NETWORK SECURITY DEVICE AND METHOD

• US 20080155278A1
• Filed: 02/25/2008
• Published: 06/26/2008
• Est. Priority Date: 12/05/2001
• Status: Active Grant

• Current Assignee: Philippe Hebrais, Sandra Lynn Carrico
• Original Assignee: Philippe Hebrais, Sandra Lynn Carrico
• Inventors: Hebrais, Philippe, Carrico, Sandra Lynn
• Granted Patent: US 7,783,901 B2
• Time in Patent Office: Days
• US Class Current: 713/194
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

The invention describes a method for hardening a security mechanism against physical intrusion and substitution attacks. A user establishes a connection between a network peripheral device and a network via a security mechanism. The security mechanism includes read only memory (ROM) that contains code that initiates operation of the mechanism and performs authentication functions. A persistent memory contains configuration information. A volatile memory stores user and device identification information that remains valid only for a given session and is erased thereafter to prevent a future security breach. A tamper-evident enclosure surrounds the memory elements, which if breached, becomes readily apparent to the user.

Claims

1. A security device for enabling a user to commence a session between a network peripheral device and a network, comprising:

an immutable memory element that comprises first information including application software that initiates and provides at least one security service;

a persistent memory element that comprises second information to enable the security device to configure the network peripheral device to access at least one different network;

a volatile memory element that comprises third information, including data for authentication, said third information erased from the volatile memory at a completion of a connection session; and

an enclosure for enclosing said immutable memory element, said persistent memory element, and said volatile memory element.

2. The security device of claim 1, wherein said at least one security service comprises at least one of:

an authentication of the security device itself, or an authentication of the user to the network upon receipt of identification information from the security device and the user.

3. The security device of claim 1, wherein said immutable memory comprises a private key for encrypting at least one of:

user identification information or security device identification information.

4. The security device of claim 1, wherein said immutable memory comprises a Read-Only Memory (ROM).

5. The security device of claim 1, wherein said immutable memory comprises a Write-once Read-Only Memory (ROM).

6. The security device of claim 1, wherein said persistent memory comprises at least one of:

a Complementary Metal Oxide Semiconductor Random Access Memory (CMOSRAM) or a Programmable Read Only Memory (PROM).

7. The security device of claim 1, wherein said volatile memory comprises a random access memory.

8. The security device of claim 1, wherein said enclosure is a tamper-evident enclosure.

9. The security device of claim 8, wherein said tamper evident enclosure exhibits any attempt to gain access to at least one of said memory elements enclosed therein.

10. The security device of claim 1, wherein a physical security of the security device depends on a degree of tamper resistance of said enclosure.

11. A method for facilitating a connection session with a user between a network peripheral device and a network, comprising:

accessing an immutable memory element within a security device that comprises first information that provides at least one security service;

accessing a persistent memory element within said security device that comprises second information including configuration information for configuring the network peripheral device to access the network;

accessing a volatile memory element within said security device that comprises third information, including data for authentication; and

erasing said third information at a completion of a connection session.

12. The method of claim 11, wherein said at least one security service comprises at least one of:

an authentication of the security device itself, or an authentication of the user to the network upon receipt of identification information from the security device and the user.

13. The method of claim 11, wherein said immutable memory comprises a private key for encrypting at least one of:

user identification information or security device identification information.

14. The method of claim 11, wherein said immutable memory comprises a Read-Only Memory (ROM).

15. The method of claim 11, wherein said immutable memory comprises a Write-once Read-Only Memory (ROM).

16. The method of claim 11, wherein said persistent memory comprises at least one of:

a Complementary Metal Oxide Semiconductor Random Access Memory (CMOSRAM) or a Programmable Read Only Memory (PROM).

17. The method of claim 11, wherein said volatile memory comprises a random access memory.

18. The method of claim 11, wherein said enclosure is a tamper-evident enclosure.

19. The method of claim 18, wherein said tamper evident enclosure exhibits any attempt to gain access to at least one of said memory elements enclosed therein.

20. The method of claim 11, wherein a physical security of the security device depends on a degree of tamper resistance of said enclosure.