sufficient to meet a pre-determined level;

wherein, said identity credential verification subsystem provides means for identity credential acquisition, analysis, storage and matching;

wherein, a first input/output interface is used for connection between the identity credential verification subsystem and an external identity credential sensor;

wherein, a second input/output interface is used for transmission and receipt of data to and from a remote connection device; and

wherein, a third input/output line is used for connection to at least one peripheral device.

2. The in-circuit security system of claim 1, wherein the input/output interface for transmission and receipt of data to and from a remote connection device connects the processor to a transceiver.

3. The in-circuit security system of claim 2, wherein said transceiver is a wireless communications transceiver.

4. The in-circuit security system of claim 2, further comprising a connection from said transceiver to an antenna.

5. The in-circuit security system of claim 2, wherein the transceiver is used for RFID communication.

6. The in-circuit security system of claim 2, wherein the transceiver is used for Bluetooth communication.

7. The in-circuit security system of claim 2, wherein the transceiver is used for infrared communication.

8. The in-circuit security system of claim 1, wherein the input/output interface for transmission and receipt of data to and from a remote connection device connects the processor to a transceiver used for wired communication.

9. The in-circuit security system of claim 8, wherein the transceiver is used for serial communication.

10. The in-circuit security system of claim 8, wherein the transceiver is used for USB communication.

11. The in-circuit security system of claim 1, wherein the identity credential verification subsystem uses biometric authentication.

12. The in-circuit security system of claim 1, further comprising an internal power source.

13. A method for controlling access to an electronic device having an in-circuit security system, comprising:

a. requiring enrollment of a personal identity credential within an identity credential verification subsystem,

b. associating the personal identity credential with at least one security privilege,

c. requesting a personal identity credential sample be provided to the identity credential verification subsystem upon access request,

d. comparing the personal identity credential sample to at least one enrolled personal identity credential within the identity credential verification subsystem,

e. determining existence of a match between the personal identity credential sample and an enrolled personal identity credential,

f. determining all security privileges associated with the personal identity credential sample,

g. determining access authorization based on at least one of said determined existence of a match or said determined security privileges,

h. granting or denying access based on said access authorization, and

i. performing any actions required for said granting or denying of access as stipulated by security settings.

14. The method of claim 13, wherein the requested access is to access stored data.

15. The method of claim 13 wherein the requested access is to selectively disable components.

16. The method of claim 13, wherein the requested access is to selectively enable disabled components.

17. The method of claim 13, wherein the requested access is to selectively destroy components.