JP2001273059A - Method and data processing system to restrict operation of usb device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a data processing system and a method protecting a USB device to enable the USB device to be available only by a connected computer system. SOLUTION: The USB device is not connected with any computer systems until it is used for the first time. When the USB device is used and connected with a specific computer system for the first time, it is connected with the specific computer system included in the data processing system. The USB device is initially incapacitated and turns to be available by responding only to the connection with the connected computer system. The USB device and the connected computer system are connected by using a pair of the encryption keys. Here the connected computer system memorizes the first key and the USB device memorizes the second key.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates generally to data processing systems, and more particularly, to enabling operation of a USB device only when the USB device is coupled to its associated computer system. The present invention relates to a data processing system and method. More specifically, the present invention relates to US
Enabling operation of the USB device only when the B device is coupled to its associated computer system;
A data processing system and method for determining whether an SB device is coupled to its associated computer system using an encryption key.

[0002]

BACKGROUND OF THE INVENTION Personal computer systems are well known in the art. Personal computer systems have become widely used to provide computer power to many areas of modern society today. Personal computers (PCs)
Central processing unit (CPU) and associated volatile and non-volatile memory (random access memory (RAM) and basic input / output system read only storage (BIOS R)
OM), a system monitor, a keyboard, one or more flexible diskette drives, a CD-ROM drive, a fixed disk storage drive (also known as a "hard drive"). Desktop, floor standing, including pointing devices such as a mouse, and optional network interface adapter.
r standing), or as a portable microcomputer. One of the salient features of these systems is the motherboard or system planar (system p) that electrically connects these components to each other.
lanar). An example of such a personal computer system is the IBM PC 30
0 series, Optiva series and Intell
It is an installation series.

A universal serial bus (universa)
l serial bus (i.e., USB) devices connect to a personal computer via an enterprise standard interface that allows connection to a personal computer system without having to power off or power on the personal computer. A peripheral connected to a computer system. USB devices can self-initialize when connected to a computer. USB devices are intended to be easily coupled / decoupled to computer systems. Furthermore, U
SB devices may be attached / removed to the computer system multiple times during the day.

[0004] There is a need to protect USB devices by, for example, discouraging theft of USB devices. Universal serial buses are becoming a more common means of attaching external devices to computers. These devices are typically cameras, printers,
Includes telephones and many other types of expensive equipment. Because these devices are easy to install, they are likely to be targets for theft.

One way to prohibit unauthorized use of USB devices is to provide a physical lock that secures the device to a computer system. However, this negates the purpose of the universal serial bus. Attachment and removal of devices that must use a physical lock to a computer system is not easy.

[0006] Thus, a USB device is only enabled when coupled to its associated computer system, and the data processing that protects the USB device so that it does not include any physical locking mechanism. There is a need for systems and methods.

[0007]

SUMMARY OF THE INVENTION A data processing system and method for protecting a USB device so that the USB device can only be used on its associated computer system is disclosed.

[0008]

Until the USB device is used for the first time, the USB device is connected to any computer or computer.
Not associated with a system. When a USB device is used for the first time, it will first be
When coupled to the system, the USB device is associated with a particular computer system included in the data processing system. USB devices are initially disabled. The USB device is enabled only in response to being coupled to its associated computer system. The USB device and its associated computer system are associated using a pair of encryption keys. Here, the associated computer system stores the first key of the pair, and the USB device stores the second key of the pair.

[0009] The foregoing and additional objects, features, and advantages of the present invention will become apparent from the following detailed written description.

[0010]

BRIEF DESCRIPTION OF THE DRAWINGS The preferred embodiments of the present invention and its advantages are better understood with reference to FIGS. Like numbers are used for like and corresponding parts of the accompanying drawings.

The present invention is a method and system for limiting the operation of a USB device such that the USB device is enabled only when coupled to its associated computer system. When a USB device is coupled to a computer system other than its associated computer system, the USB device is left disabled. USB devices do not include a physical locking mechanism.

A USB device is shipped from its manufacturer without any encryption keys stored and is not initially associated with any computer system. When the USB device is coupled to the computer system for its first use after being received from the manufacturer, the public key of the computer system to which the USB device was originally coupled is downloaded and stored on the USB device. Is done. Prior to the first use of the USB device, the device is coupled to a computer system that will be its associated computer system. Computer·
The system includes an encryption key pair, for example, an RSA public / private key pair that includes first and second encryption keys. USB
When the device is first coupled to the computer system prior to the first operation, a second encryption key is stored on the USB device. In this way, the computer system is associated with a USB device.

[0013] For subsequent operations, the USB device is initially disabled. When a USB device is subsequently coupled to a computer system after its first use,
The USB device determines whether this new computer system to which the USB device is currently connected is its associated computer system. If the USB device is currently connected to a new computer
Once the USB device determines that the system is its associated computer system, the USB device is enabled. If the USB device determines that the new computer system to which the USB device is currently coupled is not its associated computer system, the USB device is left disabled.

When the USB device is subsequently coupled to the computer system, the USB device first transmits a random number to the new computer system, thereby causing the new computer system to which it is currently coupled to to communicate with the new computer system. Determine if it is an associated computer system. In that case, the new computer system encrypts the random number using the encryption key stored on the new computer system. Next, the new computer system returns this encrypted number to the USB device. Next, the USB device uses the second encryption key stored therein to decrypt the received encrypted number. If the decrypted number is the same as the originally transmitted random number, the USB device determines that it is coupled to its associated computer system and makes itself available. If the decrypted number is different from the originally transmitted random number, US
The B-device is connected to its associated computer
Determined to be coupled to a computer system other than the system and left incapable.

The owner of the USB device states that the USB device uses an encryption key to associate the computer with its associated computer.
This protection can be disabled when coupled to the system.

FIG. 1 is a pictorial diagram of a network including a plurality of client computer systems 104 coupled to a server computer system 100 using a hub 102 in accordance with the methods and systems of the present invention. The server computer system 100 includes a local area network (LAN) connector bus 1
06 is used to connect to the hub 102. Further, each client computer system 104
Are connected to the hub 102 via the respective LAN buses 106. The preferred type of network conforms to the Ethernet specification and uses such hubs and buses. However, it will be appreciated that other types of networks may be used to practice the invention.

"Network" can be any type of data communication channel, such as an Ethernet network,
Token ring, or X. 10 or X. 25 may be included. One skilled in the art will appreciate that the invention described herein may be implemented using any type of data communication channel. However, the preferred embodiment is implemented using an Ethernet network.

FIG. 2 shows a more detailed pictorial diagram of a client computer system according to the method and system of the present invention. Client computer system 104 includes a planar (also commonly referred to as a motherboard or system board). This planar is mounted in the client 104 and has a central processing unit (C
PU) 200, system memory 206, and a means for attaching and electrically interconnecting various components of client 104, including accessory cards or boards as is known in the art.

The CPU 200 is connected to a memory controller PCI by an address / control / data bus 202.
(Peripheral component interconnect) Connected to the bus bridge 204. Bridge 204 is coupled to system memory 206. IDE (integrated drive e
The electronics device controller 220 and the PCI bus-Industry Standard Architecture (ISA) bus bridge 212 are connected to the PCI bus bridge 204 using a PCI bus 208. The IDE controller 220 is a removable hard disk drive 2
An IDE compatible storage device such as 22 is provided. PCI / ISA bridge 212 provides an interface between PCI bus 208 and an optional feature or expansion bus, such as ISA bus 214. PC
I / ISA bridge 212 includes power management logic. The PCI / ISA bridge 212 is a CMOS 213
Is powered by a battery 244 to prevent loss of configuration data stored in the

USB port 272 is coupled to PCI / ISA bridge 212. The USB port 272 supports a USB device 274 such as a camera or a printer.

PCI with connector slot 210
A standard expansion bus is coupled to PCI bridge 204.
PCI connector slot 210 may receive a PCI bus compatible peripheral card. Connector slot 216
Is connected to the PCI / ISA bridge 212. ISA connector slot 21
6 may receive an ISA compatible adapter card (not shown). It will be appreciated that other expansion bus types may be used so that the system can be expanded with additional equipment. Further, it should be understood that two expansion buses are not required to practice the present invention.

The I / O controller 218 is a PCI-I
Coupled to the SA bridge controller 212. I /
O-controller 218 controls communication between PCI-ISA bridge controller 212 and devices and peripherals such as floppy drive 224, keyboard 226, and mouse 228, and these devices communicate with CPU 200. Make communication possible.

PCI-ISA bridge controller 2
12 includes an interface for flash memory 242. The flash memory 242 has addresses,
Includes interfaces for data, flash chip selection, and read / write. Flash memory 242 is an electrically erasable, programmable, read-only memory (EEPROM) module,
Contains the BIOS used to interface between the I / O devices and the operating system.

Client computer system 1
04 includes a video controller 246. video·
The controller 246 includes, for example, the PCI expansion slot 21.
0 may be plugged in. Video controller 246 is connected to video memory 248. The images in video memory 248 are read by controller 246 and displayed on a monitor (not shown) connected to computer system 104 via connector 250.

Computer system 104 has a full
Includes a power supply 240 that provides normal system power 243 and provides full-time power to power management logic 212
And an auxiliary power main AUX5 241 to be supplied to the power supply.

According to the present invention, the planar is
61 and protected storage 262. The encryption device 261 includes an encryption / decryption engine 260, and the encryption / decryption engine 260 includes an encryption / decryption algorithm. Encryption / decryption algorithms are used to encode and decode messages sent and received by the planar. Engine 260 is preferably capable of performing public / private key encryption. Engine 260 may access protected storage device 262. The protected storage device 262 is accessible only via the engine 260 and is a temporary writable device. Storage device 262 cannot be read or written by planar, device 222, or other devices. The client's unique identifier and its encryption key pair are stored in storage 26
2 is stored. Everything stored in the storage 262 is protected by the engine 260 and cannot be accessed from the planar or its components. Device 262 may be implemented using an electronically erasable storage device such as an EEPROM. Access to the non-readable storage device 262 may be obtained to initially store the client's private key. However, once the client's private key is stored, it cannot be read. EEPROM
The key stored at 262 must not be read by planar components other than engine 260.

[0027] Encryption algorithms are known to ensure that only the intended recipient of the message can read and access the message. One known encryption algorithm is an asymmetric, or public key, algorithm. A public key algorithm is a method of encrypting a message sent from a first computer system to a second computer system. This algorithm provides each party in the secure communication with a key pair including a public key and a private key. This key pair is
Unique to each party. Examples of such encryption schemes are the RSA key pair system and the Secure Sockets Layer (SSL) system.

According to the present invention, the engine 260 and the EE
An encryption device 261 including a PROM 262 is coupled to a PCI-ISA bridge 212 using a system management (SM) bus 238. System management bus 238 is a two-wire, low speed, serial bus used to interconnect management and monitoring devices. Those skilled in the art will appreciate that the encryption device 261 may be coupled to other buses within the planar.

Further, client 104 includes a network adapter 230. Network adapter 23
0 is Media Independen interface
t Interface (MII) bus 252 and the physical layer 234 and the media access
Controller (media access controller (MAC))
232. MII bus 252 is 10 / 100Mb
A specification of signals and protocols that define the interface between the ps Ethernet Media Access Controller (MAC) 232 and the underlying physical layer 234. Network adapter 230 is connected to client 1
04 may be plugged into one of the PCI connector slots 210 (as shown) or one of the ISA connector slots 216 so that it can communicate with the server 100 using the communication link 106.

The MAC 232 processes digital network signals and provides a shared data path, the MII bus 25.
2 and the PCI bus 208. The MAC 232 performs many functions in transmitting and receiving data packets. For example, during transmission of data, the MAC 232 assembles the data to be transmitted into a packet having an address and an error detection field. Conversely, while receiving a packet, MAC 232 disassembles the packet and performs address checking and error detection. In addition, the MAC 232 typically performs encoding / decoding of digital signals transmitted via the shared path, performs generation / removal of preambles, and performs transmission / reception of bits. In a preferred embodiment, the MAC 232 is an Intel 82557 chip. However, those skilled in the art will appreciate that the functional blocks shown in network adapter 230 may be manufactured using a single piece of silicon.

The physical layer 234 has an analog signal R4
5 Condition to exit to the network via connector 236. Physical layer 234 has 10 and 100 Mbp
It may be a fully integrated device supporting sCSMA / CD Ethernet applications. Physical layer 23
4 receives parallel data from the MII local bus 252 and converts it to serial data for transmission via connector 236. Further, the physical layer 234 is responsible for shaping the waveform and providing the analog voltage. In a preferred embodiment, the physical layer 234 is implemented using an integrated services chip ICS-1890.

Physical layer 234 includes auto-negotiation logic that serves three primary purposes. First, it determines the capabilities of the client 104. Second, it advertises its own capabilities to server 100. And third,
It uses the highest performance connection technology,
The connection with the server 100 is established.

FIG. 3 is a high-level flowchart illustrating establishing and storing an encryption key pair in a computer system in accordance with the method and system of the present invention. The process begins at block 300 and thereafter proceeds to block 302. Block 302 illustrates establishing an encryption key pair for a particular computer system. Thereafter, block 304 illustrates storing the encryption key on the encryption device 261 in the computer system. Next, the process ends at block 306.

FIG. 4 is a high-level flowchart showing that peripheral devices are associated with a particular computer system in accordance with the method and system of the present invention.
The process begins at block 400 and thereafter proceeds to block 402. Block 402 indicates that a peripheral device, such as a USB device, is first coupled to the computer system. This is the first use of a USB device. Next, block 404 indicates that the public key of the computer system is downloaded to the USB device. The USB device is shipped from its manufacturer without storing any encryption keys. When the USB device is received from the manufacturer and is coupled to the computer system for first use, the public key of the computer system to which the USB device is coupled is downloaded and stored on the USB device. . Then, block 40
6 indicates that the public key of the computer system is stored in the memory in the USB device. By storing the computer system key on a USB device,
Device B is associated with that particular computer system. Next, the process ends at block 408.

FIG. 5 is a high-level flowchart showing that the peripheral device determines whether the peripheral device is currently coupled to its associated computer system in accordance with the method and system of the present invention. The process begins at block 500, after which block 5
Go to 02. Block 502 is a disabled USB
Indicates that the device is coupled to a computer system. Thereafter, block 504 indicates that the USB device generates a random number. Next, block 506 describes the USB
Indicates that the device sends a random number to the computer system to which it is currently coupled. Next, the process proceeds to block 508. Block 508 is for the USB device to:
Indicates that it receives an encrypted number from the currently coupled computer system. Next, block 510 illustrates that the USB device uses a key stored in the memory of the USB device in an attempt to decrypt the number received from the computer system.

Thereafter, block 512 illustrates determining whether the number encrypted and received from the USB device is the random number originally transmitted by the USB device. If it is determined that the number received encrypted is a random number, the process proceeds to block 514.
Only when a USB device is coupled to its associated computer system will the USB device be able to correctly decode transmissions from the computer system to which it is currently coupled. Only when a USB device is coupled to its associated computer system, the number received encrypted will be the originally transmitted random number. If the device is coupled to a computer system other than its associated computer system, the number received encrypted will not be the originally transmitted random number.
Block 514 indicates that the USB device makes itself available. Next, the process ends at block 516.

Referring back to block 512, if a determination is made that the number received encrypted was not a random number, the process proceeds to block 518. Block 518 indicates that the USB device is left incapable. Next, the process ends at block 516.

FIG. 6 is a high level flowchart showing that a computer system sends its identifier to a peripheral device in accordance with the method and system of the present invention.
The process begins at block 600 and thereafter proceeds to block 602. Block 602 indicates that the computer system receives a random number from a USB device coupled thereto. Thereafter, block 604 indicates that the computer system encrypts the random number using the secret key. Next, block 606 indicates that the computer system returns the encrypted random number to the USB device. Next, the process ends at block 608.

While the preferred embodiment has been shown and described in detail, those skilled in the art will recognize that various changes may be made in form and detail without departing from the spirit and scope of the invention. Would.

In summary, the following is disclosed regarding the configuration of the present invention. (1) A method of a data processing system for restricting an operation of a USB device, wherein the USB device is associated with a computer system included in the data processing system,
The USB device is initially disabled and the USB device is disabled.
Enabling the USB device only in response to a device being coupled to the computer system associated therewith. (2) further establishing an asymmetric encryption key pair for the computer system, wherein the encryption key pair is a first key pair;
And a second key, wherein the computer system encrypts the transmission with the first key, and the second key is used to enable a recipient of the transmission to correctly decrypt the transmission. Required and the first key is
Storing the second key on the USB device in response to the USB device being coupled to the computer system during its first operation. ). (3) Further, each time the USB device is subsequently coupled to the computer system, the USB device is usable until the USB device confirms that the USB device has been coupled to the computer system. Wherein the USB device is left incapable until it is coupled to the computer system. (4) in response to the USB device being subsequently coupled to a new computer system, determining whether the new computer system is the associated computer system using the USB device. Responsive to the determination that the new computer system is the associated computer system, enabling the USB device and determining that the new computer system is not the associated computer system In response to the USB
Prohibit the device from being usable, and here the USB
The method of claim 2 including the step of leaving the device incapable. (5) Further, the step of determining whether the new computer system is the associated computer system using the USB device includes the step of determining whether the new key is stored in the USB device and the new key. The method of claim 4 including determining whether keys stored in a computer system together form the encryption key pair. (6) generating a random number using the USB device, transmitting the random number to the new computer system, encrypting the random number using the key stored in the new computer system, Transmitting an encrypted random number to the USB device and decrypting the encrypted received random number using the second key stored in the USB device, wherein the decrypted random number is The method according to (5), further comprising the step of determining whether the number is a random number. (7) A data processing system for restricting the operation of a USB device, comprising: means for associating the USB device with a computer system included in the data processing system; and wherein the USB device is initially disabled. U
The SB device is associated with the computer
Said USB only in response to being coupled to the system
Means for enabling the device. (8) means for establishing an encryption key pair for the computer system, wherein the encryption key pair includes a first key and a second key, wherein the computer key
The system encrypts a transmission with the first key, and encrypts the transmission with the second key.
Key is required for the recipient of the transmission to be able to correctly decrypt the transmission, the means for storing the first key in the computer system and the USB device during its first operation. Means for storing said second key on said USB device in response to being coupled to said computer system. (9) Further, each time the USB device is subsequently connected to the computer system, the USB device is usable until the USB device confirms that the USB device is connected to the computer system. The system of claim 8, further comprising means for preventing the USB device from becoming unusable, wherein the USB device remains incapable of being coupled to the computer system. (10) In response to a USB device being subsequently coupled to a new computer system, means for determining whether the new computer system is the associated computer system using the USB device. Means for enabling the USB device in response to a determination that the new computer system is the associated computer system; and wherein the new computer system is not the associated computer system. Means for banning the USB device from being enabled in response to the determination that the USB device remains incapable. . (11) Further, the new computer system comprises:
Said means for determining whether said associated computer system using said USB device is:
The apparatus of claim 10, further comprising means for determining whether the second key stored on the USB device and the key stored on the new computer system form the encryption key pair together. System. (12) Further, means for generating a random number using the USB device, means for transmitting the random number to the new computer system, and using the key stored in the new computer system, Means for encrypting a random number, means for transmitting the encrypted random number to the USB device, and the encrypted random number received using the second key stored in the USB device. And a means for determining whether or not the decrypted random number is the random number. (13) A data processing system for restricting operation of a USB device, comprising: means for establishing an encryption key pair for the computer system, wherein the encryption key pair comprises a first key and a second key. Key, where the computer
The system encrypts the transmission with the first key, the second key is required for the recipient of the transmission to be able to correctly decrypt the transmission, and encrypts the first key with the computer.
Means for storing the second key on the USB device in response to the USB device being coupled to the computer system during its first operation; Means for determining if the new computer system combined with is the associated computer system using the USB device, and the new computer system is the associated computer system. Means for enabling the USB device only in response to the determination of: and the USB device being enabled in response to a determination that the new computer system is not the associated computer system. Means to prevent said USB device from remaining incapable And means for generating a random number using said USB device, the random number the new computer
Means for transmitting to the system;
Means for encrypting the random number using the key stored in the system, means for transmitting the encrypted random number to the USB device, and use of the second key stored in the USB device And a means for decrypting the encrypted received random number, and a means for determining whether the decrypted random number is the random number.

[Brief description of the drawings]

FIG. 1 is a pictorial diagram illustrating a data processing system including a plurality of client computer systems coupled to a server computer system using a network and a hub in accordance with the methods and systems of the present invention.

FIG. 2 is a pictorial diagram illustrating in more detail a client computer system in accordance with the method and system of the present invention.

FIG. 3 is a high level flowchart illustrating establishing and storing an encryption key pair in a computer system in accordance with the methods and systems of the present invention.

FIG. 4 is a high-level flowchart showing that peripheral devices are associated with a particular computer system in accordance with the methods and systems of the present invention.

FIG. 5 is a high-level flowchart illustrating determining whether a peripheral device is currently coupled to its associated computer system in accordance with the methods and systems of the present invention.

FIG. 6 is a high-level flowchart showing that a computer system sends its identifier to a peripheral device in accordance with the methods and systems of the present invention.

[Explanation of symbols]

Reference Signs List 100 server computer system 102 hub 104 client computer system 200 central processing unit (CPU) 204 PCI bus bridge 206 system memory 210 PCI connector slot 212 PCI / ISA bridge 216 ISA connector slot 218 I / O controller 220 IDE Device Controller 222 Removable Hard Disk Drive 224 Floppy Drive 226 Keyboard 228 Mouse 230 Network Adapter 232 Media Access Controller (MAC) 234 Physical Layer 236 R45 Connector 238 System Management (SM) Bus 240 Power 242 Flash・ Memory 243 Full normal system power 244 Battery 246 Video Controller 248 Video Memory 250 Connector 252 Media Independent Interface (MII) Local Bus 260 Engine 261 Encryption Device 262 EEPROM 272 USB Port 274 USB Device

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor David Carroll Chalner United States 27615 Hunting Ridge Road, Raleigh, North Carolina 713 (72) Inventor Durbu Mamohandas Desai United States 27513 North Carolina, Cary, Maidenhall Way 417 (72) Inventor Norman A. Dion Second United States 27511 North Carolina, Cary, West Guerrell Court 113 (72) Inventor Vivienne M. Klein United States 27516 North Carolina, Chapel Hill, Parkside Circle 111 (72) Inventor Howard Jeffrey Locker United States 27513 North 404 (72) Inventor Hernando Ovis United States 27513 North Carolina, Cali, Bel Vista Drive 104 (72) Inventor Andy Lloyd Trotter United States 27613 North Carolina, Raleigh, Green Lantern Street 8203-107 (72) Inventor Gems-Peter Woard Hemingway Forest Place 107, Raleigh, NC 27607 USA

Claims (13)

[Claims] 1. A method of a data processing system for limiting operation of a USB device, the method including associating the USB device with a computer system included in the data processing system, wherein the USB device is initially disabled. Enabling the USB device only in response to the USB device being coupled to the computer system associated therewith. 2. The method of claim 1, further comprising establishing an asymmetric encryption key pair for the computer system, wherein the encryption key pair includes a first key and a second key, wherein the computer system includes a first key and a second key. Encrypting the transmission with the first key, the second key being necessary for the recipient of the transmission to correctly decrypt the transmission, storing the first key in the computer system. 2. The method of claim 1, further comprising the step of storing the second key on the USB device in response to the USB device being coupled to the computer system during its first operation. . 3. Each time the USB device is subsequently coupled to the computer system, the U.S.A. indicates that the USB device has been coupled to the computer system.
Prohibiting the USB device from being enabled until the SB device confirms, wherein the USB device is left incapable until it is coupled to the computer system. Item 3. The method according to Item 2. 4. In response to the USB device being subsequently coupled to a new computer system, determining whether the new computer system is the associated computer system using the USB device. In response to determining that the new computer system is the associated computer system,
Enabling the USB device; inhibiting the USB device from being enabled in response to a determination that the new computer system is not the associated computer system, wherein the USB device is 3. The method of claim 2, comprising the step of being left incapable. 5. The method of claim 1, wherein determining whether the new computer system is the associated computer system using the USB device further comprises: determining whether the new computer system is the associated computer system using the USB device. The method of claim 4, comprising determining whether keys stored on the new computer system form the encryption key pair together. 6. Generating a random number using the USB device, transmitting the random number to the new computer system, encrypting the random number using the key stored in the new computer system. Transmitting the encrypted random number to the USB device, using the second key stored in the USB device,
6. The method of claim 5, comprising decrypting the encrypted received random number and determining whether the decrypted random number is the random number. 7. A data processing system for restricting operation of a USB device, comprising: means for associating the USB device with a computer system included in the data processing system;
B means being initially disabled, and means for enabling said USB device only in response to said USB device being coupled to said computer system associated therewith. . 8. The means for establishing an encryption key pair for the computer system, wherein the encryption key pair includes a first key and a second key, wherein the computer system includes a first key and a second key. Encrypts the transmission with the first key, the second key is required for the recipient of the transmission to correctly decrypt the transmission, and stores the first key in the computer system Responsive to the USB device being coupled to the computer system during its first operation.
Means for storing said key on said USB device. 9. Further, each time the USB device is subsequently coupled to the computer system, the U.S.A. determines that the USB device is coupled to the computer system.
Prohibiting the USB device from being enabled until the SB device acknowledges, wherein the USB device has a means for allowing it to remain disabled until coupled to the computer system. The system of claim 8, comprising: 10. In response to a USB device being subsequently coupled to a new computer system, determining whether the new computer system is the associated computer system using the USB device. Responsive to the determination that the new computer system is the associated computer system,
Means for enabling the USB device; and responsive to determining that the new computer system is not the associated computer system,
Means for inhibiting the USB device from being enabled, wherein the USB device is left disabled. 11. The second key stored in the USB device, the means for determining whether the new computer system is the associated computer system using the USB device. The system of claim 10, further comprising: means for determining whether keys stored on the new computer system together form the encryption key pair. 12. A means for generating a random number using the USB device, means for transmitting the random number to the new computer system, and using the key stored in the new computer system. Means for encrypting the random number; means for transmitting the encrypted random number to the USB device; and using the second key stored in the USB device.
The system of claim 11, comprising: means for decrypting the encrypted received random number; and means for determining whether the decrypted random number is the random number. 13. A data processing system for limiting operation of a USB device, comprising: means for establishing a pair of encryption keys for the computer system, wherein the pair of encryption keys comprises a first key and a second key. Wherein the computer system encrypts the transmission with the first key, wherein the second key is required for a recipient of the transmission to correctly decrypt the transmission; Means for storing a first key in the computer system; and in response to the USB device being coupled to the computer system during its first operation, the second device
Means for storing the key of the USB device on the USB device; means for determining whether the new computer system to which the USB is subsequently coupled is the associated computer system using the USB device; Means for enabling the USB device only in response to determining that the new computer system is the associated computer system; and that the new computer system is not the associated computer system. Means for inhibiting the USB device from being enabled, wherein the USB device is left incapable, and generating a random number using the USB device. Means for transmitting the random number to the new computer system; Means for encrypting the random number using the key stored in a computer system; means for transmitting the encrypted random number to the USB device; and the second key stored in the USB device. using,
A data processing system comprising: means for decrypting the encrypted received random number; and means for determining whether the decrypted random number is the random number.