Method and system to maintain portable computer data secure and authentication token for use therein

• US 20030005300A1
• Filed: 04/09/2002
• Published: 01/02/2003
• Est. Priority Date: 04/12/2001
• Status: Active Grant

• Current Assignee: Board of Regents of the University of Michigan (University of Michigan)
• Original Assignee: Board of Regents of the University of Michigan (University of Michigan)
• Inventors: Corner, Mark D., Noble, Brian D.
• Granted Patent: US 7,302,571 B2
• Time in Patent Office: Days
• US Class Current: 713/172
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06Q 20/3674 involving authentication

Abstract

A method and system to maintain portable computer data secure and an authentication token for use in the system are provided. The present invention provides for fine-grained authentication and full security of a laptop file system. The laptop disk is encrypted and each time data is fetched from the disk the laptop sends a short message requesting a decryption key from an authentication token worn or associated with the proper laptop user. If the user and his/her token are “present,” then access is allowed. If the user and his/her token are not “present” (i.e., within a predetermined radius), then access is disallowed and all in-memory data is flushed to the disk. The user wears the small authentication token that communicates with the laptop over a short-range, wireless link. Whenever the laptop needs decryption authority, it acquires it from the token; authority is retained only as long as necessary. With careful key management, the invention imposes an overhead of 11% compared to the local disk for representative workloads. Up to 36 MB of cached, decrypted data can be re-encrypted within five seconds of the user'"'"'s departure, and restored in just over five seconds after detecting the user'"'"'s return. This secures the machine before an attacker can gain physical access, but recovers full performance before a returning user resumes work. The invention provides laptop security without substantially impacting performance or requiring changes in user behavior.

Claims

1. A system to maintain data stored on a portable computer secure, the system comprising:

an authorization client for use on the portable computer for making requests;

a security device to be associated with an authorized user of the portable computer and including an authorization server for supplying responses to the requests;

a communication subsystem for wirelessly communicating the requests and the responses to the server and the client, respectively, within a range; and

a cryptographic subsystem for use on the portable computer for encrypting the data to obtain corresponding encrypted data when the security device is outside the range of the communication subsystem and for decrypting the encrypted data when the security device is back within the range.

2. The system as claimed in claim 1 wherein the requests include cryptographic requests for cryptographic information and wherein the server supplies the cryptographic information in response to the cryptographic requests and wherein the cryptographic subsystem utilizes the cryptographic information to either encrypt or decrypt the data.

3. The system as claimed in claim 1 wherein the requests include polling requests.

4. The system as claimed in claim 2 wherein the cryptographic information includes keys.

5. The system as claimed in claim 4 wherein the keys are encrypted.

6. The system as claimed in claim 4 wherein the keys include user and group keys.

7. The system as claimed in claim 1 further comprising a mechanism for establishing a binding between the portable computer and the security device to ensure that the security device only responds to a portable computer with a valid binding.

8. The system as claimed in claim 1 wherein the security device is an authorization token.

9. The system as claimed in claim 2 wherein the computer has a low speed memory and high speed memory and wherein the data stored in the high speed memory is not encrypted and the data stored in the low speed memory is encrypted.

10. The system as claimed in claim 2 wherein the cryptographic subsystem includes encrypted keys and wherein the cryptographic information includes keys for decrypting the encrypted keys.

11. The system as claimed in claim 1 wherein the requests including the polling requests are encrypted.

13. The method as claimed in claim 12 wherein the requests include cryptographic requests for cryptographic information and wherein the server supplies the cryptographic information in response to the cryptographic requests and where-in the cryptographic information is used to either encrypt or decrypt the data.

14. The method as claimed in claim 12 further comprising establishing a binding between the portable computer and the security device to ensure that the security device only responds to a portable computer with a valid binding.

16. The token as claimed in claim 15 wherein the requests include cryptographic requests for cryptographic information and wherein the server supplies the cryptographic information in response to the cryptographic requests.

17. The token as claimed in claim 15 wherein the requests include polling requests.

18. The token as claimed in claim 16 wherein the cryptographic information includes keys.

19. The token as claimed in claim 18 wherein the keys are encrypted.

20. The token as claimed in claim 18 wherein the keys include user and group keys.

12. A method to maintain data stored on a portable computer secure, the method comprising:

providing an authorization client for use on the portable computer for making requests;

providing a security device to be associated with an authorized user of the portable computer and including an authorization server for supplying responses to the requests;

wirelessly communicating the requests and the responses to the server and the client, respectively, within a range;

encrypting the data to obtain corresponding encrypted data when the security device is outside the range; and

decrypting the encrypted data when the security device is back within the range.

15. An authorization token for use in a system to maintain data stored on a portable computer secure, the token comprising:

an authorization server for supplying encrypted responses to encrypted requests; and

a transceiver for receiving the requests and transmitting the responses to the portable computer.