Method and system for using a compact disk as a smart key device

• US 20060136748A1
• Filed: 12/16/2004
• Published: 06/22/2006
• Est. Priority Date: 12/16/2004
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Bade, Steven A., Chao, Ching-Yun
• Granted Patent: US 7,386,736 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A data processing system accepts a removable storage media, which becomes electrically engaged with a system unit within the data processing system, after which the removable storage media and the hardware security unit mutually authenticate themselves. The removable storage media stores a private key of a first asymmetric cryptographic key pair and a public key of a second asymmetric cryptographic key pair that is associated with the hardware security unit, and the hardware security unit stores a private key of the second asymmetric cryptographic key pair and a public key of the first asymmetric cryptographic key pair that is associated with the removable storage media. In response to successfully performing the mutual authentication operation between the removable storage media and the hardware security unit, the system unit is enabled to invoke cryptographic functions on the hardware security unit while the removable storage media remains engaged with the system unit.

Claims

1. A data processing system, comprising:

a system unit;

a media reading device coupled to the system unit;

a device driver for controlling the media reading device;

an removable storage media, readable by the media reading device, wherein the removable storage media stores a first private key corresponding to a first asymmetric cryptographic key pair and a first public key corresponding to a second asymmetric cryptographic key pair; and

a hardware security unit coupled to the system unit, wherein the hardware security unit stores a second private key corresponding to the second asymmetric cryptographic key pair and a second public key corresponding to the first asymmetric cryptographic key pair, the hardware security unit comprising;

logic for authenticating the removable storage media and the hardware security unit based upon the first and second cryptographic key pairs; and

logic for enabling the system unit to invoke cryptographic functions on the hardware security unit while the removable storage media remains engaged with the media reading device after the removable storage media and the hardware security unit have been mutually authenticated.

2. The data processing system of claim 1, further comprising logic for authenticating an application once the removable storage media has been authenticated and the removable storage unit remains engaged with the media reading device.

3. The data processing system of claim 1, further comprising logic for generating a digital certificate for the removable storage media by the hardware security unit while the removable storage media remains engaged with the media reading device.

4. The data processing system of claim 1, further comprising logic for digitally signing a data item from the device driver by the hardware security unit in response to a request from the device driver while the removable storage media remains engaged with the media reading device.

5. The data processing system of claim 1, further comprising logic for performing a cryptographic function by the hardware security unit for the device driver in response to a request from the device driver after successfully performing a mutual authentication operation between the removable storage media and the hardware security unit without requiring the removable storage media to be engaged with the media reading device.

6. The data processing system of claim 1, the device driver comprising:

a third private key corresponding to a third asymmetric cryptographic key pair; and

a third public key corresponding to a fourth asymmetric cryptographic key pair, and

 

the data processing system, further comprising;

a fourth private key, stored on the hardware security unit, corresponding to the fourth asymmetric cryptographic key pair and a fourth public key corresponding to the third asymmetric cryptographic key pair;

logic for performing a mutual authentication operation between the device driver and the hardware security unit based upon the third and fourth asymmetric cryptographic key pairs; and

logic for enabling the device driver to invoke functions on the hardware security unit while the removable storage unit remains engaged with the media reading device after the removable storage media and the device driver have been mutually authenticated.

7. The data processing system of claim 6, further comprising logic for authenticating an application once the removable storage media and the device driver have been authenticated and the removable storage unit remains engaged with the media reading device.

8. The data processing system of claim 6, further comprising logic for generating a digital certificate for the device driver by the hardware security unit while the removable storage media remains engaged with the media reading device.

9. A method for performing cryptographic functions, the method comprising:

engaging a removable storage media with a media reading device coupled to a system unit,

wherein the system unit includes a hardware security unit and a device driver for controlling the media reading device; and

wherein the removable storage media contains a first private key corresponding to a first asymmetric cryptographic key pair and a first public key corresponding to a second asymmetric cryptographic key pair, and

wherein the hardware security unit contains a second private key corresponding to the second asymmetric cryptographic key pair and a second public key corresponding to the first asymmetric cryptographic key pair;

performing a mutual authentication operation between the removable storage media and the hardware security unit based upon the first and second asymmetric cryptographic key pairs; and

in response to successfully performing the mutual authentication operation, enabling the system unit to invoke cryptographic functions on the hardware security unit while the removable storage media remains engaged to the media reading device.

10. The method of claim 9, further comprising authenticating an application once the removable storage media has been authenticated and while the removable storage unit remains engaged with the media reading device.

11. The method of claim 9, further comprising generating a digital certificate for the removable storage media by the hardware security unit while the removable storage media remains engaged with the media reading device.

12. The method of claim 9, further comprising digitally signing a data item from the device driver by the hardware security unit in response to a request from the device driver while the removable storage media remains engaged with the media reading device.

13. The method claim 9, further comprising performing a cryptographic function by the hardware security unit for the device driver in response to a request from the device driver after successfully performing a mutual authentication operation between the removable storage media and the hardware security unit without requiring the removable storage media to be engaged with the media reading device.

14. The method of claim 9,

wherein the device driver includes a third private key corresponding to a third asymmetric cryptographic key pair;

and a third public key corresponding to a fourth asymmetric cryptographic key pair, and

wherein the data processing system includes a fourth private key, stored on the hardware security unit, corresponding to the fourth asymmetric cryptographic key pair and a fourth public key corresponding to the third asymmetric cryptographic key pair;

the method further comprising;

performing a mutual authentication operation between the device driver and the hardware security unit based upon the third and fourth asymmetric cryptographic key pairs; and

enabling the device driver to invoke functions on the hardware security unit while the removable storage unit remains engaged with the media reading device after the removable storage media and the device driver have been mutually authenticated.

15. The method of claim 14, further comprising authenticating an application once the removable storage media and the device driver have been authenticated and the removable storage unit remains engaged with the media reading device.

16. The method of claim 14, further comprising generating a digital certificate for the device driver by the hardware security unit while the removable storage media remains engaged with the media reading device.

17. A computer program product on a computer readable medium for use in a data processing system for performing cryptographic functions, the computer program product comprising:

logic, stored on the computer readable medium, for reading a removable storage media with a media reading device coupled to a system unit,

wherein the system unit includes a hardware security unit and a device driver for controlling the media reading device,

wherein the removable storage media contains a first private key corresponding to a first asymmetric cryptographic key pair and a first public key corresponding to a second asymmetric cryptographic key pair, and

wherein the hardware security unit contains a second private key corresponding to the second asymmetric cryptographic key pair and a second public key corresponding the first asymmetric cryptographic key pair;

logic, stored on the computer readable medium, for performing a mutual authentication operation between the media reading device and the hardware security unit while the removable storage media is engaged with the media reading device; and

logic, stored on the computer readable medium, for enabling cryptographic functions on the hardware security unit while the removable storage media remains engaged with the media reading device system unit in response to successfully performing the mutual authentication operation between the removable storage media and the hardware security unit.

18. The computer program product of claim 17, further comprising logic, stored on the computer readable medium, for authenticating an application once the removable storage media has been authenticated and while the removable storage unit remains engaged with the media reading device.

19. The computer program product of claim 17, further comprising logic, stored on the computer readable medium, for generating a digital certificate for the removable storage media by the hardware security unit while the removable storage media remains engaged with the media reading device.

20. The computer program product of claim 17, further comprising logic, stored on the computer readable medium, for digitally signing a data item from the device driver by the hardware security unit in response to a request from the device driver while the removable storage media remains engaged with the media reading device.

21. The computer program product claim 17, further comprising logic, stored on the computer readable medium, for performing a cryptographic function by the hardware security unit for the device driver in response to a request from the device driver after successfully performing a mutual authentication operation between the removable storage media and the hardware security unit without requiring the removable storage media to be engaged with the media reading device.

22. The computer program product of claim 17,

wherein the device driver includes a third private key corresponding to a third asymmetric cryptographic key pair;

and a third public key corresponding to a fourth asymmetric cryptographic key pair, and

wherein the data processing system includes a fourth private key, stored on the hardware security unit, corresponding to the fourth asymmetric cryptographic key pair and a fourth public key corresponding to the third asymmetric cryptographic key pair;

the computer program product further comprising;

logic, stored on the computer readable medium, for performing a mutual authentication operation between the device driver and the hardware security unit based upon the third and fourth asymmetric cryptographic key pairs; and

logic, stored on the computer readable medium, for enabling the device driver to invoke functions on the hardware security unit while the removable storage unit remains engaged with the media reading device after the removable storage media and the device driver have been mutually authenticated.

23. The computer program product of claim 22, further comprising logic, stored on the computer readable medium, for authenticating an application once the removable storage media and the device driver have been authenticated and the removable storage unit remains engaged with the media reading device.

24. The computer program product of claim 22, further comprising logic, stored on the computer readable medium, for generating a digital certificate for the device driver by the hardware security unit while the removable storage media remains engaged with the media reading device.