CRYPTOGRAPHIC KEY CONTAINERS ON A USB TOKEN

• US 20080181412A1
• Filed: 01/26/2007
• Published: 07/31/2008
• Est. Priority Date: 01/26/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ellison, Carl M., Acar, Tolga
• Granted Patent: US 8,588,421 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A Universal Serial Bus (USB) compatible storage device is utilized as a security token for storage of cryptographic keys. A cryptographic subsystem of a processor accesses cryptographic keys in containers on the USB compatible storage device. Accessing includes storing and/or retrieving. The processor does not include an infrastructure dedicated to the USB compatible storage device. Cryptographic key storage is redirected from an in-processor container to the USB compatible storage device. No password or PIN is required to access the cryptographic keys, yet enhanced security is provided. Utilizing a USB compatible storage device for a cryptographic key container provides a convenient, portable, mechanism for carrying the cryptographic key, and additional security is provided via physical possession of the device.

Claims

1. A method for accessing a cryptographic key, the method comprising:

receiving, by a processor, an indication to access a cryptographic key;

searching for a universal serial bus (USB) compatible storage device; and

if a USB compatible storage device is found, accessing the cryptographic key on the USB compatible storage device, wherein accessing comprises at least one of storing and retrieving.

2. A method in accordance with claim 1, further comprising:

if no USB compatible storage device is found, accessing the cryptographic key in a memory of the processor.

3. A method in accordance with claim 1, further comprising:

if no USB compatible storage device is found;

rendering a prompt to provide a USB compatible storage device;

determining if a USB compatible storage has been provided;

if a USB compatible storage has been provided, accessing the cryptographic key on the provided USB compatible storage device; and

if no USB compatible storage device has been provided, accessing the cryptographic key in a memory of the processor.

4. A method in accordance with claim 1, wherein the cryptographic key is isolated in a protected execution environment of the processor.

5. A method in accordance with claim 1, wherein the USB compatible storage device comprises a portable device.

6. A method in accordance with claim 1, wherein no infrastructure dedicated to the USB compatible storage device is implemented on the processor.

7. A method in accordance with claim 1, wherein the cryptographic key is accessed via a cryptographic programming interface.

8. A system for implementing a cryptographic key on a universal serial bus (USB) compatible storage device, the system comprising:

an input/output portion configured to;

receive an indication to access a cryptographic key; and

a processing portion configured to;

search and index for an indication of the USB compatible storage device; and

if an indication of the USB compatible storage device is found, access, via a cryptographic programming interface, the cryptographic key on the USB compatible storage device, wherein accessing comprises at least one of storing and retrieving.

9. A system in accordance with claim 8, further comprising a memory portion, wherein:

if no indication of the USB compatible storage device is found, access, via the cryptographic programming interface, the cryptographic key in the memory portion.

10. A system in accordance with claim 8, further comprising a memory portion, the processing portion further configured to:

if no indication of the USB compatible storage device is found;

render a prompt to provide a USB compatible storage device;

determine if a USB compatible storage has been provided;

if a USB compatible storage has been provided, access, via the cryptographic programming interface, the cryptographic key on the provided USB compatible storage device; and

if no USB compatible storage device has been provided, access, via the cryptographic programming interface, the cryptographic key in the memory portion.

11. A system in accordance with claim 8, wherein the cryptographic key is isolated in a protected execution environment of the system.

12. A system in accordance with claim 8, wherein the USB compatible storage device comprises a portable device.

13. A system in accordance with claim 8, wherein the system comprises no infrastructure dedicated to the USB compatible storage device.

15. A computer-readable medium in accordance with claim 13, the computer-executable instructions further for accessing the cryptographic key via a cryptographic programming interface.

14. A computer-readable medium having stored thereon computer-executable instructions for accessing a cryptographic key on a universal serial bus (USB) compatible storage device by performing the steps of:

receiving, by a processor, an indication to access a cryptographic key;

searching for a USB compatible storage device; and

if a USB compatible storage device is found, accessing the cryptographic key on the USB compatible storage device, wherein accessing comprises at least one of storing and retrieving.

16. A computer-readable medium in accordance with claim 14, the computer-executable instructions further for:

if no USB compatible storage device is found, accessing the cryptographic key in a memory of the processor.

17. A computer-readable medium in accordance with claim 14, the computer-executable instructions further for:

if no USB compatible storage device is found;

rendering a prompt to provide a USB compatible storage device;

determining if a USB compatible storage has been provided;

if a USB compatible storage has been provided, accessing the cryptographic key on the provided USB compatible storage device; and

if no USB compatible storage device has been provided, accessing the cryptographic key in a memory of the processor.

18. A computer-readable medium in accordance with claim 14, wherein the cryptographic key is isolated in a protected execution environment of the processor.

19. A computer-readable medium in accordance with claim 14, wherein the USB compatible storage device comprises a portable device.

20. A computer-readable medium in accordance with claim 14, wherein no infrastructure dedicated to the USB compatible storage device is implemented on the processor.