Trusted Security Zone Access to Peripheral Devices

• US 20150169885A1
• Filed: 01/06/2014
• Published: 06/18/2015
• Est. Priority Date: 07/24/2012
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Paczkowski, Lyle W., Parsel, William M., Persson, Carl J., Schlesener, Matthew C.
• Granted Patent: US 9,268,959 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

A method of trusted data communication. The method comprises executing a data communication application in a trusted security zone of a processor, wherein the processor is a component of a computer, commanding a controller of a peripheral device to execute a control application in a trusted security zone of the controller, wherein the controller is a component of the computer, commanding at least one of another peripheral device or a user interface device to not access a data bus of the computer, verifying that the controller is executing the control application in the trusted security zone of the controller, sending data from the processor to the controller over the data bus of the computer, and the controller one of transmitting the data sent by the processor on an external communication link, reading a memory storage disk, or writing to a memory storage disk.

Claims

1. A universal serial bus (USB) drive, comprising:

a memory, wherein the memory contains at least some confidential information;

a processor coupled to the memory;

a universal serial bus connector coupled to the processor; and

an application stored in the memory that, when executed by the processor,

determines that a request to access the memory received by the universal serial bus connector is directed to the at least some confidential information,

satisfies the request to access the memory when a message is received by the universal serial bus connector from a sender of the request to access the memory, wherein the message indicates that the sender is executing in a trusted security zone, and

does not satisfy the request to access the memory when the message is not received by the universal serial bus connector from the sender.

2. The universal serial bus drive of claim 1, wherein the at least some confidential information comprises at least one of a credit card number, a credit card authentication number, a financial account number, a financial account authentication number, a social security number, or a telephone number.

3. The universal serial bus drive of claim 1, wherein the processor comprises a trusted security zone, and wherein the application executes in the trusted security zone of the processor.

4. The universal serial bus drive of claim 3, wherein the at least some confidential information is stored in a trusted security zone of the memory.

5. The universal serial bus drive of claim 3, wherein the application executes in the trusted security zone of the processor based on the request.

6. The universal serial bus drive of claim 5, wherein the request indicates that the request is to be processed by the trusted security zone of the processor.

7. The universal serial bus drive of claim 1, wherein the application sends a request to the sender of the request for access for the sender to execute in the trusted security zone of the sender.

8. The universal serial bus drive of claim 1, wherein the trusted security zone is hardware implemented.

9. The universal serial bus drive of claim 1, wherein the application executes in a normal security zone of the processor.

10. A method of accessing a memory disk drive, comprising:

transmitting to a disk controller of a memory disk drive a command to execute in a trusted security zone of the disk controller;

transmitting to the disk controller a request for confirmation that the disk controller is executing in the trusted security zone of the disk controller; and

when a confirmation that the disk controller is executing in the trusted security zone of the disk controller is received, transmitting to the disk controller a command to access a trusted security zone portion of the memory disk drive.

11. The method of claim 10, wherein a server computer transmits the command to the memory disk drive to execute in the trusted security zone of the disk controller.

12. The method of claim 10, wherein the confirmation comprises a trust token.

13. The method of claim 10, wherein the memory disk drive is installed in one of a desk top computer, a laptop computer, or a notebook computer.

14. The method of claim 10, wherein the memory disk drive further comprises a normal security portion.

15. The method of claim 10, wherein the trusted security zone of the disk controller comprises a separate physical portion of the disk controller.

16. The method of claim 10, wherein the trusted security zone of the disk controller comprises a virtual processor portion of the disk controller.

17. The method of claim 10, wherein after the data is transmitted to the disk controller, the disk controller is returned to executing in a normal security zone of the disk controller.

18. The method of claim 10, further comprising transmitting to another controller a command to execute in a trusted security zone of the other controller and to execute an idling program to idle active applications or program while the disk controller accesses the trusted security portion of the memory disk drive, wherein the other controller does not read from or write to a data bus while executing the idling program.

19. The method of claim 18, wherein the other controller is not a party to a trusted communication between the disk controller and the memory disk drive.

20. The method of claim 18, wherein after data is transmitted to the disk controller, the disk controller and the other controller are returned to executing in a normal security zone of their respective processors.