SECURE KEY COMPONENT AND PIN ENTRY

• US 20170041143A1
• Filed: 08/04/2015
• Published: 02/09/2017
• Est. Priority Date: 08/04/2015
• Status: Active Grant

• Current Assignee: entIT Software LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: LIBERSHTEYN, Vladimir, WINDLE, Chris A., Liu, Richard
• Granted Patent: US 9,917,696 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

According to an example, secure key component and PIN entry may include receiving a communication from a smart card control device upon connection of the smart card control device with a secure key component and PIN entry apparatus. The communication may be related to storage of a key component on a smart card that is communicatively connectable to the apparatus. The key component may be related to a Master File Key (MFK) that is formed by using a plurality of key components including the key component. In response to the communication, the smart card may be prompted to generate the key component, or entry of the key component may be received based on actuation of a keypad of the apparatus. Further, the generated or received key component may be stored on the smart card upon connection of the smart card with the apparatus.

Claims

1. A method for secure key component and personal identification number (PIN) entry, the method comprising:

receiving, by a secure key component and PIN entry apparatus comprising a physical processor, a communication from a smart card control device upon connection of the smart card control device with the apparatus, wherein the communication is related to storage of a key component on a smart card that is communicatively connectable to the apparatus, and wherein the key component is related to a Master File Key (MFK) that is formed by using a plurality of key components including the key component;

in response to the communication,

prompting, by the apparatus comprising the physical processor, the smart card to generate the key component, or

receiving, by the apparatus comprising the physical processor, entry of the key component based on actuation of a keypad of the apparatus; and

storing, by the apparatus comprising the physical processor, the generated or received key component on the smart card upon connection of the smart card with the apparatus.

2. The method according to claim 1, wherein the key component is related to the MFK that is formed by applying an XOR operation to the plurality of key components.

3. The method according to claim 1, further comprising:

loading, by the apparatus comprising the physical processor, the key component from the smart card onto a hardware security module for generating the MFK.

4. The method according to claim 1, further comprising:

determining, by the apparatus comprising the physical processor, a status of the apparatus as being secure or insecure; and

in response to a determination that the status of the apparatus is insecure, changing, by the apparatus comprising the physical processor, predetermined information on the apparatus to a predetermined value.

5. The method according to claim 4, wherein determining, by the apparatus comprising the physical processor, the status of the apparatus as being secure or insecure further comprises:

determining whether a contact part disposed on a first panel of the apparatus is disposed in an engaged or a disengaged position relative to another contact part disposed on a second panel of the apparatus; and

in response to a determination that the contact part disposed on the first panel of the apparatus is disposed in the disengaged position relative to the another contact part disposed on the second panel of the apparatus, changing, by the apparatus comprising the physical processor, the predetermined information on the apparatus to the predetermined value.

6. The method according to claim 1, further comprising:

determining, by the apparatus comprising the physical processor, whether a power status of the apparatus is below a predetermined threshold; and

in response to a determination that the power status of the apparatus is below the predetermined threshold, changing, by the apparatus comprising the physical processor, predetermined information on the apparatus to a predetermined value.

7. The method according to claim 6, wherein the predetermined value is zero.

8. A secure key component and personal identification number (PIN) entry apparatus comprising:

a keypad facilitating selection of numbers 0-9, and letters A-F for key component entry in hexadecimal notation;

at least one physical processor; and

a memory storing machine readable instructions that when executed by the at least one physical processor cause the at least one physical processor to;

receive a communication from a smart card control device upon connection of the smart card control device with the apparatus, wherein the communication is related to storage of a key component on a smart card communicatively connectable to the apparatus, and wherein the key component is related to a Master File Key (MFK) that is formed by using a plurality of key components including the key component;

in response to the communication,

prompt the smart card to generate the key component, or

receive entry of the key component responsive to actuation of the keypad; and

store the generated or received key component on the smart card upon connection of the smart card with the apparatus.

9. The secure key component and PIN entry apparatus according to claim 8, further comprising a tamper proof seal on first and second panels of the apparatus, wherein the tamper proof seal is at least one of removable and breakable to provide a visual indication of tampering with the apparatus.

10. The secure key component and PIN entry apparatus according to claim 8, further comprising machine readable instructions that when executed by the at least one physical processor further cause the at least one physical processor to:

load the key component from the smart card onto a hardware security module for generating the MFK.

11. The secure key component and PIN entry apparatus according to claim 8, further comprising machine readable instructions that when executed by the at least one physical processor further cause the at least one physical processor to:

determine whether a contact part disposed on a first panel of the apparatus is disposed in an engaged or a disengaged position relative to another contact part disposed on a second panel of the apparatus; and

in response to a determination that the contact part disposed on the first panel of the apparatus is disposed in the disengaged position relative to the another contact part disposed on the second panel of the apparatus, change predetermined information on the apparatus to a predetermined value.

12. The secure key component and PIN entry apparatus according to claim 8, further comprising machine readable instructions that when executed by the at least one physical processor further cause the at least one physical processor to:

determine whether a power status of the apparatus is below a predetermined threshold; and

in response to a determination that the power status of the apparatus is below the predetermined threshold, change predetermined information on the apparatus to a predetermined value.

13. A non-transitory computer readable medium having stored thereon machine readable instructions to provide secure key component and personal identification number (PIN) entry, the machine readable instructions, when executed, cause at least one physical processor of a secure key component and PIN entry apparatus to:

receive a communication from a smart card control device upon connection of the smart card control device with the apparatus, wherein the communication is related to storage of a key component on a smart card that is communicatively connectable to the apparatus, and wherein the key component is related to a Master File Key (MFK) that is formed by using a plurality of key components including the key component;

in response to the communication,

prompt the smart card to generate the key component, or

receive entry of the key component based on actuation of buttons of a keypad of the apparatus;

store the generated or received key component on the smart card upon connection of the smart card with the apparatus; and

load the key component from the smart card onto a hardware security module for generating the MFK.

14. The non-transitory computer readable medium according to claim 13, further comprising machine readable instructions, when executed, further cause the at least one physical processor of the apparatus to:

generate a prompt to enter a PIN prior to generation of the key component, or receiving of the entry of the key component based on the actuation of the buttons related to the key component;

verify the PIN to determine whether a user of the apparatus is an authorized user; and

in response to a determination that the user of the apparatus is the authorized user, prompt the smart card to generate the key component, or receive entry of the key component based on the actuation of the buttons related to the key component.

15. The non-transitory computer readable medium according to claim 13, further comprising machine readable instructions, when executed, further cause the at least one physical processor of the apparatus to:

determine whether a contact part disposed on a first panel of the apparatus is disposed in an engaged or a disengaged position relative to another contact part disposed on a second panel of the apparatus; and

in response to a determination that the contact part disposed on the first panel of the apparatus is disposed in the disengaged position relative to the another contact part disposed on the second panel of the apparatus, change predetermined information on the apparatus to a predetermined value.