PC Security Lock Device Using Permanent ID and Hidden Keys

• US 20110113235A1
• Filed: 08/27/2010
• Published: 05/12/2011
• Est. Priority Date: 08/27/2009
• Status: Abandoned Application

• Current Assignee: Craig Erickson
• Original Assignee: Craig Erickson
• Inventors: Erickson, Craig
• Application Number:
  US12/870,776
• Publication Number:
  US 20110113235A1
• Time in Patent Office: Days
• US Class Current: 713/152
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user

Abstract

The invention is a method, system, and apparatus providing user control and security of a PC system. Using the hardware and associated installation software, the system is capable of uniquely securing a PC system without the need for name and password entry. The secure USB device contains a unique asymmetrical key pair, unique device ID, secure storage area, and the firmware to control all of this. In providing the security and control, one embodiment of the invention does not require biomechanical devices or name and password entry systems. There are no passwords and login names to be found, and the encryption/decryption keys are protected from exposure. This provides a more secure environment, as the keys are protected from exposure. The user is in control of the PC system and the data which is desired to be kept secure.

Claims

1. A system for securing data in a local computer, the system comprising:

a secure dongle, the secure dongle comprising;

a communications port configured to communicate with a local computer;

a permanent memory, the memory comprising a permanent unique identification code, a permanent asymmetrical encryption key pair, a permanent asymmetrical signature key pair, and a permanent vault file encryption key; and

a processor, wherein the processor is configured to generate and verify signatures using the permanent asymmetrical signature key pair; and

,

a software package configured for installation on the local computer, the software package configured, upon installation on the local computer, to request specific identification information from the dongle.

2. The system of claim 1, wherein the specific identification information requested from the secure dongle by the software package includes the permanent unique identification code of the secure dongle.

3. The system of claim 1, wherein the software package comprises:

a dongle monitoring service program configured to monitor the presence of the secure dongle on a local computer and to prevent access to secure information on the local computer if the correct secure dongle is not present;

a vault file device driver configured to place selected data into a virtual vault file on a local computer, and to treat the virtual vault file as a disk drive, and to prevent access to the virtual vault file if the secure dongle is not present;

a user program configured to interact with the vault file service program to manage the virtual vault files, and to interact with the dongle monitoring service program to configure the monitor service; and

a secure dongle driver for communicating to the secure dongle.

4. The system of claim 1, wherein the software package comprises:

email software configured to send public keys, and to encrypt and decrypt emails using email encryption data provided by the secure dongle using the permanent asymmetrical encryption key pair.

5. The system of claim 4, wherein the email software is configured to wrap the public keys prior to sending the public keys.

6. The system of claim 1, further comprising:

a master server, wherein the master server is connected to an internet-like connection and is configured to receive transmissions from the secure dongle via one or more local computers.

7. The system of claim 6, wherein the master server comprises a master server database, the master server database including the permanent unique identification code, permanent asymmetrical encryption key pair, permanent asymmetrical signature key pair, and permanent vault file encryption key of the secure dongle.

8. A dongle for providing access to secure data, the dongle comprising:

a communication port;

a processor configured to generate and verify signatures;

a permanent memory, the memory comprising;

a permanent unique identification code;

a permanent asymmetrical email encryption key pair comprising a public encryption key and a private decryption key;

a permanent asymmetrical signature key pair comprising a public signature key and a private signature key; and

a permanent vault file encryption key,

9. The dongle of claim 8, further comprising:

preprogrammed routines and protocols which instruct the processor to initiate encrypted communication using the permanent asymmetrical encrypted key pair, and to initiate encrypted signature generation and verification using the permanent asymmetrical signature key pair.

10. The dongle of claim 9, wherein the preprogrammed routines and protocols are included in firmware within the dongle.

11. The dongle of claim 8, wherein the vault file encryption key comprises a 2-key Triple DES key.

12. The dongle of claim 8, wherein the processor is configured to perform decryption of wrapped keys.

13. The dongle of claim 8, further comprising a secure hidden storage area configured to store, and provide for retrieval of, secure data including vault file encryption and decryption keys in real time.

14. A method for securing data on a local computer, the method performed in conjunction with the local computer and a secure device and a remote master server, wherein the secure device is configured to be secured to or placed adjacent to the local computer and to communicate with the local computer, the secure device having a unique identification number, an email encryption key comprising an email public-private key pair, and a signature generating key comprising a signature public-private key pair, the local computer having a storage medium having data thereon, the method comprising:

providing the secure device with the unique identification number, the email encryption key, and the signature generating key pre-installed in a permanent memory of the secure device;

installing a first portion of secure device support software onto the local computer, wherein the secure device support software is configured to interact with the secure device;

establishing and confirming the existence of an internet connection between the local computer and remote master server;

communicatively connecting the secure device with the local computer, wherein the secure device is secured to or placed adjacent to the local computer;

generating, within the secure device, a secure device signature using a private signature generation key from the signature public-private key pair;

transmitting the secure device signature to the local computer;

storing the secure device signature on the local computer; and

transmitting unique identifying information of the secure device to the master server via the internet connection;

confirming, at the master server, the authenticity of the unique identifying information of the secure device;

authorizing, by the master server, of installation of a remaining portion of the secure device support software onto the local computer;

transmitting, from the master server to the local computer, the authorization of the installation of the remaining portion of the secure device support software onto the local computer; and

installing the remaining portion of the secure device support software onto the local computer.

15. The method of claim 14, wherein transmitting the unique identifying information of the secure device to the master server via the internet connection comprises transmitting the unique identifying information in an encrypted format.

16. The method of claim 14, further comprising:

disconnecting the secure device from the local computer;

reconnecting the secure device to the local computer;

providing the secure device signature from the local computer back to the secure device;

verifying, within the secure device, the secure device signature using a private signature generation key from the signature public-private key pair; and

activating the secure device for use with the local computer responsive to said verification.

17. The method of claim 14, further comprising:

creating at least one virtual vault drive in a memory of the local computer;

generating a virtual vault drive image of the at least one virtual vault drive on a screen of the local computer;

preventing access to the at least one virtual vault drive when the secure device is disconnected from the local computer; and

changing the display of the virtual vault drive image of the screen of the local computer when the secure device is disconnected from the local computer.

18. The method of claim 17, wherein changing the display of the virtual vault drive image of the screen of the local computer when the secure device is disconnected from the local computer comprises eliminating the display of the virtual vault drive image.

19. The method of claim 17, wherein the dongle further comprises a vault file encryption key, and creating the at least one virtual vault drive in a memory of the local computer comprises encrypting all data to be incorporated into the at least one virtual vault drive using the vault file encryption key.

20. The method of claim 14, further comprising:

providing a public email key of the email encryption key from the secure device to the local computer;

packaging the public email key as an attachment file in a first email having a sender'"'"'s email address;

forwarding the first email to an email address of a designated recipient;

opening the first email, on a local computer of the designated recipient, including extracting the public email key and determining the sender'"'"'s email address;

storing the sender'"'"'s email address and public email key on the recipient computer of the designated recipient;

preparing, on the recipient computer, a responsive email, including encryption of the responsive email;

sending the responsive email to the sender'"'"'s email address;

opening the responsive email on the local computer; and

decrypting the responsive email using a private key of the email encryption key.