Secure Apparatus Enabled Secure Platform Integration

Patent metadata

Field	Value
Publication number	US-2022141015-A1
Application number	US-202117518228-A
Country	US
Kind code	A1
Filing date	Nov 3, 2021
Priority date	Nov 3, 2020
Publication date	May 5, 2022
Grant date	—

Abstract

In accordance with some embodiments, a secure modular apparatus providing a first platform for secure platform integration includes communication device(s) and a key store for storing encryption keys. The apparatus additionally includes a crypto engine operable to use the encryption keys for cryptographic operations. The apparatus also includes a controller and a housing arranged to at least partially support the communication device(s), the key store, the crypto engine, and the controller. The controller, via the communication device(s), exchanges encrypted messages prepared or processed by the crypto engine with a second platform provided by a personal communication device, where the second platform is distinct from the first platform and has a plurality of layers including at least one layer between a hardware layer and high level layers, and the encrypted messages control one or more of a hardware unit in the hardware layer and a component in the high level layers.

First claim

What is claimed is:

1 . A system comprising:
an apparatus providing a first platform and a personal communication device providing a second platform, wherein the second platform is distinct from the first platform, the second platform has a plurality of layers including at least one layer between a hardware layer and high level layers; wherein the apparatus includes:
one or more communication devices;
a key store for storing encryption keys;
a crypto engine operable to use the encryption keys for cryptographic operations; and
a controller operable to, via the one or more communication devices, exchange encrypted messages prepared or processed by the crypto engine with the second platform, wherein the encrypted messages control one or more of a hardware unit in the hardware layer and a component in the high level layers.

2 . The system of claim 1 , wherein controlling the one or more of the hardware unit in the hardware layer and the component in the high level layers includes enabling, disabling, supplementing, or replacing at least one feature of the one or more of the hardware unit and the component via the encrypted messages facilitated by the at least one layer.

3 . The system of claim 1 , wherein:
the one or more components in the high level layers include a secure application communicatively coupled with the first platform; and the encrypted messages include at least one message passing through the secure application to communicate with the at least one layer.

4 . The system of claim 1 , wherein:
the encrypted messages include at least one message passing through a virtual machine to communicate with the at least one layer.

5 . The system of claim 1 , wherein:
the encrypted messages include at least one message passing through a communication device of the one or more communication devices to communicate with the at least one layer without transiting through a layer of the higher level layers.

6 . The system of claim 1 , wherein:
the encrypted messages include at least one message directing the at least one layer to control or monitor a communication device in the hardware units on the personal communication device, including disabling the communication device or redirecting communications associated with the communication device.

7 . The system of claim 1 , wherein:
the apparatus further includes sensors operable to obtain sensor data independent of device sensors of the hardware units on the personal communication device in the second platform; and controlling the one or more of the hardware unit and the component includes controlling or disabling the device sensors, including using the sensor data to perform one or more of replacing, verifying, and supplementing the device sensors.

8 . The system of claim 7 , wherein:
the device sensors on the personal communication device collect a first set of identity trait data associated with a user of the second platform; the sensors are further operable to obtain a second set of identity trait data of the user for independent authentication of the user by the first platform.

9 . The system of claim 1 , wherein:
the cryptographic operations include using at least one of the encryption keys for validating an application in the high level layers.

10 . The system of claim 1 , wherein:
controlling the one or more of the hardware unit in the hardware layer and the component in the high level layers includes to initializing one or more of a bootloader layer coupled with the hardware layer and the component using one or more of the encryption keys.

11 . The system of claim 1 , wherein:
the encrypted messages include at least a first message directing the at least one layer to obtain operational status from the high level layers and communicate the operational status to the apparatus via the one or more communication devices.

12 . The system of claim 10 , wherein:
the controller is further operable to report to a server, via a remote communication device of the one or more communication devices or via the personal communication device, the operational status.

13 . The system of claim 12 , wherein:
the controller is further operable to receive from the server, via the remote communication device or the personal communication device, configurations of the personal communication device, wherein the server determines the configurations based on aggregated operational status from a plurality of apparatuses; and the encrypted messages include at least a second message directing the at least one layer to enforce the configurations in one or more of the hardware layer and the high level layers.

14 . The system of claim 12 , wherein:
the controller is further operable to detect the remote communication device or the personal communication devicedisconnecting from the server; and controlling the one or more of the hardware unit in the hardware layer and the component in the high level layers includes enforcing the configurations in one or more of the hardware layer and the high level layers.

15 . The system of claim 1 , wherein:
the hardware units include a processor; and the encrypted messages include at least a message directing the processor to offload at least a portion of processing on the second platform by the processor to be executed on the first platform.

16 . The system of claim 1 , wherein:
the hardware units include a storage for storing application data from the second platform; and the encrypted messages include the application data to be accessed and modified by the first platform.

17 . The system of claim 1 , wherein:
the cryptographic operations include using the one or more encryption keys to form an outer layer of a secure tunnel used by the second platform to communicate with a remote source, an inner layer of the secure tunnel is formed between the personal communication device and the remote source.

18 . The system of claim 1 , wherein the apparatus further includes a housing at least partially supporting the one or more communication devices, the key store, the crypto engine, and the controller.

19 . The system of claim 18 , wherein the housing is arranged to hold the personal communication device.

20 . An apparatus providing a first platform comprising:
one or more communication devices; a key store for storing encryption keys; a crypto engine operable to use the encryption keys for cryptographic operations; a controller operable to, via the one or more communication devices, exchange encrypted messages prepared or processed by the crypto engine with a second platform provided by a personal communication device, wherein the second platform is distinct from the first platform and has a plurality of layers including at least one layer between a hardware layer and high level layers, and the encrypted messages control one or more of a hardware unit in the hardware layer and a component in the high level layers; and a housing arrange to at least partially support the one or more communication devices, the key store, the crypto engine, and the controller.

Assignees

• Ppip Llc

Inventors

• Fong Michael
• Fong Neric Hsin-Wu
• Foustok Mohamad Ahmad
• Speers Ryan Mark

Classifications

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/0894 Primary

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04M2250/12

  including a sensor for measuring a physical value, e.g. temperature or motion · CPC title

• H04M1/724092

  Interfacing with an external cover providing additional functionalities · CPC title

• H04L63/0485

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title