Providing secure data transmission over a universal serial bus (USB) interface

Patent metadata

Field	Value
Publication number	US-10715501-B2
Application number	US-201615334782-A
Country	US
Kind code	B2
Filing date	Oct 26, 2016
Priority date	Oct 26, 2016
Publication date	Jul 14, 2020
Grant date	Jul 14, 2020

Abstract

An example includes a computing device including a controller configured to communicably couple the computing device to a peripheral computing device. The controller includes an encryption unit configured to encrypt input data received from the peripheral computing device before sending the input data to an application running on the computing device, and a decryption unit configured to decrypt output data received from the application before sending the output data to the peripheral computing device. The computing device also includes a memory device including a data structure that directs the flow of the data between the peripheral computing device and the application. The data structure includes an encryption enable field and an encryption key field for controlling the encryption and decryption units of the controller.

First claim

What is claimed is:

1. A computing device, comprising:
a controller configured to communicably couple the computing device to a peripheral computing device, wherein the controller comprises:
an encryption unit on the computer device configured to encrypt input data received from the peripheral computing device before sending the input data to an application running on the computing device wherein the computing device runs the application in a higher virtual trust level than other software running on the computing device; and
a decryption unit on the computer device configured to decrypt output data received from the application running on the computing device before sending the output data to the peripheral computing device; and

a memory device comprising a data structure that directs a flow of the input data and the output data between the peripheral computing device and the application, wherein the data structure comprises an encryption enable field and an encryption key field for controlling the encryption unit and the decryption unit of the controller, wherein the encryption enable field of the data structure indicates whether the encryption unit is to be enabled for the input data, and wherein the encryption key field comprises an encryption key to be used to encrypt the input data in response to the encryption enable field indicating that the encryption unit is to be enabled for the input data.

2. The computing device of claim 1 , wherein the controller accesses the data structure within the memory device and uses information from the data structure to control the encryption unit and the decryption unit.

3. The computing device of claim 2 , wherein the controller accesses a portion of the data structure corresponding to an input endpoint for the input data before determining whether to encrypt the input data using the encryption unit.

4. The computing device of claim 2 , wherein the controller accesses a portion of the data structure corresponding to an output endpoint for the output data before determining whether to decrypt the output data using the decryption unit.

5. The computing device of claim 1 , wherein the controller is configured to communicably couple the computing device to a plurality of peripheral computing devices.

6. The computing device of claim 5 , wherein the encryption unit is configured to encrypt the input data received from any of the plurality of peripheral computing devices before sending the input data to any of a plurality of applications running on the computing device.

7. The computing device of claim 5 , wherein the decryption unit is configured to decrypt the output data received from any of a plurality of applications before sending the output data to any of the plurality of peripheral computing devices.

8. The computing device of claim 1 , wherein the controller comprises a USB controller, and wherein the peripheral computing device comprises a USB device.

9. A method for securely transmitting input data between a computing device and a peripheral computing device, comprising:
encrypting input data with an encryption unit on the computer device, the input data received from a peripheral computing device communicably coupled to the computing device with a controller, wherein the encrypting occurs before sending the input data from the peripheral computing device to an application running on the computing device wherein the computing device runs the application in a higher virtual trust level than other software running on the computing device; and
decrypting output data with a decryption unit on the computer device, wherein the decryption of is of output data received from the application running on the computing device before sending the output data to the peripheral computing device; and
directing, with a memory device comprising a data structure, a flow of the input data and the output data between the peripheral computing device and the application, wherein the data structure comprises an encryption enable field and an encryption key field for controlling the encryption unit and the decryption unit of the controller, wherein the encryption enable field of the data structure indicates whether the encryption unit is to be enabled for the input data, and wherein the encryption key field comprises an encryption key to be used to encrypt the input data in response to the encryption enable field indicating that the encryption unit is to be enabled for the input data.

10. The method of claim 9 , further comprising, in response to a detection that an encryption feature is not enabled, sending the input data to the application.

11. The method of claim 9 , wherein detecting whether an encryption feature of the controller is enabled comprises:
accessing a portion of a data structure corresponding to an input endpoint for the input data; and
determining whether the encryption enable field of the portion of the data structure is set for the input data.

12. The method of claim 11 , wherein encrypting the input data comprises:
in response to setting the encryption enable field for the input data, reading an encryption key field of the portion of the data structure to determine the encryption key corresponding to the input data; and
using the encryption key to encrypt the input data at the encryption unit of the controller.

13. The method of claim 9 , further comprising:
receiving, at the controller, the input data from a plurality of peripheral computing devices;
detecting whether the encryption feature of the controller is enabled for the input data received from each of the plurality of peripheral computing devices; and
in response to enabling the encryption feature for the input data received from any of the plurality of peripheral computing devices, encrypting the input data before sending the input data to any of a plurality of applications running on the computing device.

14. A tangible, non-transitory, computer-readable medium comprising instructions that, when executed by a processor, direct the processor to:
encrypt input data with an encryption unit, the input data received from a peripheral computing device communicably coupled to the computer-readable medium with a controller, wherein the encrypting occurs before sending the input data from the peripheral computing device to an application running on the computer-readable medium wherein the computer-readable medium directs the processor to run the application in a higher virtual trust level than other software running on the by the instructions of the computer-readable medium; and
decrypt output data with a decryption unit on the computer-readable medium, wherein the decryption of is of output data received from the application running on the computer-readable medium before sending the output data to the peripheral computing device; and
direct, with a memory device comprising a data structure, the flow of the input data and the output data between the peripheral computing device and the application, wherein the data structure comprises an encryption enable field and an encryption key field for controlling the encryption unit and the decryption unit of the controller, wherein the encryption enable field of the data structure indicates whether the encryption unit is to be enabled for the input data, and wherein the encryption key field comprises an encryption key to be used to encrypt the input data in response to the encryption enable field indicating that the encryption unit is to be enabled for the input data.

15. The tangible, non-transitory, computer-readable medium of claim 14 , wherein the tangible, non-transitory

Assignees

• Intel Corp

Inventors

• Wielicki Rafal
• Stelter Jaroslaw
• Rider Tomer

Classifications

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• G06F13/4282

  on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247) · CPC title

• H04L63/0435 Primary

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title