Providing secure data transmission over a universal serial bus (usb) interface

Patent metadata

Field	Value
Publication number	US-2018115533-A1
Application number	US-201615334782-A
Country	US
Kind code	A1
Filing date	Oct 26, 2016
Priority date	Oct 26, 2016
Publication date	Apr 26, 2018
Grant date	—

Abstract

An example includes a computing device including a controller configured to communicably couple the computing device to a peripheral computing device. The controller includes an encryption unit configured to encrypt input data received from the peripheral computing device before sending the input data to an application running on the computing device, and a decryption unit configured to decrypt output data received from the application before sending the output data to the peripheral computing device. The computing device also includes a memory device including a data structure that directs the flow of the data between the peripheral computing device and the application. The data structure includes an encryption enable field and an encryption key field for controlling the encryption and decryption units of the controller.

First claim

What is claimed is:

1 . A computing device, comprising:
a controller configured to communicably couple the computing device to a peripheral computing device, wherein the controller comprises:
an encryption unit configured to encrypt input data received from the peripheral computing device before sending the input data to an application running on the computing device;
a decryption unit configured to decrypt output data received from the application before sending the output data to the peripheral computing device; and
a memory device comprising a data structure that directs the flow of the input data and the output data between the peripheral computing device and the application, wherein the data structure comprises an encryption enable field and an encryption key field for controlling the encryption unit and the decryption unit of the controller.

2 . The computing device of claim 1 , wherein the controller accesses the data structure within the memory device and uses information from the data structure to control the encryption unit and the decryption unit.

3 . The computing device of claim 2 , wherein the controller accesses a portion of the data structure corresponding to an input endpoint for the input data before determining whether to encrypt the input data using the encryption unit.

4 . The computing device of claim 2 , wherein the controller accesses a portion of the data structure corresponding to an output endpoint for the output data before determining whether to decrypt the output data using the decryption unit.

5 . The computing device of claim 1 , wherein the controller is configured to communicably couple the computing device to a plurality of peripheral computing devices.

6 . The computing device of claim 5 , wherein the encryption unit is configured to encrypt input data received from any of the plurality of peripheral computing devices before sending the input data to any of a plurality of applications running on the computing device.

7 . The computing device of claim 5 , wherein the decryption unit is configured to decrypt output data received from any of a plurality of applications before sending the output data to any of the plurality of peripheral computing devices.

8 . The computing device of claim 1 , wherein the encryption enable field of the data structure indicates whether the encryption unit is to be enabled for the input data, and wherein the encryption key field comprises an encryption key to be used to encrypt the input data if the encryption enable field indicates that the encryption unit is to be enabled for the input data.

9 . The computing device of claim 1 , wherein the encryption enable field of the data structure indicates whether the decryption unit is to be enabled for the output data, and wherein the encryption key field comprises an encryption key to be used to decrypt the output data if the encryption enable field indicates that the decryption unit is to be enabled for the output data.

10 . The computing device of claim 1 , wherein the computing device runs the application in a higher virtual trust level than other software running on the computing device.

11 . The computing device of claim 1 , wherein the controller comprises a USB controller, and wherein the peripheral computing device comprises a USB device.

12 . A method for securely transmitting input data between a computing device and a peripheral computing device, comprising:
receiving, at a controller of a computing device, input data from a peripheral computing device; detecting whether an encryption feature of the controller is enabled; and if the encryption feature is enabled, encrypting the input data before sending the input data to an application running on the computing device.

13 . The method of claim 12 , further comprising, if the encryption feature is not enabled, sending the input data to the application.

14 . The method of claim 12 , wherein detecting whether an encryption feature of the controller is enabled comprises:
accessing a portion of a data structure corresponding to an input endpoint for the input data; and determining whether an encryption enable field of the portion of the data structure is set for the input data.

15 . The method of claim 14 , wherein encrypting the input data comprises:
if the encryption enable field is set for the input data, reading an encryption key field of the portion of the data structure to determine an encryption key corresponding to the input data; and using the encryption key to encrypt the input data at an encryption unit of the controller.

16 . The method of claim 12 , further comprising:
receiving, at the controller, input data from a plurality of peripheral computing devices; detecting whether an encryption feature of the controller is enabled for the input data received from each of the plurality of peripheral computing devices; and if the encryption feature is enabled for input data received from any of the plurality of peripheral computing devices, encrypting the input data before sending the input data to any of a plurality of applications running on the computing device.

17 . A method for securely transmitting output data between a computing device and a peripheral computing device, comprising:
receiving, at a controller of a computing device, output data from an application running on the computing device; detecting whether the output data is encrypted; if the output data is encrypted, decrypting the output data before sending the output data to a peripheral computing device.

18 . The method of claim 17 , further comprising, if the output data is not encrypted, sending the output data to the peripheral computing device.

19 . The method of claim 17 , wherein detecting whether the output data is encrypted comprises:
accessing a portion of a data structure corresponding to an output endpoint for the output data; and determining whether an encryption enable field of the portion of the data structure is set for the output data.

20 . The method of claim 19 , wherein decrypting the output data comprises:
if the encryption enable field is set for the output data, reading an encryption key field of the portion of the data structure to determine an encryption key corresponding to the output data; and using the encryption key to decrypt the output data at a decryption unit of the controller.

21 . The method of claim 17 , further comprising:
receiving, at the controller, output data from a plurality of applications running on the computing device; detecting whether the output data received from any of the plurality of applications is encrypted; and if the output data received from any of the plurality of applications is encrypted, decrypting the output data before sending the output data to any of a plurality of peripheral computing devices.

22 . A tangible, non-transitory, computer-readable medium comprising instructions that, when executed by a processor, direct the processor to:
securely transmit input data by:
receiving the input data from a peripheral computing device; and
encrypting the input data at a controller before transmitting the input data to an application; and
securely transmit output data by:
receiving the output data from the application; and
decrypting the output data at the controller before transmitting the output data to the peripheral computing device.

23 . The computer-readable medium of claim

Assignees

• Intel Corp

Inventors

• Wielicki Rafal
• Stelter Jaroslaw
• Rider Tomer

Classifications

• G06F13/4282

  on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247) · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0435 Primary

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title