CH706159B1 - Portable device to encrypt / decrypt and / or compress / decompress data. - Google Patents

Abstract

The present invention relates to a portable device (100) for encrypting / decrypting and / or compressing / decompressing data comprising: an outer envelope (2); at least one CPU (3); at least one cryptographic authentication support chip (4); at least one first data input / output port (5) adapted to be interfaced with external devices; at least one second data input / output port (6) adapted to be interfaced with external devices.

Description

Description Field of the invention [0001] The present invention concerns the field of data encryption and / or compression and in particular a portable device for encrypting / decrypting and / or compressing / decompressing data.

Prior art [0002] Both software and hardware solutions are available on the market in the field of data encryption.

[0003] Software solutions generally require that the user performs on average at least two distinct operations, if not more, with systems that are different from each other in order to guarantee the safe exchange of information.

[0004] Taking as an example the case in which a user has to send content reserved to third parties known to him and, therefore, intends to encrypt such data and information (case extensible 1: 1 also to compression), the user must, in sequence: - Encrypt the information it intends to send; - Store this encrypted information on your system (computer, PC etc.); - Send them via another system to the recipient (s) (e-mail, web transfer via third party systems, Skype, MSN, peer-to-peer systems, physical shipment of a mass storage device, eg CD Rom , «USB key», USB Hard Disk etc.). - Communicate to the recipient / recipients the encryption key through an alternative channel with respect to that of sending the data (operation in itself insecure).

[0005] At this point whoever receives the encrypted data must do exactly the opposite and the procedure clearly depends on the software system used to encrypt and the method used to send the encrypted information.

[0006] The Applicant has also noticed that the software system suffers from a great limit common to all the systems present on the market: the encryption key with which the information was encrypted, "travels" in whole or in part together with the autographed information themselves.

[0007] Often, among other things, such software solutions are open-source and, therefore, even if the key is "obfuscated" in the file itself using appropriate algorithms, it is quite simple, with a few hours of work, to recover it.

[0008] The Applicant has also observed that even if this cryptographic key does not "travel" together with the encrypted data and information, the software solution is easily exposed to attempts at memory dumping, snooping, spoofing and interception in general of the key itself. This is possible through special programs like Trojans and malware in general, keyloggers, etc. that create a "backdoor" on the user's computer by intercepting both what is typed with the keyboard or with the "click" of the mouse, and even by performing the "memory dumping" technique with the analysis of cryptographic keys and critical information cryptographic algorithms directly in the computer memory, that is directly in the execution space of the software solution itself.

[0009] In view of the above, the Applicant has realized that known software solutions are therefore intrinsically unsafe and also require a certain ability to operate with the computer.

[0010] There are also some hardware solutions on the market.

[0011] Generally these solutions consist, in the vast majority of cases, in USB devices (completely similar to a "USB" key) fitted internally with a local mass memory (as, in fact, the normal USB "keys") of Storage) and only in some cases of cryptographic chips. These solutions essentially allow to insert the device in a computer (exclusively through the USB interface) and to be able to write and read data and files on and from the integrated storage memory in a safe manner: the data is encrypted and decrypted in real time .

[0012] The Applicant has however observed that such devices are not provided with a microprocessor inside them, but at most of a microcontroller they therefore have limited computational capabilities, therefore they cannot update "on board" services over time, such as new algorithms of encryption and / or compression compared to those for which they were designed.

[0013] Furthermore, as for the software solution, in the event that a user has to send content reserved to third parties known to him, he must still send the USB "flash drive" containing the data encrypted by another system proposing the problems set out above.

[0014] The Applicant has therefore found the need to provide a device for encrypting / decrypting and / or compressing / decompressing data that is structurally simple, safe and that allows to solve the problems described above of the known solutions.

Summary of the invention [0015] Therefore, in a first aspect of the invention the invention relates to a portable device for encrypting / decrypting and / or compressing / decompressing data comprising: an external envelope; at least one CPU; at least one cryptographic authentication support chip; at least a first input / output port adapted to be interfaced with external devices; at least one second input / output port adapted to be interfaced with external devices.

In the context of the present invention, the term chip indicates a high integration electronic circuit.

[0016] The present invention, in the aforementioned aspect, can have at least one of the preferred characteristics which are described below.

[0017] Preferably, the CPU comprises: - at least one microprocessor or a microcontroller; and - at least one cryptographic engine.

[0018] In the context of the present invention the term microcontroller means a controller which generally operates at 100/150 MHz, with addressing capability up to 32 bits and which presents a series of peripherals and system elements directly on the chip which the constitutes (in these cases we speak of systems, peripherals on board "on board"). Microcontrollers are also only able to execute native code or programs in the RTOS context.

[0019] In the context of the present invention the term microprocessor means a controller which generally operates at frequencies higher than 150/200 MHz, with addressing capacity greater than 16 bits and which presents a series of peripherals and system elements external to the chip, so not on board. Unlike a microcontroller, a microprocessor is able to run complete Linux horn operating systems, Microsoft Windows Embedded.

[0020] Preferably, the CPU comprises a microprocessor.

[0021] Advantageously, the microprocessor has an addressing capacity greater than 32 bits, preferably greater than 40 bits.

[0022] Advantageously, the first data input / output port and the second data input / output port comprise connection elements adapted to communicate data with external devices according to an international communication standard selected from Ethernet, USB, FireWire, ThunderBolt, Bluetooth, Wi-Fi, UWB, ZigBee, ANT, WirelessHART, SATA, PATA, EIDE, RS232, RS485, CAN, Lin, Profibus or an analog audio connection device (such as headphone and / or microphone connectors).

[0023] Conveniently, the first data input / output port comprises a male connection member able to interface with a female connection member of a first external device.

[0024] In the context of the present invention a connection device is intended as an electromechanical organ capable of allowing the operative association with a further connecting member.

[0025] In the context of the present invention, a male connection device is intended as a connection member designed to at least partially enter a recess which represents a female connection member.

[0026] In the context of the present invention, a female connection is intended as a connection device for at least partially accommodating a male connection member.

[0027] Preferably, the second data input / output port comprises a female connection member able to interface with a male male connection member of a second external device.

[0028] Conveniently, the first data input / output port comprises a male USB connection member.

[0029] Preferably, the second data input / output port comprises a female USB connection member.

[0030] Advantageously, the external devices are chosen among personal computers, notebooks, netbooks, desktops, workstations, servers, handheld and hand-held devices, tablets, smartphones, mobile phones, USB storage devices, keyboard, mouse, digital headphones and analog, Modem, Router, Gateway.

[0031] Preferably, the device comprises at least one RAM memory of the dynamic type.

[0032] Conveniently, the device comprises at least one flash memory.

[0033] Preferably, the device comprises at least one system for giving power to at least the CPU and at least to the second data input / output port.

[0034] The casing advantageously comprises a longitudinal extension L <15 cm.

[0035] Preferably, the device has a weight of between 0.01 kg and 3 kg.

[0036] Conveniently the device comprises a Bluetooth communication module.

[0037] Advantageously, the device according to the present invention comprises a memory expansion module.

[0038] According to another aspect, the present invention relates to a process for securely exchanging data between two external devices interfaced with a portable device as mentioned above. The process comprising the steps of: connecting a female connection member of a data input / output port of a first external device with a male connection member of said first data input / output port of said portable device; connecting a male connection member of a data input / output port of a second external device with a female connection member of said second data input / output port of said portable device; verification of a first identification parameter (VID) of the first external device to determine the device manufacturer; recognition of the type of first external device connected to said device through a second identification parameter (PID).

[0039] Advantageously, the process further comprises the steps of: - mutual authentication between the first external device and the portable device and between the portable device and the second external device, - establishing a secure connection between the first external device and the second device external.

[0040] Alternatively, the process comprises the steps of: - mutual authentication between the first external device and the portable device and between the portable device and the second external device; - mapping of the second external device to the first external device; - encryption / decryption and / or compression / decompression by the CPU encryption engine.

[0041] According to another alternative the process comprises the steps of: - mutual authentication between the first external device and the portable device and between the portable device and the second external device; - acquisition by the portable device of the analog and / or digital audio stream sent by the second external device; - encoding / decoding of said flow by a codec executed by the CPU; - encryption / decryption and / or compression / decompression by the CPU.

Brief description of the drawings [0042] Further features and advantages of the invention will become more apparent from the detailed description of some preferred but not exclusive embodiments of a portable device for encrypting / decrypting and / or compressing / de-compressing data according to the present invention .

[0043] This description will be set forth below with reference to the accompanying drawings, provided for indicative purposes only and, therefore, not limiting, in which: FIG. 1 is a schematic view of a portable device for encrypting / decrypting and / or compressing / decompressing data according to the present invention; fig. 2 is a block diagram of an embodiment of hardware configuration of a portable device for encrypting / decrypting and / or compressing / decompressing data according to the present invention; fig. 3 is a block diagram of a function from the portable device for encrypting / decrypting and / or compressing / decompressing data according to the present invention.

Detailed description of embodiments of the invention [0044] With reference to figs. 1-3, a portable device for encrypting / decrypting and / or compressing / decompressing data according to the present invention, is identified with the reference number 100.

[0045] The device 100, in the embodiment shown in fig. 1, has an outer casing 2, at least one CPU 3, at least one cryptographic authentication support chip 4, at least one first data input / output port 5 adapted to be interfaced with external devices, and at least one second input port 6 / data output suitable for interfacing with external devices.

[0046] The outer casing preferably extends along a main direction so as to identify an extension direction X-X. In the embodiment schematically shown in fig. 1, the first 5 and the second data input / output port 6 are located at the opposite ends of the casing 2 with respect to the extension direction.

[0047] Conveniently, the first data input / output port 5 comprises a USB male connection member.

[0048] Preferably, the second data input / output port 6 comprises a female USB connection member.

[0049] Preferably, to make the device easily portable, the casing 2 has a substantially parallelepiped shape and has a longitudinal extension L with L <15 cm, even more preferably with L <10 cm.

[0050] The casing 2 contains at least the CPU 3 and at least the cryptographic authentication support chip 4, described in greater detail below.

[0051] The CPU 3 comprises at least one microprocessor, at least one cryptographic engine and / or a compression / decompression engine. According to one embodiment, the microprocessor is a CISC / RISC microprocessor with thirty-two bits and has a computing power of up to 720 MHz, the cryptographic engine is a hardware-type cryptographic engine capable of managing RSA and AES algorithms in its variants , 3DES as well as hashing algorithms, such as MD5, SHA-1, SHA-256.

[0052] The CPU 3 is functionally connected to the cryptographic authentication chip 4.

[0053] The cryptographic authentication chip 4 comprises a microcontroller dedicated exclusively to tasks related to data security.

[0054] The cryptographic authentication chip 4 comprises a causal number generator of the type TRNG, at least a cryptographic hashing engine and at least a protected memory comprising circuits suitable for preventing the reading of the data device 100 from the outside to the unauthorized and / or or special metal shields against intrusive analysis and weak currents.

[0055] The cryptographic authentication chip 4, in addition to performing the functions of random number generator and Hash function calculation, is configured to validate the presence of a common data within two devices, for example the device 100 according to the present invention and an external device, without the need to exchange the same data.

[0056] The cryptographic authentication chip is further configured to derive additional keys and / or codes used by the encryption algorithms in the CPU in a unique and secure manner from secret encrypted keys.

[0057] The device 100 also comprises at least one memory 9 of the dynamic Ram type and at least one flash memory 10 at the inside of the casing.

[0058] According to one embodiment the flash memory 10 is a 128 Mbit or higher flash memory, in which resides part of the bootloader, the operating system, the applications and the data.

[0059] According to one embodiment the device 100 can contain a Bluetooth communication module 14. The Bluetooth communication module 14 according to one embodiment comprises a microcontroller inserted in a System On Chip (SoC) dedicated to the management of Bluetooth connections through a radio interface with external devices which include corresponding Bluetooth modules. The radio interface includes at least one antenna 16 receiving / transmitting.

[0060] The device 100 further comprises a module, not shown in the figure, for memory expansion 19. Preferably, a memory expansion module which can be modulated in the storage capacity. For this purpose, the memory expansion module advantageously comprises a Micro SD card reader.

[0061] The device 100 further comprises at least one system 11 for supplying power to at least the CPU 3 and at least to the second data input / output port 8.

[0062] The system for power supply comprises at least one high-integration chip and the related electronic support circuitry and is able to functionally connect to at least one external power supply to the device 100, such as for example a rechargeable battery or a replaceable battery or a condenser or the supply subsystem of the external device itself, provided in one of the external devices connected through the first or second port to the said device 100.

[0063] In some embodiments, the battery or capacitor can be recharged by one of the external devices, in particular by the external device in which the male connector of the device 100 is inserted and connected. In the latter case, an automatic switch may be present to exclude the battery 12.

[0064] Still in order to make the device 100 easily transportable and manageable, the latter has a weight of between 0.01 kg and 3 kg. Preferably between 0.02 and 1 kg.

[0065] The device 100 according to the present invention therefore allows two external devices connected to each other to communicate securely and hardware by means of a physical passage of data within the device itself.

[0066] In the normal operation or at the simple start-up (insertion of the device 100 inside a first external device 17), the CPU 3 of the device 100 constantly verifies the possible insertion in its second data input / output port 6 of a second external device 18.

[0067] In detail, the CPU 3 checks the insertion of a male connection device, such as for example a male USB connection, in the female connection member 8 of its second data input / output port 6.

[0068] Each time the CPU detects the male connection member of a new external device 18 inserted in the female connection member 8 of the second data input / output port 6 of the device 100, the event is managed according to the type of device 18 inserted.

[0069] In fig. 3 shows a flow chart illustrating how the CPU 3 behaves in the event, indicated with the reference number 200, for detecting a second external device 18 which inserts its male connection member in the second input / output port 6 data of the device 100 according to the present invention.

[0070] In 201 the manufacturer of the device 18 is determined, the male connection member of which has been inserted in the female connection member 8 of the second data input / output port 6.

[0071] The device 18 sends to the CPU 3 with the first identification parameter (VID) identifying the manufacturer of the said device 18.

[0072] The CPU also discriminates, between a second external device 18 produced by the same manufacturer of the device 100 according to the present invention, reference 202 and a device of another manufacturer, reference 203. This operation occurs by comparing the first identification parameter ( VID) sent by said second device with a reference one (that of the manufacturer of the device 100) contained in the flash memory.

[0073] In the case in which the first identification parameter (VID) does not correspond to that of the manufacturer of the device 100 according to the present invention, an event indicated with the reference number 203, the CPU 3 is preparing to identify the type of the second device. In 204, for this purpose, if the second external device is not produced by the same manufacturer of the device 100, the CPU discriminates by means of a second identification parameter (PID) the type of second external device 18.

[0074] This operation takes place by comparing the second identification parameter (PID) sent by the said second device 18 with a library of second identification parameters contained in the flash memory.

[0075] If the second device is not a HID or MSC or CDC device, the process ends and the second device is ignored, blocks 205, 206.

[0076] If the second device is a HID or MSC or CDC device, such as a keyboard, a USB headset or a mass storage device, the CPU 3 requests the user who has inserted the second device 18, the insertion of a predetermined alpha numeric user code, ie a «Master Password».

[0077] If the user enters the correct user code, block 207, the process continues and a message is sent to the first device 17 informing him of the presence of the second device 18 and that access has been authorized, the map is then mapped. interface towards the first device 17. In other words, the first device 17 is able to exchange information with the second device 18 as if "virtually" the first and the second device were directly interfaced.

[0078] By exchanging data between the first 17 and the second device 18, these can be at least partly encrypted / decrypted and / or compressed / decompressed by the encryption engine of the CPU 3.

[0079] In 207 if the user does not enter the predetermined identification code or inserts it incorrectly for a certain number of repetitions, the process ends, the second device is ignored and the device 100 will be blocked.

[0080] In 207 if the insertion of a predetermined alpha numeric user code, that is to say the «Master Password» had previously been provided, the process goes directly to the phase in which a message is sent to the first device 17 that the informs of the presence of the second device 18 and that access has been authorized, the interface towards the first device 17 is then mapped.

[0081] In particular, if the second device is a CDC device, such as an analog and / or digital audio headset, the CPU 3 requests the user who has inserted the second device 18 to insert a predetermined user code of numeric alpha tipop, ie a «Master Password».

If the user enters the correct user code, block 207, the process continues and a message is sent to the first device 17 informing him of the presence of the second device 18 and that access has been authorized.

[0082] At this point, the acquisition by the portable device 100 of the analog and / or digital audio stream sent by the second external device 18 takes place.

[0083] The CPU 3 then provides through the execution of a codec to do the encoding and / or decoding of the aforementioned flow.

[0084] Encryption / decryption and / or compression / decompression by the CPU then occurs.

[0085] In the case in which the first identification parameter (VID) corresponds to that of the manufacturer of the device 100 according to the present invention, the CPU is preparing to identify the type of the second device.

[0086] Similarly to what was done for devices not produced by the same manufacturer of the device 100, the CPU 3 discriminates, in 202 by means of a second PID identifying parameter the type of second external device.

[0087] This operation occurs by comparing the second identification parameter (PID) sent by the said second device 18 with a library of second identification parameters contained in the flash memory 10, [0088] At this point, a step of mutual authentication of the device 100 according to the present invention and of the second device 18 at the end of which a secure connection is established between the device 100 according to the present invention and the second device 18.

[0089] The secure connection takes place by means of the cryptographic authentication chip 4 of the device 100 according to the present invention which is configured to derive further keys and / or codes used by the cryptographic algorithms in a unique and secure manner from secret encrypted keys. in the CPU.

[0090] Once the secure connection has been created it is possible to perform the services offered by the second external device 18, such as for example the backup or the remaining of the data contained in the device 100 according to the present invention. The data exchanged between

Claims (15)

the second external device 18 and the portable device 100 according to the present invention are therefore exchanged in an intrinsically safe manner. [0091] The present invention has been described with reference to some embodiments. Various modifications can be made to the embodiments described in detail, while remaining within the scope of protection of the invention, defined by the following claims. claims 1. A portable device (100) for encrypting / decrypting and compressing / decompressing data comprising: an outer envelope (2); at least one CPU (3); at least one cryptographic authentication support chip (4); at least one first data input / output port (5) adapted to be interfaced with external devices; at least one second data input / output port (6) adapted to be interfaced with external devices; wherein said CPU (3) comprises data compression and / or decompression means. 2. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to claim 1, characterized in that said CPU (3) comprises: - at least one microprocessor or a microcontroller; and - at least one cryptographic engine. 3. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to claim 1 or 2, characterized in that said first data input / output port (5) and said second input port (6) data output comprise connection elements adapted to communicate data with external devices according to an international communication standard, and an analog audio connection device, 4. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to claim 1 or 2, characterized in that said first data input / output port (5) comprises a male connection member (7) adapted to interfacing with a female connection member of a first external device. 5. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to claim 1 or 2, characterized in that said second data input / output port (6) comprises a female connection member (8) adapted to interface with a male connection member of a second external device. 6. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to any of the previous claims from 1 to 5, characterized in that the said first data input / output port comprises a male USB connection. 7. A portable device (100) for encrypting / decrypting and compressing / decompressing data according to any one of the preceding claims 1 to 6, characterized in that it comprises at least one RAM memory (9) of the dynamic type. 8. A portable device (100) for encrypting / decrypting and compressing / decompressing data according to any one of the preceding claims 1 to 7, characterized in that it comprises at least one flash memory (10). 9. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to any of the previous claims from 1 to 8, characterized in that it comprises at least one system (11) for giving power to at least said CPU (3) and at least to said second data input / output port (6). 10. A portable device (100) for encrypting / decrypting and compressing / decompressing data according to any one of the preceding claims 1 to 9, characterized in that said envelope (2) comprises a longitudinal extension L <15 cm. 11. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to any of the previous claims from 1 to 10, characterized in that said device has a weight of between 0.01 kg and 3 kg. 12. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to any of the previous claims from 1 to 11, characterized in that it comprises a wireless data communication module (14). 13. Portable device (100) for encrypting / decrypting and compressing / decompressing data according to any of the previous claims from 1 to 12, characterized in that it comprises a memory expansion module (15) (19). 14. Communication process between a first and a second external device (17, 18) and a portable device (100) according to any of the previous claims from 1 to 13: - said first external device (17) comprising at least one connection member female and said second external device (18) comprising at least one male connection member; said process comprising the steps of: connecting the female connection member of a data input / output port of a first external device (17) with a male connection member (7) of said first input / output port (5) data of said portable device (100); connecting a male connection member of a data input / output port of a second external device (18) with a female connection member (8) of said second data input / output port (6) of said portable device (100) ; - verification of a first identification parameter (VID) of the second external device (18) to determine the manufacturer of the device; - recognition of the type of second external device (18) connected to said device (100) through a second identification parameter (PID); - mutual authentication between the first external device (17) and the portable device (100) and between the portable device (100) and the second external device (18); - establishing a secure connection between said portable device (100) and said second external device (18); wherein said process comprises the steps of encryption / decryption and compression / decompression by the CPU encryption engine (3). 15. Process according to claim 14 characterized by comprising the steps of: - mutual authentication between the first external device and the portable device (100) and between the portable device (100) and the second external device; - mapping of the second external device (18) to the first external device (17).