PORTABLE SECURITY DEVICE PROTECTION AGAINST KEYSTROKE LOGGERS

• US 20110265156A1
• Filed: 12/21/2009
• Published: 10/27/2011
• Est. Priority Date: 12/24/2008
• Status: Abandoned Application

• Current Assignee: Gemalto SA (Thales SA)
• Original Assignee: Gemalto SA (Thales SA)
• Inventors: Bombay, Bart J.
• Application Number:
  US13/141,683
• Publication Number:
  US 20110265156A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

The invention relates to a portable security device (SC, TK) comprising host connection means (PAD_H, USB_M) for connecting to a computer (PC), client connection means (PAD_C, USB_F) for connecting to an input device (KBD), filtering means for intercepting sensitive data transmitted from the client connection means (PAD_C, USB_F) to the host connection means (PAD_H, USB_M), and protection means for protecting said sensitive data. The invention also relates to an input device comprising a portable security device, to a server, to a system comprising a portable security device, a computer and an input device, and to a method for securing data entered into a computer (PC) with an input device (KBD), the method comprising installing a portable security device (TK) between the computer (PC) and the input device (KBD).

Claims

1. Portable security device (SC, TK) comprising:

host connection means (PAD_H, USB_M) for connecting to a computer (PC),

client connection means (PAD_C, USB_F) for connecting to an input device (KBD),

filtering means for intercepting sensitive data transmitted from the client connection means (PAD_C, USB_F) to the host connection means (PAD_H, USB_M), and

protection means for protecting said sensitive data.

2. Portable security device (SC, TK) according to claim 1, wherein the host connection means (PAD_H, USB_M) and/or the client connection means (PAD_C, USB_F) comprise a USB port.

3. Portable security device (SC, TK) according to claim 2, wherein the portable security device (SC, TK) comprises a USB host logic for communicating with the input device (KBD) and a USB client logic for communicating with the computer (PC).

4. Portable security device (SC, TK) according to claim 2 or 3, wherein the portable security device (SC, TK) comprises a USB hub logic.

5. Portable security device (SC, TK) according to any previous claim, further comprising computer monitoring means set to install an agent in the computer (PC), wherein the agent is set to inform the portable security device (SC, TK) whenever data expected from the input device (KBD) by the computer (PC) are sensitive data.

6. Portable security device (SC, TK) according to any previous claim, further set to recognize certain data coming from the client connection means (PAD_C, USB_F) as an indication that subsequent data coming from the client connection means (PAD_C, USB_F) are sensitive data.

7. Portable security device (SC, TK) according to any previous claim, comprising input means (SWITCH) for informing the portable security device (SC, TK) that it should process subsequent data coming from the client connection means (PAD_C, USB_F) as sensitive data.

8. Portable security device (SC, TK) according to any previous claim, further comprising output means (LED) for informing a user of the portable security device (SC, TK) that it is actually processing data coming from the client connection means (PAD_C, USB_F) as sensitive data.

9. Portable security device (SC, TK) according to any previous claim, wherein protecting sensitive data comprises encrypting them.

10. Input device (KBD) embedding a portable security device (SC) according to any previous claim.

12. System comprising a portable security device (SC, TK) according to any of claims 1 to 9, a computer (PC) and an input device (KBD).

13. System according to claim 12 wherein the input device (KBD) is a keyboard.

14. System according to claim 12 or 13, further comprising a server (SRV) to which a user of the computer (PC) can authenticate, wherein the input device (KBD) is set to allow input of user authentication credentials, wherein the portable security device (SC, TK) is set to identify user authentication credentials requested by the server (SRV) as sensitive data, and to establish a secure connection with the server (SRV) for sending said user authentication credentials.

11. Server (SRV) comprising authentication means to authenticate a user of a computer (PC) connected to the server (SRV) with user authentication credentials, characterized in that when the authentication credentials submitted to the authentication means do not match the expected user authentication credentials, the authentication means are set to check whether the submitted authentication credentials match an agreed format informing of the availability of a portable security device (TK) connected to the computer (PC), and in that upon positive verification, the authentication means are set to attempt a user authentication with the portable security device (TK).

15. Method for securing data entered into a computer (PC) with an input device (KBD), the method comprising installing a portable security device (TK) between the computer (PC) and the input device (KBD), identifying sensitive data within said data, and protecting said sensitive data, within the portable security device (TK).