Methods and Systems for Secure Encryption of Data

• US 20090327762A1
• Filed: 05/05/2008
• Published: 12/31/2009
• Est. Priority Date: 05/05/2008
• Status: Active Grant

• Current Assignee: Sonavation, Inc.
• Original Assignee: Sonavation, Inc.
• Inventors: BOUDREAUX, John
• Granted Patent: US 8,489,901 B2
• Time in Patent Office: Days
• US Class Current: 713/194
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

Provided is a data acquisition module. The data acquisition module includes a memory and a controller. The controller includes an encryption module configured to encrypt information written to the memory using a key included in the controller. The key is unique to the controller.

Also provided is a method for processing identification information. The method includes encrypting information with a key included in a controller and storing the encrypted information. The key is unique to the controller.

Claims

1. A data acquisition module, comprising:

a memory; and

a controller, comprising;

an encryption module configured to encrypt information written to the memory using a key included in the controller, wherein the key is unique to the controller.

2. The data acquisition module of claim 1, wherein the controller comprises a memory and wherein the key is stored in the memory of the controller during a manufacturing step used to manufacture the controller.

3. The data acquisition module of claim 2, wherein the controller memory is a one-time programmable (OTP) memory that includes a plurality of blown fuses, wherein each blown fuse of the plurality of blown fuses includes a charge such that the key is destroyed if a portion of a package of the memory is breached or if the controller memory is electromagnetically scanned.

4. The data acquisition module of claim 2, wherein the controller memory is shielded.

5. The data acquisition module of claim 1, wherein the key is cryptographically random and not recorded.

6. The data acquisition module of claim 1, wherein the contents of the memory are encrypted according to a symmetrical encryption technique.

7. The data acquisition module of claim 1, wherein the key is derived from unique characteristics of a die used to form the controller.

8. The data acquisition module of claim 1, wherein the controller is configured to generate a session key from a host key stored in the memory according to a Diffie-Helman technique or a Secure Hash Algorithm.

9. The data acquisition module of claim 1, wherein the controller comprises:

a sensor configured to sense identification information from a candidate and output sensed data;

a template generation module configured to generate template based on the sensed data; and

a comparison module configured to determine an identity of the candidate based on the generated template and a template stored in the memory.

10. The data acquisition unit of claim 9, wherein the controller further comprises:

an authorization module configured to determine privileges to be granted to the candidate based on the determined identity.

14. The method of claim 1, wherein the information comprises a host key, further comprising:

generating a session key according to a Diffie-Hellman technique or a Secure Hash Algorithm technique; and

encrypting information to be sent to a host with the generated session key.

15. The method of claim 14, further comprising:

discarding the generated session key after a session is complete.

11. A method for processing identification information, comprising:

encrypting information with a key included in a controller; and

storing the encrypted information, wherein the key is unique to the controller.

12. The method of claim 11, wherein the encrypting step comprises:

encrypting the information according to a symmetrical encryption technique.

13. The method of claim 11, wherein the information includes a template generated based on sensed data.

16. The method of claim 11, further comprising:

generating a template based on sensed data; and

comparing the generated template to a known template to determine an identity of a candidate, wherein the information includes the known template.

17. The method of claim 16, further comprising:

determining privileges to be granted to the candidate based on the determined identity.