RU2738823C1 - Peripheral device with integrated safety system using artificial intelligence - Google Patents

Abstract

FIELD: computer equipment.

SUBSTANCE: invention relates to the field of computer equipment, in particular to peripheral portable device, which can interact with the main computing device. Peripheral device with an integrated safety system using artificial intelligence comprises a housing, in which there are: at least one driver configured to obtain an access code from a user and based on said selection of operating modes; at least one security means to enable execution of one or more security operations on data; at least one device for providing interaction of peripheral device with main computing device; means for operatively connecting the security means to the host device in response to an instruction from the host device; apparatus for transmitting data between a main computing device and a peripheral means, such that transmitted data must first pass through a security means; artificial intelligence module.

EFFECT: technical result is higher safety of peripheral device.

12 cl, 8 dwg

Description

FIELD OF TECHNOLOGY

[001] This invention relates to the field of computing, and in particular to a peripheral portable device that can interact with a main computing device.

LEVEL OF TECHNOLOGY

[002] Computing devices are becoming increasingly portable today. In particular, there are more and more portable peripheral devices that are capable of communicating with a host computing device (eg, desktop computer, laptop, or personal digital assistant) to achieve certain functionality. These portable peripherals can take many different physical forms (eg, PCMCIA cards, smart cards, CDs) and can perform a variety of functions (eg, storage, communication, encryption, etc.).

[003] While portable computing provides a number of advantages, it has the significant disadvantage that the computing environment (including portable peripherals and any other computing devices that communicate with these devices) is more susceptible to security breaches, i. E. unauthorized access or modification of programs and / or data located in this environment. Therefore, cryptographic devices and methods of their use can be developed for use in such computing environments (as well as in other computing environments) to provide enhanced security for the environment.

SUMMARY OF THE INVENTION

[004] This technical solution is aimed at eliminating the disadvantages known from the prior art.

[005] The technical problem or technical problem solved in this technical solution is the implementation of a peripheral device with an integrated security system using artificial intelligence.

[006] The technical result is to improve the security of the peripheral device, which is carried out through the use of artificial intelligence, which controls access to various sections of the peripheral device based on user authentication.

[007] The specified technical result is achieved by implementing a peripheral device with an integrated security system using artificial intelligence, comprising a housing in which is located at least one security means to enable one or more security operations on data; at least one means for providing interaction of the peripheral device with the host computing device; means for operatively connecting the security means to the host in response to an instruction from the host; and means for transmitting data between the host computing device and the peripheral means, so that the transmitted data must first pass through the security means; an artificial intelligence module configured to change the user's privacy level based on recognition of data loaded on the user's peripheral device, while the user is restricted from accessing the content until the artificial intelligence component changes the user's privacy level based on his authentication.

[008] In some implementations, the peripheral device further comprises means for non-volatile data storage. [009] In some embodiments, the peripheral device further comprises means for providing communication between the host and the remote device.

[0010] In some embodiments, the peripheral device further comprises a biometric device.

[0011] In some embodiments, the peripheral device further comprises means for communicating with a smart card.

[0012] In some embodiments, the nonvolatile storage device further comprises a solid state disk storage device.

[0013] In some embodiments, the solid state disk storage device comprises an ATA format flash disk.

[0014] In some embodiments, the peripheral device further comprises means for providing communication between the host and the remote device.

[0015] In some embodiments, the means for providing communication between the host and the remote device further comprises wireless communication means.

[0016] In some embodiments, the wireless communication means comprises a wireless modem.

[0017] In some embodiments, the wireless communication means comprises a wireless local area network transceiver.

[0018] In some embodiments, the biometric device comprises a fingerprint scanner.

[0019] In some embodiments, the biometric device comprises a retinal scanning device.

[0020] In some implementations, the artificial intelligence module issues recommendations for changing the user's privacy level.

BRIEF DESCRIPTION OF DRAWINGS

[0021] The features and advantages of the present technical solution will become apparent from the following detailed description and the accompanying drawings, in which:

[0022] FIG. 1 shows a block diagram of an implementation of a technical solution in accordance with the invention.

[0023] FIG. 2 is a perspective view of a physical implementation of the system of FIG. 1 according to one embodiment of the invention.

[0024] FIG. 3 shows a block diagram of a peripheral device in accordance with an embodiment of the invention.

[0025] FIG. 4 shows a flow diagram of a method in accordance with an embodiment of the invention for initiating use of a system in accordance with the invention.

[0026] FIG. 5 is a block diagram of a system in accordance with an embodiment of the invention illustrating the operation of the system during a method in accordance with the invention as in FIG. 4.

[0027] FIG. 6 shows a flowchart of a method in accordance with an embodiment of the invention for using a peripheral device in accordance with the invention.

[0028] FIG. 7 shows a block diagram of a peripheral device in accordance with another embodiment of the invention.

[0029] FIG. 8 is a block diagram illustrating data flow through the interface control device of FIG. 7.

DETAILED DESCRIPTION OF THE INVENTION

[0030] Below will be discussed in detail the terms and their definitions used in the description of this technical solution.

[0031] In this invention, a system means a computer system, a computer (electronic computer), a CNC (numerical control), a PLC (programmable logic controller), computerized control systems and any other devices capable of performing a given, well-defined sequence of operations. (actions, instructions), centralized and distributed databases, smart contracts.

[0032] By a command processor is meant an electronic unit or an integrated circuit (microprocessor) executing machine instructions (programs), or the like. A command processor reads and executes machine instructions (programs) from one or more storage devices. Data storage devices can be, but are not limited to, hard disks (HDD), flash memory, ROM (read only memory), solid-state drives (SSD), optical drives.

[0033] A program is a sequence of instructions for execution by a computer control device or command processing device.

[0034] Server (English server) - an electronic device that performs service functions at the request of the client, providing him with access to certain resources. For the purposes of this disclosure, a server is contemplated that has a persistent connection to an internetwork that can transmit data to a client device. The server can process this data and transmit the processing result back to the client device.

[0035] A data exchange module is a server module that can represent a receiver of incoming signals, and a converter for further processing, and a translator for further sending.

[0036] A computation module is a server module that is a microprocessor specially adapted for complex signal processing.

[0037] Peripheral device (English peripheral) - equipment that allows you to enter information into a computer or output it from it. Peripheral devices are optional for system operation and can be disconnected from the computer.

[0038] FIG. 1 shows a block diagram of a system 100 according to the invention. System 100 includes a host 101 and a peripheral device 102 that communicate via a communications interface 103. Here, the term "peripheral device" can refer to any device that operates outside the host and that is connected to the host. The peripheral device 102 includes a security mechanism 102a that allows security operations (examples of which are described in more detail below) on data that is stored in the host computer 101, data that is transferred from the host computing device 101 to the peripheral device 102, or data, that are transferred from the peripheral device 102 to the host computer 101. As will be explained in more detail below, the peripheral device 102 also provides additional functionality (referred to herein as "target functionality") to the system 100, such as, for example, the ability to store data in a solid state disk storage device. the ability to activate communication from the computing device 101 to another device, the ability to receive biometric input to provide user authentication to the device 101, and the ability to receive and read a smart card inserted into the peripheral device 102.

[0039] In some embodiments, the communication interface 103 can be any one of a variety of communication interfaces, such as a wireless communication interface, a PCMCIA interface, a smart card interface, a serial interface (such as an RS-232 interface), a SCSI interface, or an IDE interface. etc. Each embodiment of the communication interface 103 includes hardware present in each host 101 and peripheral 102 that operates in accordance with a communication protocol (which may be implemented, for example, by software stored in a memory, and / or firmware that is present in host 101 and / or peripheral 102) suitable for this type of communication interface, as will be apparent to anyone skilled in the art. Each embodiment of the communication interface 103 also includes mechanisms for providing physical communication, if any, between the host 101 and the peripheral device 102.

[0040] In some implementations, the security engine 102a may be configured to perform any electronic data protection operation (referred to herein simply as a "security operation"), including, for example, operations that provide one or more basic cryptographic functions such as privacy. data, data integrity check, user authentication and denial of user access. The specific security operations that may be implemented in the peripheral device in accordance with the invention are described in more detail below. These operations are carried out using machine learning.

[0041] In some embodiments, the device further comprises an artificial intelligence module. In another embodiment, connecting a peripheral device further causes the host to generate a set of test patterns from a subset of security research studies and encryption techniques using an artificial intelligence module. An artificial intelligence (AI) module can be, for example, an expert system and / or a neural network.

[0042] The term "intelligence" refers to the ability to reason or make conclusions, such as inferences about the current or future state of a system, based on existing information about the system. Artificial intelligence can be used to identify a specific context or action, or to generate a probability distribution for specific system states without human intervention. Artificial intelligence is based on the use of advanced mathematical algorithms such as decision trees, neural networks, regression analysis, cluster analysis, genetic algorithm and augmented learning to set available data (information) about the system. In particular, the artificial intelligence module allows one of a variety of methodologies to be used for data-driven learning, followed by inference based on models built in this way, for example, hidden Markov models (HMMs) and related dependency models that constitute the prototype of more general probabilistic graphical models. such as Bayesian networks, for example, generated from structure searches using Bayesian model estimates or approximations, linear classifiers such as supporting vector machines (SVMs), nonlinear classifiers such as methods called "neural network" methodologies, fuzzy logic methodologies, and other approaches that perform data merging, etc.), in accordance with the implementation of the various automated aspects described below.

[0043] The artificial intelligence module, in some implementations, is used to change the user's privacy level based on the recognition of data loaded on the user's peripheral device.

[0044] In some implementations, the artificial intelligence module of the peripheral automatically changes the user's privacy level to allow the user to access the content of the peripheral, while the user is restricted from accessing the content until the artificial intelligence component changes the user's privacy level based on its authentication.

[0045] In some implementations, the artificial intelligence module issues recommendations for changing the user's privacy level.

[0046] This solution facilitates the simultaneous exchange of data in a confidential and public context (eg, infrequent or minimally specific) in accordance with an aspect of the present invention, a peripheral implementation. Data can be differentiated on the website for each specific peripheral, for example, by its unique identifier. This can be accomplished in part by downloading user content to make it available to the online community in accordance with various restrictions on the operation of the peripheral. For example, one or more levels of privacy can be assigned to content. Privacy levels can include private or public and / or privacy levels. The user can assign an appropriate privacy level to the content, or alternatively the system or method can recognize the context of the content and automatically assign the appropriate privacy level based on the operation of the artificial intelligence module. In the second case, certain kinds of content can only be "pushed" into sections of the peripheral with an appropriate level of confidentiality. For example, a system or method can be trained to recognize medical or medical-related information contained on a peripheral device and automatically assign the highest privacy level. As a result, this information can be placed in the appropriate section.

[0047] The user can assign levels of privacy or grant access rights to people in various sections of the peripheral device. For example, everyone can be given access to the user's "public" content. This public access can be provided by default or explicitly by the user. Other users that are known to the user can be assigned one or more privacy levels that correspond to the privacy levels assigned to the user's content.

[0048] In some implementations, a person's credentials may be accepted and the person's privacy level (s) may be identified in an authentication step by means of a biometric means. The relevant content of the user can be accessed based on the person's privacy level. Authentication of a person's identity and privacy levels can be repeated for each person logging into the peripheral. Any user can exchange data or otherwise interact with one or more people at different levels of privacy at the same time.

[0049] Specifically, at least the first person may be assigned a first privacy level, and at least a second person may be assigned a second privacy level that is different from the first privacy level. For example, assuming privacy levels 0-2, where 0 is the least private (e.g. public) and 2 is the most private for that particular user, the first privacy level could be 0 and the second privacy level could be 2. The contents of the sections for the first and second privacy levels can be displayed to the first and second person, respectively.

[0050] Further, the user (owner or co-owner of the content of the section) can interact or otherwise communicate with the first and second person simultaneously at two different levels of confidentiality. It should be appreciated that communication between the user and any person can begin at any time, for example, via IM (instant messaging), email, chatting program and / or blogging; however, access to sections of a user's peripheral device can be granted after an appropriate privacy level has been set for each person.

[0051] The security mechanism 102a may, for example, be implemented as a security token. As used herein, a "security token" refers to a device that performs security operations and that includes one or more mechanisms (such as, for example, using a hardware random number generator and / or secure memory) to secure the contents of those operations.

[0052] FIG. 2 is a perspective view of a physical implementation of the system 100 of FIG. 1 according to one embodiment of the invention. FIG. 2, the peripheral device 102 is in the form of a smart card 112 that can be inserted into a corresponding slot 113 formed in the laptop 111, which in FIG. 2 embodies a host 101. Often, a peripheral device in accordance with the invention is a portable device, such as the card 112 shown in FIG. 2. Here, "portable device" can generally refer to any device that can be easily carried by hand.

[0053] FIG. 3 shows a block diagram of a peripheral device 300 in accordance with an embodiment of the invention. Peripheral device 300 includes security functionality 301, target functionality 302, and host interface 303 that are formed together as part of a single physical device. For example, the security functionality 301 and the target functionality 302 may be enclosed in a single smart card-like enclosure (denoted 304 in FIG. 3) conforming to, for example, the PCMCIA standard or the smart card standard.

[0054] Peripheral device 300 can have a number of advantageous characteristics. The peripheral device 300 may be implemented in a manner that allows the operations of protecting the security functionality 301 to be performed in a manner that is known to the host of the system according to the invention, so that the host (and possibly the user) is only aware of the presence of the target functionality 302. In addition In addition, the peripheral device 300 can be implemented such that security operations are performed "in-line", that is, security operations are performed between the transfer of data to or from the host computer and the execution of the target functionality provided by the peripheral device. In addition, the peripheral device 300 makes it easy to provide a wide range of secure target functionality to a computing device.

[0055] FIG. 4 is a flow diagram of a method 400, according to an embodiment of the invention, for initiating use of a system in accordance with the invention. The method 400 provides an aspect of the invention in which the presence of security functionality as part of a peripheral is not detected by the host, thereby making the security functionality transparent to the host.

[0056] FIG. 5 is a block diagram of a system 500 according to an embodiment of the invention illustrating the operation of system 500 during a method according to the invention according to method 400 of FIG. 4. System 500 includes a host 501 and a peripheral device 502. Host 501 includes a display device 503a (e.g., a conventional computer display monitor) and a user input device 503b (e.g., a keyboard, mouse, trackball, joystick, or other appropriate device), hereinafter collectively referred to as user interface device 503. The main computing device 501 also includes a processing device 505 installed in the housing 504, a memory device 506, an input / output (I / O) device 507 for communicating with a user interface device 503, and an input / output (I / O) device 508 to provide communication with a peripheral device 502. Each of the devices 505, 506, 507, and 508 may be implemented with conventional such devices and may communicate with each other via a conventional computer bus 509, as is well known and understood in the art. Peripheral device 502 includes security functionality 511, memory device 512, input / output (I / O) device 513 to enable communication with host 501 and target function 514. Security functionality 511, memory device 512, input / output device 513 output (I / O) and target functionality 514, each individually or together, can be implemented by conventional devices and can communicate with each other via a conventional computer bus 515 as is well known and understood. The host 501 and the peripheral 502 are shown in simplified form in FIG. 5 for ease of clarity in illustrating this aspect of the invention. As described in more detail below and as understood by those of skill in the art, computing device 501 and peripheral device 502 may include other devices not shown in FIG. 5.

[0057] Returning to FIG. 4, use of the system according to the invention begins when, as shown in step 401, a user of the system connects a peripheral device according to the invention to a host computer. Such a connection can take place in any manner that allows the peripheral to communicate with the host. This often occurs as a result of the physical connection of a peripheral device to the host computer. (In general, such a physical connection can occur either before or after the host starts up; however, in the former case, the subsequent steps of method 400 - except, depending on the implementation of the peripheral, step 403, which cannot be performed until the host starts up.) For example, a peripheral device may be embodied in a card or disk (such as a card conforming to the PCMCIA form factor as defined by the relevant standard) that is inserted into an appropriate slot formed in the host. computing device. Or, the peripheral device may be formed in a housing from which a cord extends, the plug of the cord being inserted into a mating receptacle formed in the host. However, such a physical connection does not have to occur. The peripheral device can also be connected to the host computing device via any type of wireless communication for which the host computing device contains an appropriate interface.

[0058] Once the connection between the peripheral device and the host is established, the host detects the presence of the peripheral, as shown in step 402. Such detection of the presence of the peripheral is usually permitted as a standard aspect of host operating system software.

[0059] Typically, once the presence of a new peripheral is detected by the host operating system software, the operating system software (or accompanying program) also identifies the type of peripheral. This can be accomplished, for example, with a standard software device driver (hereinafter "host driver") for devices of the type that use the host interface used by the peripheral 502. FIG. 5 shows that a computing device driver is stored in memory section 506a 506 of host 501. However, in method 400, before the operating system software can perform such identification, the peripheral device in accordance with the invention suspends this aspect of the operating system software so that the peripheral device may establish its identity, as shown in step 403 and explained below. As will be understood from this explanation, performing step 403 advantageously allows the peripheral to receive the identity of the target functionality that is part of the peripheral. Since, as described elsewhere herein below, a peripheral in accordance with the invention may include multiple types of target functionality, the peripheral may receive different identifiers.

[0060] The particular method for suspending the operating system software so that a peripheral device can establish its identity may depend on the characteristics of the operating system software and / or the device interface. However, for many combinations of operating system software and device interface, the operating system software waits for confirmation that the device connected to the device interface is ready to further interact with the operating system software before the operating system software attempts to identify the type of device connected to the device. interface (for example, the standard for PCMCIA interfaces defines such an operation). In such cases, the peripheral device may be configured to delay informing the operating system software that the peripheral device is ready for further interaction until the peripheral device establishes its identity.

[0061] The following description of one manner in which block 403 may be implemented may be better understood with reference to the system 500 shown in FIG. 5. One of the ways in which the operating system software of the host computer can identify the type of peripheral is by accessing a known memory section of the memory of the peripheral, as established by an interface standard designed for that type of peripheral that stores data. representing the type of peripheral device. This is true for various types of peripherals such as peripherals that conform to the PCMCIA standard. The PCMCIA standard, for example, includes a specification called the card information structure, which defines, among other things, the location in a portion of the PCMCIA card memory designated as "attribute memory" that stores data identifying the type of the PCMCIA card. In system 500, peripheral device 502 is such a device. The memory block of the memory device 512 of the peripheral device 502 that the host computer 501 seeks to access is shown in FIG. 5 as a memory section 512a, and the data stored therein are referred to herein as "peripheral device identification".

[0062] The peripheral device 502 can be implemented such that the peripheral device 502 assumes the identity of the target functionality 514 (regardless of whether the security functionality of the peripheral device is also used). This allows the host 501 to interact with the peripheral 502 as if the peripheral 502 was a device of the type of target functionality 514, without recognizing that security functionality 511 is present that can perform security operations. Thus, the need to modify aspects of the host computing device (eg, device driver) to enable security operations is reduced or eliminated, making the implementation and use of a data protection system including peripheral device 502 easier and more reliable. Because it is easier to use the data protection system (for example, the user does not need to enter data so that the computing device driver is properly configured to provide the desired interaction with the security device), the likelihood that the user will use the system inappropriately (for example, do not apply security operations to the interaction with a host computer, or apply security operations incorrectly or incompletely) is reduced.

[0063] Although, as shown in FIG. 5, peripheral device 502 includes security functionality 511 and target functionality 514, system 500 can operate such that only security functionality 511 is used. The peripheral device 502 and the peripheral device driver (discussed below) may be implemented such that when the peripheral device 502 operates such that the identification data of the peripheral device stored in the memory location 512a identifies the peripheral device 502 as a security device.

[0064] Returning to FIG. 4, after the peripheral has established its identity, the host identifies the peripheral as shown in step 404. This may be implemented as part of the computing device driver as discussed above.

[0065] Once the host has identified the peripheral (and other host operating system software operations completed, if applicable), the user can begin to use the peripheral (particularly security features of the peripheral) as indicated at block 505 method 500. Such use may be permitted by one or more programs (hereinafter collectively referred to as a "peripheral device driver, conventionally referred to as" applications ") that are executed by a host computer.

[0066] The use of a separate driver to control and interact with the security functions of a peripheral device in accordance with the invention can be effective as it reduces or eliminates the need to modify the host driver. As a practical matter, such driver modification can probably only be achieved by requiring the user to interact with the standard host driver to modify the standard host driver accordingly. This is undesirable because the user may forget to change the driver or change the driver incorrectly or incompletely.

[0067] The peripheral driver may be pre-installed on the storage device (eg, hard disk) of the host (in FIG. 5, the peripheral driver is shown stored in the memory section 506b of the memory device 506 of the host 501), or it may be made accessible to the host through an appropriate interface (such as a floppy disk drive, CD-ROM drive, or network connection) at the time the user wishes to initiate communication between the host and a peripheral. In addition, when a peripheral device according to the invention is used with a host computer that uses operating system software that supports a function informally called "plug and play", it is also possible to store the peripheral device driver in the device. memory of the peripheral and configure the peripheral so that when the peripheral is first connected to the host, the host automatically enables the user to instruct the host to invoke a peripheral driver for transmission from the peripheral to the host.

[0068] FIG. 6 shows a flow chart of a method 600 in accordance with an embodiment of the invention for using a peripheral device in accordance with the invention. It should be understood that the method 600 shown in FIG. 6 is not the only way to implement the aspects of the use of the peripheral device according to the invention, which are illustrated in FIG. 6. Those of skill in the art will readily understand that such aspects may be implemented using any of a variety of other suitable methods. In addition, the use of a peripheral device according to the invention may include aspects not shown in FIG. 6. The method 600 of FIG. 6 is shown only to assist in illustrating certain aspects of the invention and should not be interpreted as limiting the manner in which the peripheral device according to the invention can be used.

[0069] To begin using a peripheral device in accordance with the invention, the user instructs the host to start executing the peripheral driver as shown in step 601 of method 600, the user must know the appropriate command to start executing the peripheral driver in any suitable manner (for example, from the user manual supplied with the peripheral driver and / or peripheral). In general, the steps of the method 600 occur as a result of the operation of the peripheral driver, however, the operation of the host driver may be necessary or desirable for the operation of some aspects of the method 600 (eg, performing a transaction as shown at blocks 608, 612, and 615).

[0070] As indicated above, the peripheral device in accordance with the invention may be implemented such that the driver subtracts. the device cannot detect the presence of the security functionality of the peripheral. In such a case, the peripheral driver allows security functionality to be discovered, as shown at 602 of method 600. This can be accomplished by including instructions as part of the peripheral driver, when the peripheral driver first starts executing, it accesses a predefined location of the peripheral memory device. devices (in FIG. 5, memory sections 512b) for data that identifies whether the peripheral is a device having security functionality that is compatible with the peripheral driver. If the peripheral is such a device, then the peripheral driver can enable the user to use the security functionality of the peripheral. In addition, a peripheral device driver may be implemented as shown in FIG. 6 so that if proper security functionality is not detected, execution of the peripheral driver is terminated, preventing use of the peripheral. Alternatively, the peripheral device driver can be implemented such that if proper security functionality is not found, the target peripheral functionality can be used without the security functionality of the peripheral.

[0071] A peripheral device according to the invention generally can operate in one of three modes:

1) a mode in which only safety functions are used,

2) a mode in which both safety and target functions are used, and

3) a mode in which only the target functionality is used.

[0072] The user may be able to select any of the three operating modes using the peripheral device driver. However, some applications may prohibit operation in one or two modes. In particular, it may be desirable to prevent a peripheral device from operating in the last of the above modes, that is, in a mode in which the security functionality is not used, if it is desired to ensure that the use of the target functionality can only occur using one or more security operations. This can be achieved by implementing a peripheral driver such that an option for operating in this mode is not presented to the user, or the peripheral can be configured during manufacture to prohibit operating in this mode. For example, if the target functionality is implemented as a communications device or memory device, it may be desirable to ensure that unencrypted data cannot be transmitted through the communications device or stored in the memory device, whether unintentionally or intentionally.

[0073] In method 600, all three of the above modes are available for use. At block 603 of method 600, a determination is made as to whether security functions should be used. As noted above, such use may be required. If yes, the peripheral is operating in one of the first two modes above (safety functions only or safety functions plus target functions). If not, the third mode is used (target functions only).

[0074] A peripheral device driver may be implemented such that a user must successfully enter an acceptable access code (eg, a password or PIN, or apply facial recognition, for example) before the user is allowed to use the peripheral. In particular, they may require an access code before allowing the user to use the security functionality, thereby establishing a security level that protects the integrity of the security operations themselves. In the method 600, as shown at 604, an acceptable access code must be entered by the user before the security functionality of the peripheral can be used. The access code can be entered, for example, by entering the access code in a conventional manner using a user interface device (eg, a keyboard) of the host computing device, or through any biometric method access. Or, the access code may be entered using specific embodiments of the target functionality (eg, a biometric device discussed in more detail below) that is part of a peripheral device in accordance with the invention.

[0075] Advantageously, the access code can be used not only to control access to security functions (or other) of the peripheral device, but also to identify the "identity" of the user. Each person (user) is represented by data that establishes certain characteristics of the operation of the peripheral device, such as, for example, restrictions on the operation of the peripheral device (for example, restrictions on the types of security operations that can be performed) or specification of operating parameters or characteristics (for example, cryptographic keys or specification of a particular embodiment of a type of security algorithm, such as a particular encryption algorithm). Data representing personalities and corresponding user access codes may be stored in a memory device of a peripheral device.

[0076] Upon receipt of an acceptable access code, the peripheral driver controls the host to provide a user interface that allows the user to control the peripheral as desired, and in particular to use the peripheral to perform security operations, as described below. If access codes are also used to identify individuals, then upon receipt of an acceptable access code, the peripheral driver may also access and retrieve data representing the corresponding identity so that the operation of the peripheral can be appropriately controlled. A user interface for enabling a user to control a peripheral device may be implemented in any of a variety of well known methods (eg, as a graphical user interface) using methods and devices that are well known to those skilled in the art. Typically, a user interface allows a user to perform any functionality that is provided by a peripheral, as described in more detail elsewhere in this document.

[0077] As indicated above, the peripheral device according to the invention can operate in any of three modes. Once an acceptable access code is entered, the peripheral driver may allow the user to select one of three modes, as shown at block 605 of method 600. Alternatively, as mentioned above, it may be desirable to present the user with only the security functionality only mode selection. or "security functionality plus targeted functionality mode" to eliminate the possibility that a user would make unsecured use of the targeted functionality. If the security functionality only mode or the security functionality plus target functionality mode is used, the user interface (and the underlying peripheral driver) allows the user to enter all the required instructions regarding the security operations that must be performed for a particular "transaction" (e.g., storing data in a memory device, transmitting data by a communication device, or exchanging data with a smart card reader), as shown in steps 606 and 610 of method 600. For example, a user interface may allow a user to select data for which security operations are to be performed , specify the application of specific security operations to the data, or specify parameters or other information required for a specific security operation. If security mode plus target function mode or target function only mode is selected, the user interface and peripheral driver allows the user to enter any required instructions regarding the use of target functionality for a transaction, as shown in steps 607 and 611 of method 600. For example, if target functionality implemented as a memory device, the user interface can allow the user to specify a name for the stored data. Or, for example, if the target functionality is implemented as a communication device, the user interface can allow the user to specify a destination (eg, an email address) for data transmission.

[0078] Once the user has provided instructions at blocks 606 and 607, at block 610 or at block 611, a transaction is performed as shown at block 608 or block 612 of method 600. After the transaction is completed, the user may be allowed to perform additional transactions as shown at block 609 of method 600. The user can also start using a different identity (by entering the appropriate access code), as shown at block 609 of method 600. Finally, use of the peripheral device ends as shown at block 618 of method 600.

[0079] The peripheral device and the associated peripheral device driver may be implemented such that only the security functionality of the peripheral device can be used. Thus, the peripheral device can be used, for example, to encrypt or decrypt data stored on the host computing device by receiving data from the host computing device, encrypting or decrypting the data as appropriate, and then returning the encrypted or decrypted data to the host computing device. ...

[0080] As noted above, the peripheral device and the associated peripheral device driver can be implemented so that only the target functionality of the peripheral device can be used, even without entering an appropriate access code. In the method 600, such an operation is indicated by steps 614, 615, and 616, which function in the same way as steps 611, 612, and 609 described above. Using a peripheral device in this manner can be useful, for example, when the target functionality is implemented as a biometric device, as described below, that is used to perform user authentication. In particular, if the biometric device is to be used as a mechanism for entering an access code at block 604, operation in this mode may be required (depending on the capabilities of the biometric device) to permit such use of the biometric device. Of course, in this case, the security functionality, that is, user authentication, is used as part of block 615. Block 617 may also allow the security function to be started by invoking a request for an appropriate access code (block 604). Finally, use of the peripheral ends (block 618).

[0081] As described above, a peripheral device in accordance with the invention that includes security functionality and targeted functionality may be implemented such that the host is not aware of the security functionality. They can also protect the user from being aware of the security functionality and force specified security operations to be automatically performed. This may be necessary so that, for example, the user does not need to provide input regarding the performance of security operations, thus eliminating the possibility that the user will neglect to provide such input, or enter the input incorrectly or incompletely. Or, it may be necessary to make transparent security operations for users to increase the security of these operations, because if such operations are not known, no attempt will be made to compromise the security provided by these operations. If so, the peripheral driver can be implemented such that the peripheral can only operate in security plus target mode (steps 610, 611, 612, 614, 615, 616, and 617 of method 600 cannot be performed), and therefore, it is not indicated (eg, a user interface display view that allows instructions for performing security operations to be entered, as in block 606 of method 600) whether the security functionality of the peripheral is available. Rather, the user will simply be presented with options related to the operation of the target functionality (block 607 of method 600). In such an implementation, the peripheral device driver may be implemented to automatically cause one or more specified security operations to be performed based on user-specified interaction with the target functionality, or the peripheral device may be configured to perform such security operations every time the specified interaction occurs. with targeted functionality.

[0082] A significant advantage of the peripheral device according to the invention is that the peripheral device can be implemented such that any of a variety of types of target functionality can be included as part of the peripheral device. Specifically, as described in more detail below, a peripheral device includes an interface control device that includes and manages communication between and between a host computing device, a cryptographic processing device that is part of the peripheral device, and target functionality that is also part of the peripheral device. devices. The interface manager can be tailored to provide an appropriate interface for each type of target function. Thus, in general, any desired target functionality can be used with a peripheral device according to the invention, provided that the target functionality is implemented to allow communication with an interface of the type shown. Specialists in the field of communication can easily understand how to implement such communication with target functions, given the detailed description below (see Fig. 7, 8A and 8B) of the embodiment of the peripheral device according to the invention, and in particular, the interface control device of such a peripheral device ...

[0083] For example, the target functionality of a peripheral device in accordance with the invention may be implemented as a memory device configured to provide non-volatile data storage. In general, any such storage device can be used to implement such an objective function. More specifically, you can use a solid state disk storage device (eg, a flash memory device). As an example of implementation, a storage device that can be used to implement target functionality in a peripheral device in accordance with the invention can be a compact flash memory device. Other solid state disk storage devices such as SCSI drives, SSDs, and IDE drives can be used, but are not limited to. Those of skill in the art will have a good understanding of the construction and operation of storage devices in general, as well as those defined in particular above, so that together with an understanding of the required communication capabilities between the target functionality and the interface control device, the storage device for use with the invention can be easy to construct and operate. A peripheral device according to the invention, which includes a storage device that embodies the intended functionality, can be used, for example, to securely store data in a manner that allows the user of the data to easily carry the data wherever it goes.

[0084] The target functionality of the peripheral device according to the invention may also be implemented as a communication device configured to provide communication between a host computer and a remote device. In general, any such communication device can be used to implement the targeted functionality. A communications device that can be used to implement target functionality in a peripheral device in accordance with the invention can include, for example, a data modem (such as, for example, a conventional telephone line modem, ISDN modem, cable modem, or wireless modem) or LAN transceiver (wired or wireless and, in the latter case, working, for example, in the infrared or radio frequency spectrum). Those of skill in the art will have a good understanding of the design and operation of communication devices in general, as well as those defined in particular above, so that together with an understanding of the required communication capabilities between the target functionality and the interface control device, the communication device for use with the invention can be easy to construct and operate. A peripheral device according to the invention, which includes a communication device that implements the targeted functionality, may be used, for example, to encrypt email before transmission to a recipient. Or, such a peripheral device can be used, for example, to encrypt data files that a person wishes to securely transfer between a computing device at the person's workplace and a computing device in the person's home. [0085] The target functionality of a peripheral device in accordance with the invention may also be implemented as a biometric device, which is defined herein as any device that is adapted to receive input regarding the physical characteristics of a person based on the person's physical interaction with the device. In general, any such biometric device can be used to implement the target function. Biometric devices that can be used in a peripheral device according to the invention may include, for example, a fingerprint scanner, a retina scanner, or a fingerprint scanner.

[0086] In addition to conventional computing devices for storing and / or manipulating digital data, a biometric device includes a sensor for determining a physical characteristic and an analog-to-digital converter for converting analog data representing the measured characteristic into digital data. For example, a fingerprint scanner includes a sensor that a person can put a finger on, a sensor that recognizes the fingerprint, and then the contents of the detected fingerprint are converted into digital data by the device. Likewise, a retinal scanning device includes a sensor that can be located near the human eye, a sensor that senses eye characteristics such as a blood vessel pattern or iris, a device that converts the content of the detected characteristics into digital data. Those of skill in the art have a good understanding of the construction and operation of biometric devices in general, as well as those defined in particular above, so that together with an understanding of the required communication capability between the target functionality and the interface control device, a biometric device for use with the invention can be easy to construct and operate. Fingerprint scanning devices and retinal scanning devices that can be easily modified for use with the invention, that is, for communication with an interface control device according to the invention, are known to those skilled in the art.

[0087] A peripheral device in accordance with the invention, which includes a biometric device that implements the target functionality, can be used, for example, to allow a user to authenticate to a host computer prior to providing access to specific data stored on the host computing device. Such user authentication can be performed using a biometric device to obtain biometric data from the user and compare the biometric data with an appropriate library of biometric data representing a predetermined group of people (eg, authorized users). The data library can be stored in the storage device of the peripheral device.

[0088] When a peripheral device including a fingerprint scanner is configured as a card adapted to be inserted into a slot in a host computing device (eg, a PCMCIA slot), it may be useful to make the peripheral device relatively long so that part the card on which the sensor is located could exit the slot of the main computing device, allowing fingerprints to be scanned while the peripheral device is inserted into the main computing device.

[0089] The biometric device can be used in various ways with the system according to the invention depending on the capabilities of the biometric device. Using known apparatus and methods, a “smart” biometric device can be implemented with the ability to detect the presence of an input signal for a sensor and, upon such detection, initiate the acquisition of biometric data and characteristics by the peripheral device by corresponding data comparison. Such a biometric device can be used to perform user authentication as in step 604 of method 600 above. Alternatively, the biometric device may require the user to initiate the data collection and authentication process. Such a biometric device can be used to perform user authentication on a peripheral device that allows operation without entering the correct access code, as in steps 614 and 615 of method 600.

[0090] The target functionality of a peripheral device in accordance with the invention can also be implemented as a smart card reader for communicating with a smart card, such as, for example, an ISO 7816 smart card. Such a device can be implemented by adapting a conventional smart card reader, the design and operation of which is well known to those skilled in the art, to provide a communication interface that allows the smart card reader to communicate with an interface control device. A peripheral device in accordance with the invention, which includes a smart card reader, can be used to provide security functions for the smart card reader or to add to existing security functions of the smart card reader.

[0091] It should be understood that the above examples are merely illustrative, and not exhaustive, methods of using the peripheral device according to the invention. There are many other possibilities.

[0092] FIG. 7 shows a block diagram of a peripheral device 700 in accordance with another embodiment of the invention. Peripheral device 700 includes a cryptographic processor 701, an interface control device 702, a first memory device 703, a second memory device 704, a real time clock 705, a host I / O interface 706, and target functionality 707.

[0093] Host I / O interface 706 provides communication between peripheral 700 and host. The electrical and mechanical characteristics of the I / O interface 706, and the protocol used to provide communication over the 706 interface, are set in any way that conforms to the industry standard specifications for this type of interface. For example, a peripheral device according to the invention can be adapted to be inserted into a PCMCIA slot of a host computer. In such a peripheral, the electrical and mechanical characteristics and communication protocol for the host I / O interface 706 are set in accordance with the relevant PCMCIA standards.

[0094] The cryptographic processor 701 may be adapted to perform security operations. Typically, cryptographic processor 701 may be implemented by any processor capable of performing cryptographic operations to be provided by peripheral 700. In one embodiment of peripheral 700, cryptographic processor 701 is an embedded special purpose processor implemented on a single integrated chip, designated MYK -82 (also called Capstone), which includes the ARM6 ™ processor core and several special-purpose cryptographic processing elements. The design and function of the Capstone chip are known to those skilled in the art of cryptographic processing.

[0095] The first memory 703 can be a nonvolatile storage device that can be used to store computer programs and persistent data. The first memory 703 may be implemented by any suitable such device, such as, for example, a conventional flash memory device.

[0096] The second memory 704 may be a volatile storage device, which may also be a readily available storage device in which frequently used data and program instructions may be stored while the peripheral 700 is in operation. The second memory 704 may also be implemented with using any suitable device, such as, for example, a conventional random access memory (RAM) device.

[0097] In the peripheral device 700, the interface control device 702 interacts between the host computing device, the target functionality 707, and the cryptographic processor 701. In one embodiment of peripheral device 700, interface control device 702 is a conventional device, which may be a programmable gate array (FPGA) that is programmed to perform functions. The interface manager 702 under the control of the cryptographic processor 701 may be adapted to allow the peripheral device 700 to receive the identity of the objective function 707, as discussed above. The interface control device 702 also enables embedded cryptography according to the invention, since the interface control device 702 controls the flow of data between the host computer and the target functionality 707.

[0098] FIG. 8A is a block diagram illustrating data flow through the interface control device 702 of FIG. 7. Data transferred from the host is provided to a peripheral device 700 (not shown in FIG. 8A) via the host I / O interface 706. The interface manager 702 submits data to the cryptographic processor interface 708 (not shown in FIG. 7). Depending on the configuration of the interface control device 702, determined by the operation of the peripheral device driver and / or the settings made during the manufacture of the peripheral device 700, the data may or may not be processed by the cryptographic processor 701 (FIG. 7). Typically (or, in some cases, required), as discussed in more detail above, cryptographic processing occurs. The interface manager 702 then causes the transfer of data to the target functionality 707. The data transferred from the target functionality 707 to the host follows a similar path in the opposite direction. When the target functionality 707 is absent or unused, the data transferred from the host, after being presented to the cryptographic processor interface 708 and processed by the cryptographic processor 701, is forced back to the host I / O interface 8 706 (and from there to the host. computing device) via interface control device 702.

[0099] A set of configuration registers is maintained for the host I / O interface, the cryptographic processor interface, and the target functionality interface. In particular, the contents of the host I / O interface configuration registers are such that the host interacts with the peripheral device as if security functionality were not available. The contents of the target functionality interface registers reflect the presence of the security functionality. The cryptographic processor interface registers bridge the gap between the other two sets of registers.

[00100] In general, the security functionality of a peripheral device according to the invention can be configured to perform any cryptographic operation as well as other related mathematical operations. The configuration of the security functionality that enables a particular cryptographic or mathematical operation can be accomplished, for example, using appropriate existing cryptographic software, application-specific hardware, or a combination thereof, as known to those of skill in the art of cryptographic devices. The following is a description of exemplary cryptographic and mathematical operations that may be implemented as part of the security functionality of a peripheral device according to the invention. These cryptographic and mathematical operations are well known and can be easily implemented in the peripheral device according to the invention by a person skilled in the art of cryptography.

[00101] For example, a peripheral device according to the invention may implement one or more cryptographic key exchange operations. Any key exchange operation can be implemented, such as, for example, RSA, Diffie-Hellman and X9.42 key exchange algorithms (ANSI Banking Standard).

[00102] The peripheral device according to the invention may also implement one or more hashing operations. Any hashing operation can be implemented, such as, for example, FIPS 180-1 (SHA-1), Message Digest 2 (RSA) and Message Digest 5 (RSA) algorithms.

[00103] The peripheral device according to the invention may also implement one or more digital signature operations. Any digital signature operation can be implemented, such as, for example, the FIPS 186 (DSA - 512, 1024) and RSA Signature (512, 768, 1024, 2048) algorithms.

[00104] The peripheral device according to the invention may also implement one or more symmetric encryption operations. Any symmetric encryption operation can be implemented, such as, for example, FIPS 185 (implemented entirely in hardware), DES (including 3DES, EDE3, CBC and ECB), RC-2 and RC-4 algorithms.

[00105] Although the present invention has been specifically shown and described with reference to its exemplary embodiments, it should be understood that the invention is not limited to the disclosed exemplary embodiments.

[00106] All components of this technical solution can be connected by a bus. In some examples, the data bus includes one or more data buses. The data bus can be implemented in accordance with the Controller Area Network (CAN) bus protocol, which is defined by the International Organization for Standardization (ISO) 11898-1, the Multimedia Systems Data Bus (MOST) protocol, the flexible CAN data bus (CAN-FD) protocol (ISO 11898-7) and / or K-line bus protocol (ISO 9141 and ISO 14230-1) and / or IEEE 802.3 Ethernet ™ bus protocol (2002 onwards), etc.

[00107] The elements of the proposed technical solution are in a functional relationship, and their joint use leads to the creation of a new and unique technical solution. Thus, all blocks are functionally linked.

[00108] The components of the claimed device may be connected by a system bus, which can be any of several types of bus structure (s), including a memory bus or memory controller, a peripheral bus or external bus and / or local bus, using any of a variety of architectures. buses, including (but not limited to) 11-bit bus, Industrial Standard Architecture (ISA) bus, Micro-Channel Architecture (MCA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), Video Electronics Manufacturers Association (VESA Local Bus (VLB)), Peripheral Component Interconnect (PCI), Universal Serial Bus (USB) ), the Advanced Graphics Port (AGP), the International Association of Personal Computer Memory Card Manufacturers (Personal Co mputer Memory Card International Association (PCMCIA)) and Small Computer Systems Interface (SCSI).

[00109] All blocks used in the system can be implemented with electronic components used to create digital integrated circuits, which is obvious to a person skilled in the art. Not limited to, microcircuits can be used, the logic of which is determined during manufacture, or programmable logic integrated circuits (FPGA), the logic of which is set through programming. For programming, programmers and debugging environments are used that allow you to set the desired structure of a digital device in the form of a circuit diagram or a program in special hardware description languages: Verilog, VHDL, AHDL, etc. An alternative to FPGAs can be programmable logic controllers (PLCs), basic matrix crystals ( BMK) requiring a factory production process for programming; ASICs are specialized custom large integrated circuits (LSIs), which are significantly more expensive for small-scale and single-piece production.

[00110] Typically, the FPGA itself consists of the following components:

• configurable logic blocks that implement the required logic function;

• programmable electronic links between configurable logic blocks;

• programmable input / output blocks providing connection of the external output of the microcircuit with the internal logic.

[00111] Blocks can also be implemented with read-only memory devices.

[00112] Thus, the implementation of all the blocks used is achieved by standard means based on the classical principles of the implementation of the foundations of computing.

[00113] As one skilled in the art will appreciate, aspects of the present technical solution may be embodied as a system, method, or computer program product. Accordingly, various aspects of the present technical solution may be implemented solely as hardware, as software (including application software and so on), or as an embodiment combining software and hardware aspects, which may generally be referred to as a "module" , "System" or "architecture". In addition, aspects of the present technical solution may take the form of a computer program product implemented on one or more computer-readable media having computer-readable program code that is implemented thereon.

[00114] Any combination of one or more computer readable media can also be used. The computer-readable storage medium can be, without limitation, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or any suitable combination thereof. More specifically, examples (non-exhaustive list) of a computer-readable storage medium include: electrical connection using one or more wires, a portable computer diskette; hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), fiber optic connection, compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any combination of the above. As used herein, a computer-readable storage medium can be any flexible storage medium that can contain or store a program for use by the system itself, device, apparatus, or in connection therewith.

[00115] Program code embedded in a computer-readable medium may be transmitted using any medium, including, without limitation, wireless, wired, fiber optic, infrared, and any other suitable network or combination of the above.

[00116] Computer program code for performing operations for the steps of the present technical solution can be written in any programming language or combinations of programming languages, including an object-oriented programming language such as Java, Smalltalk, C ++, and so on, and conventional procedural programming languages. such as the "C" programming language or similar programming languages. The program code can be executed on the user's computer in whole, in part, or as a separate software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer. In the latter case, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN), a wide area network (WAN), or a connection to an external computer (for example, via the Internet using Internet providers).

[00117] Aspects of the present technical solution have been described in detail with reference to block diagrams, schematic diagrams, and / or diagrams of methods, devices (systems), and computer program products in accordance with embodiments of the present technical solution. It will be appreciated that each block from the block diagram and / or diagrams, as well as combinations of blocks from the block diagram and / or diagrams, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other data processing device to create a procedure, such that instructions executed by a computer processor or other programmable data processing device create means to implement the functions / actions specified in block or blocks of flowchart and / or diagram.

[00118] These computer program instructions may also be stored on a computer-readable medium that can control a computer other than a programmable data processing device or other devices that function in a particular way, such that the instructions stored on the computer-readable medium create a device including instructions that perform the functions / actions specified in the block diagram and / or diagram.

[00119] The above description includes examples of one or more aspects. Of course, it is not possible to describe every possible combination of components or methodologies in order to represent the aspects described above, but one skilled in the art will understand that many additional combinations and permutations of various aspects are possible. Accordingly, the described aspects are intended to cover all such changes, modifications and variations that fall within the spirit and scope of the appended claims. In addition, to the extent that the term "includes" is used either in the detailed description of the invention or in the claims, such a term is intended to have an inclusive meaning, similar to the term "comprising" as the term "comprising" is interpreted when used as a transitional word in the claims.

[00120]

Claims (24)

1. Peripheral device with an integrated security system using artificial intelligence, containing a housing in which are located: • at least one driver configured to receive an access code from a user and, based on it, select the following operating modes: a) the mode in which the safety functions are used, or b) the mode in which the safety and objective functions are used, or c) the mode in which the objective functions are used, wherein upon receiving the correct access code from the user, the peripheral driver controls the host to provide a user interface that allows the user to control the peripheral as desired, and in particular to use the peripheral to perform security operations; • at least one means of protection to ensure the ability to perform one or more security operations on data; • at least one means for providing interaction of the peripheral device with the main computing device; • means for operatively connecting the security device to the host in response to an instruction from the host; and • means for transferring data between the main computing device and the peripheral means, so that the transmitted data must first pass through the security means; • an artificial intelligence module capable of changing the privacy level of the user based on recognition of the data loaded on the user's peripheral device, while the user is restricted from accessing the content until the artificial intelligence component changes the privacy level of the user based on his authentication; formation of recommendations for changing the level of user confidentiality. 2. The peripheral device according to claim 1, further comprising means for non-volatile data storage. 3. The peripheral device of claim 1, further comprising means for providing communication between the host and the remote device. 4. The peripheral device of claim 1, further comprising a biometric device. 5. A peripheral device according to claim 1, further comprising means for communicating with a smart card. 6. The peripheral device of claim 2, wherein the nonvolatile data storage means further comprises a solid state disk storage device. 7. The peripheral device of claim 6, wherein the solid state disk storage device comprises an ATA format flash disk. 8. The peripheral device of claim 3, wherein the means for providing communication between the host and the remote device further comprises wireless communication means. 9. The peripheral device of claim 8, wherein the wireless communication means comprises a wireless modem. 10. The peripheral device of claim 8, wherein the wireless communication means comprises a wireless local area network transceiver. 11. The peripheral device of claim 4, wherein the biometric device comprises a fingerprint scanner. 12. The peripheral device of claim 4, wherein the biometric device comprises a retinal scanning device.

Images