Portable secure computing network

• US 8,732,451 B2
• Filed: 05/20/2009
• Issued: 05/20/2014
• Est. Priority Date: 05/20/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Viswanathan, Rajesh, Steeves, David J.
• Primary Examiner(s): Zele, Krista
• Assistant Examiner(s): SCOTT, RANDY A
• Application Number:
  US12/468,948
• Publication Number:
  US 20100299518A1
• Time in Patent Office: 1,826 Days
• Field of Search: 726/2, 726/5, 726/11, 726/4, 726/6, 713/152, 713/153, 380/44
• US Class Current: 713/152
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

As provided herein, when using an untrusted network connection, a secure online environment can be created for a remote machine by connecting to a trusted computer with a trusted network connection. A proxy server is installed on a first computing device and shared encryption keys are generated for the first device and a portable storage device. A connection is initiated between a second computing device (e.g., remote device), connected to an untrusted network, and the first computing device, comprising initiating a proxy server protocol from the portable storage device (e.g., attached to the second device), using the second computing device. A secure connection between the first and second devices is created using the encryption keys.

Claims

1. A method for creating a secure online environment for an unsecured computing device connected to an untrusted network using a first trusted computing device connected to a trusted network, comprising:

installing, using a portable storage device while operatively coupled to a first trusted computing device, a proxy server on the first trusted computing device that uses a first trusted network for online access;

installing, using the portable storage device while operatively coupled to a second trusted computing device, the proxy server on the second trusted computing device that uses a second trusted network for online access;

generating one or more shared encryption keys for the first trusted computing device and the second trusted computing device on which the proxy server is installed;

connecting, using a proxy server protocol of the portable storage device while operatively coupled to an unsecured computing device connected to an untrusted network, the unsecured computing device to a trusted device website, the trusted device website comprising a list of trusted computing devices, the list of trusted computing devices comprising at least the first trusted computing device and the second trusted computing device; and

responsive to a selection of the first trusted computing device from the list of trusted computing devices, creating a secure connection, using the proxy server protocol of the portable storage device, between the unsecured computing device and the first trusted computing device using at least some of the one or more shared encryption keys, at least some of at least one of the installing a proxy server on the first trusted computing device, the installing the proxy server on the second trusted computing device, the generating, the connecting, or the creating implemented at least in part via a processing unit.

2. The method of claim 1, comprising generating at least one shared encryption key for the portable storage device.

3. The method of claim 1, the creating a secure connection comprising:

encrypting data sent by the unsecured computing device to the first trusted computing device using a first shared encryption key stored within the portable storage device, the first shared encryption key corresponding to a second shared encryption key maintained on the first trusted computing device.

4. The method of claim 1, the list of trusted computing devices comprising a recommendation specifying that the first trusted computing device has a first connection speed that is faster than a second connection speed of the second trusted computing device.

5. The method of claim 1, the list of trusted computing devices comprising a recommendation specifying that the first trusted computing device has a first proximity to the unsecured computing device that is closer than a second proximity of the second trusted computing device to the unsecured computing device.

6. The method of claim 1, the list of trusted computing devices comprising a recommendation specifying that the first trusted computing device comprises at least one of a program or a file that the second trusted computing device does not comprise.

7. The method of claim 1, the unsecured computing device comprising one of:

a laptop;

or

a tablet.

8. The method of claim 1, comprising proxying data traffic for the unsecured computing device that is using the untrusted network through the first trusted computing device that is using the first trusted network.

9. The method of claim 8, the proxying data traffic for the unsecured computing device comprising:

proxying outbound data traffic from the unsecured computing device through the first trusted computing device to the first trusted network; and

proxying inbound data traffic from the first trusted network through the first trusted computing device to the unsecured computing device.

10. The method of claim 8, the proxying data traffic comprising routing data traffic by proxying one or more of:

an application layer protocol from an Internet protocol suite;

or

a transport layer protocol from the Internet protocol suite.

11. The method of claim 1, the generating one or more shared encryption keys comprising:

generating a public/private key pair, comprising a private key and a public key, for the first trusted computing device;

storing the private key on the first trusted computing device; and

writing the public key to the portable storage device.

12. The method of claim 1, at least some of the one or more shared encryption keys comprising one or more of:

one or more symmetric encryption keys;

or

one or more one-time password encryption keys.

13. A system for creating a secure online environment for an unsecured computing device connected to an untrusted network using a first trusted computing device connected to a trusted network, comprising:

a proxy server installer, within a portable storage device, configured to;

install, using the portable storage device while operatively coupled to a first trusted computing device, a proxy server on the first trusted computing device that uses a first trusted network for online access; and

install, using the portable storage device while operatively coupled to a second trusted computing device, the proxy server on the second trusted computing device that uses a second trusted network for online access;

an encryption key generator, within the portable storage device, configured to generate one or more shared encryption keys for the first trusted computing device and the second trusted computing device on which the proxy server is installed;

an online centralized redirector, within the portable storage device, configured to;

connect, using a proxy server protocol of the portable storage device while operatively coupled to an unsecured computing device connected to an untrusted network, the unsecured computing device to a trusted device website, the trusted device website comprising a list of trusted computing devices, the list of trusted computing devices comprising at least the first trusted computing device and the second trusted computing device; and

a secure connection generator, within the portable storage device, comprising a proxy server initiator configured to;

responsive to a selection of the first trusted computing device from the list of trusted computing devices, create a secure connection, using the proxy server protocol of the portable storage device, between the unsecured computing device and the first trusted computing device using at least some of the one or more shared encryption keys over the untrusted network, at least some of at least one of the proxy server installer, the encryption key generator, the online centralized redirector, or the secure connection generator implemented at least in part via a processing unit.

14. The system of claim 13, the list of trusted computing devices comprising a recommendation specifying that the first trusted computing device has a first connection speed that is faster than a second connection speed of the second trusted computing device.

15. The system of claim 13, the list of trusted computing devices comprising a recommendation specifying that the first trusted computing device has a first proximity to the unsecured computing device that is closer than a second proximity of the second trusted computing device to the unsecured computing device.

16. The system of claim 13, the list of trusted computing devices comprising a recommendation specifying that the first trusted computing device comprises at least one of a program or a file that the second trusted computing device does not comprise.

17. The system of claim 13, the encryption key generator configured to generate at least one shared encryption key for the portable storage device.

18. The system of claim 13, the secure connection between the unsecured computing device and the first trusted computing device configured to proxy data traffic for the unsecured computing device that is using the untrusted network through the first trusted computing device that is using the first trusted network.

19. The system of claim 13, at least some of the one or more shared encryption keys comprising one or more of:

one or more asymmetric encryption keys;

one or more symmetric encryption keys;

or

one or more one-time password encryption keys.

20. A computer-readable storage device comprising computer-executable instructions, which when executed at least in part via a processing unit on a computer perform acts, comprising:

installing, using a portable storage device while operatively coupled to a first trusted computing device, a proxy server on the first trusted computing device that uses a first trusted network for online access;

installing, using the portable storage device while operatively coupled to a second trusted computing device, the proxy server on the second trusted computing device that uses a second trusted network for online access;

generating one or more shared encryption keys for the first trusted computing device and the second trusted computing device on which the proxy server is installed;

connecting, using a proxy server protocol of the portable storage device while operatively coupled to an unsecured computing device connected to an untrusted network, the unsecured computing device to a trusted device website, the trusted device website comprising a list of trusted computing devices, the list of trusted computing devices comprising at least the first trusted computing device and the second trusted computing device; and

responsive to a selection of the first trusted computing device from the list of trusted computing devices, creating a secure connection, using the proxy server protocol of the portable storage device, between the unsecured computing device and the first trusted computing device using at least some of the one or more shared encryption keys.