WO2011007017A1

WO2011007017A1 - Electronic device for generating a secure environment

Info

Publication number: WO2011007017A1
Application number: PCT/ES2009/000364
Authority: WO
Inventors: Juan Santesmases Blanco; Germán SALVADOR GARCÍA-CANO
Original assignee: Zitralia Seguridad Informática, S.L.
Priority date: 2009-07-13
Filing date: 2009-07-13
Publication date: 2011-01-20
Also published as: WO2011007036A3; WO2011007036A2

Abstract

Electronic device for generating a secure environment for communicating with a host hardware equipment item (1) with storage means (3), processing means (4) and firmware (5). The electronic device (6) comprises: - a load manager (7) that boosts its load in the storage means (3), loads a kernel (8) and a boot file system and passes control of the host equipment item (1) to the boot file system (9), which loads a PBA program for authenticating the user and obtaining an encryption key; decrypts an encrypted operating system (11) and passes control of the host equipment item (1) to the encrypted operating system (11); - the encrypted operating system (11) that decrypts an encrypted working environment (12); loads an encrypted working environment (12) and initializes a communications manager (13) for enabling the communications systems supported by the host hardware equipment item.

Description

Electronic device for generating a secure environment

Field of the invention

The present invention falls within the field of "mass storage devices (such as USB disks, CDs, DVDs, pen drives, SD memory cards, etc.), and more specifically in those devices capable of connecting to any computer. and run an operating system and handle data installed on the device itself safely and regardless of the type of computer and the operating system that has the same installed, that is, devices capable of using only the hardware resources of the computer.

Background of the invention

Currently, there are several threats that computer systems face, both at the corporate level and at the particular level. After viruses, some of the most important threats are illegitimate access to information and theft of it or even the hardware it stores.

PC environments and communications networks, although they usually have multiple security systems at the perimeter level, are exposed to multiple threats due to the continued use of the equipment by users and even to the configuration changes themselves by the users. System administrators

These facts - normal in any environment that evolves over time - can, at some point, leave open doors that are exploited by the multiple existing threats. But in addition, if we refer to the users' particular equipment, which may eventually be used in teleworking environments, these same threats are further aggravated due to weakness or even lack of security and defense measures.

In all these cases, any program that is executed, even if different security features are provided, will do so on a platform that, at that time, can be potentially unstable and insecure. At a minimum, they are platforms that we do not know their degree of strength and security, and that are therefore lacking in confidence.

In this sense, the need arises to achieve a safe work environment that can remain unchanged over time, in addition to being independent of the equipment on which you are working, allowing you to work safely even on those equipment that are exposed in a way continue to All kinds of computer threats.

Today, mobility is necessary for the business of companies, so there is a new type of user that is the mobile user, increasingly common at different corporate levels, with managers and commercials being the most affected.

This mobile user profile suffers from new threats of its role, many of which did not exist in traditional user environments, and the most specific are the loss and / or theft of information on portable computers or the leakage of sensitive information .

Another series of threats are common to both mobile and traditional users. However, solutions that protect static users such as antivirus, firewalls, IDS, IPS, are of no use once the user is outside our network and connects to the Internet even after connecting to our VPN server (Virtual private network, 'Virtual Private Network') and carry a personal firewall because they lose effectiveness once outside the corporate environment.

These risks include: _s

- Information theft: By sending documents "confidential or strategic information of the company by e-mail, copying or burning to CDs, USB sticks ₁ etc.

- Physical theft or loss of portable equipment: with possible loss of sensitive and confidential information.

- Identity Impersonation: by stealing sensitive passwords by phishing or pharming in counterfeit web environments extracted from stolen portable computers.

- Virus and malware: sometimes, with access even through VPN to corporate data.

- Denial of service attacks.

- High risk of exploitation of vulnerabilities and data theft.

- Unauthorized changes of corporate access configurations: The user has a problem and sometimes tends to procure himself a solution that is not always sufficiently valid from a security point of view and that unfortunately can lead to unwanted consequences.

- Installation of unauthorized software in the access points, software that can impact - even if it is not malware - in the system behavior, performance, communication bandwidth occupation, or that can even be malware or spyware that may be subtracting, deleting information or Simply sabotaging our organization.

All these new risks, in turn, bring their own consequences, which make them lose money, productivity and sometimes even brand image and prestige, but above all they highlight the following consequences:

• High number of incidents in the customer service center (CAU), with their corresponding costs.

• Loss of productivity of employees / employees, who end up sometimes using more time to make their tools work, than in their own work.

• Hardly quantifiable losses: sometimes some of these incidents, such as denial of service attacks, phishing or identity theft and theft can cause losses and sometimes irreparable damage.

Therefore the problems to be solved are the following:

Protection against theft and leakage of confidential information, for which logical and physical encryption technologies and restrictions are used in the core of the operating system that prevent most conventional attack techniques.

Protection against viruses, malware and spyware of the workplace, by strengthening the core of the operating system and through Snapshot technology, which recovers a fresh image of the system every time it restarts, losing any action of a possible virus or spyware .

Protection against identity theft, through the use of authentication using tokens, e-DNI, cryptographic cards, fingerprints, etc., and through the mandatory authentication prior to the start-up of the operating system. - Compliance with data protection laws through the use of physical and logical information encryption technologies. Thanks to the encryption technology ₍ information all media content will be encrypted using one or two algorithms (physical, logical, or both) 256 bit strength.

Reduction of user service center incidents (CAU) as an immediate consequence of all the previous security measures adopted. - Rationalization of the use of bandwidth and data transfer in mobile and dedicated lines, by limiting the use of bandwidth of each user at the operating system core level, through the absence of spyware, viruses, etc. The equipment also saves a significant percentage of the bandwidth used by the jobs, through the impossibility of using P2P software (eMule, etc.) by users. Provide devices that are capable of generating a safe and controlled work and connection environment.

The most immediate benefits are basically translated into reduction of maintenance and operation costs, fixed and mobile telecommunications costs, and in sharp increases in the productivity of its employees.

In addition, there are advantages and benefits added, although more difficult to measure, such as that by guaranteeing the privacy of the information, barriers that are really difficult to overcome are created to exercise industrial espionage and information theft.

There are currently solutions in the market that solve some of the above problems. However, existing solutions are very closed in terms of including new applications or carrying out customizations of the user environment, and are oriented to a very horizontal environment, leaving out many of the requirements and needs of corporations. The main difference between market solutions is related to the content of the user's customized package. Some solutions only include one application or two, typically through software that establishes a secure remote access connection

(authentication and encryption of communications) and do not store local data.

Solutions of this type are Sun ^' s SunRay and Microsoft Roaming User profiles (secure access to Intraήets in roaming), Citrix, Microsoft Terminal Server MobiKey and Red Cannon (focusing on secure remote access).

Other solutions package a small environment with a reduced set of applications and local storage capacity. Patent document WO2007 / 036935 from Ceedo Technologies (2005) LTD provides virtualization technology for Windows systems, allowing the customer's work environment to be stored in a portable USB memory device, pocket PCs and mobile devices. But the supported applications require some integration with the tool and therefore there are quite a few limitations regarding their inclusion.

Some manufacturers have integrated a reduced virtualization of Windows to be able to support some Windows applications without requiring a copy of Windows, as is the case of MojoPac (www.mojopac.com), which discloses a tool that provides a virtualization application, which allows Have a work desk on any PC directly plugging in a USB disk.

Some solutions such as Sentillion or Vmware create a complete virtual machine for greater flexibility, but they have the problem of requiring additional Windows licenses, in addition to being quite vulnerable in security issues. Finally, there are some solutions and proof of concept developed that include a CPU and local memory in the solution itself, such as Realm Systems ^' Project BlackDog based on a PowerPC processor.

On the other hand, the Mobiu tool ("www.thekeyrevolution.com") provides a 1 GB USB key of secure flash memory, with backup and remote access functionalities. It includes specific applications to generate a work environment: document management applications, file processing, word processors, Firefox, PDF reader, ZIP software.

Description of the invention

The present invention solves the aforementioned problems, by creating a safe environment. The characteristics of the present invention are the following:

- It is based on a self-contained and self-executing operating system resident in a mass data storage device (such as a CD, DVD, USB hard drive, USB Flash, SD memory cards, mobile phone with memory card support , mobile phone based on Android, PDA, 3G modem with support for memory cards, cryptographic card, etc.), specific for each environment according to the specific needs of each of them and for each organization. Therefore, the devices used are easily portable, facilitating their distribution, and allow their use on any PC or laptop.

- Documents and software stored on the device will always be encrypted, so that prior authentication is necessary to allow access.

- There are several possible operating modes or methods of use, depending on the characteristics of the PC or device where you want to use the system:

• Cold start (autoboot): When a computer is started with the storage device connected, an operating system is read only, minimum, safe and with the necessary software to access the documents already installed and preconfigured, so Do not use any resource from the host PC, except CPU, and do not leave any trace on your memory or hard drive.

• Hot boot (autorun): If the device is connected to a computer with the operating system running, it will also launch automatically, without the need to restart the PC, the same previous operating system is lifted, always being isolated from the operating system of the host PC, but being able to access the same data and applications.

• Online mode: In some cases it may be recommended that the execution of the applications be done remotely, in this way the user peripherals such as the screen, keyboard and mouse are used to access a remote execution environment, which is where The work is really done. This allows the use of the system in a very wide range of platforms, including mobiles.

As a specific case, where the storage and execution device is the same, the following mode can be distinguished:

• Mobile mode: In this mode, by means of a mobile phone execution, the device used to access the data is the same that stores it, a mobile terminal with sufficient capacity to launch the applications natively or as a client of the online mode .

For this, a portable multi-system kernel has been created, customizing and adapting a Linux operating system kernel, with improvements in security aspects, to be used in the case of cold start. The previous kernel has also been adapted to allow its native execution on a Windows host operating system (hot boot), and said kernel has been adapted to a massive virtual execution environment, to meet the specific needs of the online mode of execution . An Android-based operating system kernel has been customized and adapted for use in compatible mobile phones, thus enabling mobile mode operation. Therefore, a multi-system portable Kernel system has been developed that can be run directly, on Windows or from a mobile terminal.

- In any of the operating methods, during the boot the user is asked for a password or other type of authentication, so that without exceeding that step it is not possible to start the system or access the stored data. As alternative methods to the use of ^'passwords are the use of smart cards, ID electrónicQ O biometric devices.

- In all boot modes, the launched operating system is specially modified to make it safe, preventing user access to unauthorized parties, and also preventing any alteration of the system: The user cannot install or remove software, or run any application not initially provided.

- Communications are also a very important part of the system, communications via Ethernet, Wifi, and 3G modems are transparently supported. Customers are also included for the leading manufacturers of VPN solutions, such as Cisco or Juniper.

- The system has a configurable and integrated firewall that prevents any communication with unforeseen systems, so that if the system administrator so wishes, it can allow communications only with its servers, thus preventing the user from coming into contact with sites that host malware, or that may even filter information to third parties.

- The device takes control of the processor and the memory of the equipment on which it is executed and it is not necessary to access the hard disk of the equipment.

- The device provides storage space for data, protecting them, through encryption mechanisms. If it is considered necessary all the work information used will be stored encrypted.

- The system is protected against unauthorized copies.

- Ensures secure access to unique addresses and ports of web applications, client-server environments, Citrix, Terminal Server, VPNs, etc. and all kinds of predefined applications.

- The operating system starts up in RAM memory, inviolable for the threats of these environments, whether Internet / Intranet, viruses, worms, spyware, etc. It is a self-contained system, in which the operating system is started, it has the precise connectivity -and nothing else-, the necessary, minimum and essential applications, under the umbrella of a fortified and custom-made operating system for the concrete solution of the client.

- Provides access from any PC or laptop, turning the hardware into a means of physical access to information (a 'commodity'), so that the user can travel with the USB disk or CD in his pocket and use a laptop or a fixed PC in the destination location, be it a remote delegation, a cyber café or your own home. If a computer breaks down, a different one can be used, now the workstation travels in the user's pocket.

- Guarantees that, even if the user lost the support -CD / DVD or USB disk / flash- with its operating system, applications and even with your confidential information, thanks to physical and logical encryption, information leaks will not occur outside the organization. In fact, accompanying encryption with optional high security configurations such as authentication via e-DNI, cryptographic token or smart-card, they make it even more robust. In this way the physical loss of equipment remains merely that, a loss of a physical good, since the information is safeguarded thanks to the physical and logical encryption of the information.

- Automatic configuration of communications (ports, Internet, etc.) transparently to the user.

As for the deployment of the system, a device generation web console is included, a console in which the system administrator, or even the user himself, if so desired, can define exactly what specific applications and features he wishes to include in his device . This console allows you to configure and define all the characteristics of the system, and leaves as a result a file that can be dumped to the desired physical device, with the help of a suitable tool. This console can operate in auto-provisioning mode, so that the user himself defines, downloads and dumps the image of his system to the physical device. Finally, the system also includes a device management web console that allows you to control and manage all available devices. From here, the system administrator can:

o Install, configure and uninstall applications,

o Manage user certificates, CA or known site,

o Define and enforce the desired security policies,

o Configure the device firewall.

o Remotely control the screen, keyboard and mouse of the device.

o Issue orders of self-destruction or deletion, in case of loss, theft of the device, or removal of a user in the system.

In addition, the system can be integrated with different software or hardware elements:

- Integration with cryptographic SD cards. These are SD cards that integrate a cryptographic chip. Its use guarantees that the encryption keys reside in a safe place, and cannot be extracted from it.

- Cryptographic smart cards: As a method of user authentication and keystore for encryption.

- Electronic ID: As a particularly interesting case of card Smart cryptographic.

- Anti Keyloggers: In the event that the system launches on a host operating system, there is a possibility that it was infected by some kind of keylogger that records the keystrokes, with the consequent security problem in the event that password is used as authentication method. To alleviate this problem, software specifically designed to detect and eliminate keyloggers can be included.

- IBM zTic: The system can be integrated with IBM zTic devices, a USB storage device that simultaneously captures communications with certain websites, such as some banks, and encapsulates them in a secure tunnel, thus avoiding type attacks " man in the middle. "

The electronic device for generating a secure environment object of the present invention is configured to communicate with a host hardware equipment where the secure environment is generated and which includes data storage means, data processing means and a firmware. The electronic device comprises:

- a load manager configured for, once the host hardware device has detected the electronic device:

• force your load on data storage media;

• obtain, once loaded, control of the host hardware equipment;

• load a kemel and boot file system included in the electronic device into the data storage media;

• pass control of the host hardware equipment to the kernel;

- the kernel (8), configured to, after automatic initialization, pass control to the boot file system;

- the boot file system configured to:

• load a PBA program included in the electronic device onto the data storage media, said PBA program being responsible for authenticating the user and obtaining an encryption key;

• decrypt an encrypted operating system included in the electronic device;

• pass control of the host hardware equipment to said encrypted operating system;

- the encrypted operating system configured to:

• decrypt an encrypted work environment; • upload an encrypted work environment on the data storage media containing the user's work environment including access to data and applications previously stored in said encrypted work environment;

• Initialize a communications manager in charge of enabling predefined communications systems that are also supported by the host hardware equipment.

The electronic device is preferably an external storage device, for example a USB disk, a CD, a DVD, a flash drive, an SD memory card, a mobile phone.

The kernel is preferably an adaptation of a Linux-based operating system kernel.

The host hardware equipment can be a host computer.

The load manager is preferably configured to, in case the host computer has an active host operating system, load an anti-keylogger into the data storage media to prevent pre-existing spyware on the host operating system from capturing the keystrokes of the host computer.

The electronic device and the host hardware equipment may be included in the same mobile device. In this case the kernel can be an adaptation of an operating system kernel based on Android.

Once the electronic device has generated the secure environment, the encrypted operating system may be configured to store the user's work data in an encrypted manner in the encrypted work environment.

The kernel can have a configurable firewall responsible for allowing communications from the host hardware equipment only with default servers.

Another aspect of the present invention is a secure environment generation system comprising the electronic device for generating a secure environment and the host hardware equipment where the secure environment is generated.

Also, another aspect of the present invention is a method of generating a secure environment, said secure environment generated by an electronic device on a host hardware equipment with data storage means, data processing means and a firmware. The method comprises:

- detect the electronic device connected to the host hardware equipment; - load a load manager of the electronic device into the data storage media; '

- get the load manager control of the host hardware equipment;

- upload a kernel and boot file system included in the electronic device to the data storage media;

- pass control of the host hardware equipment to the kernel;

- initialize the kernel;

- pass control to the boot file system;

- loading a PBA program included in the electronic device onto the data storage media, said PBA program being responsible for authenticating the user and obtaining an encryption key;

- decrypt an encrypted operating system included in the electronic device;

- pass control of the host hardware equipment to said encrypted operating system;

- decrypt an encrypted work environment;

- loading an encrypted work environment on the data storage media containing the user's work environment including access to data and applications previously stored in said encrypted work environment;

- Initialize a communications manager responsible for enabling predefined communications systems that are also supported by the host hardware equipment.

User authentication by the PBA program can be done in any of the following ways:

- password;

- cryptographic smart card;

- Electronic ID;

- cryptographic token;

- biometric device.

The electronic device connects to the host hardware equipment per port

USB

The method may also include:

- access a generation console installed on a server through a web browser installed on an administrator's computer;

- choose in said generation console the configuration to be installed in the electronic device, said configuration defining the security applications and policies to be included in the electronic device;

- generate a file with the chosen configuration;

- download the file from the administrator's computer using the generation console;

- save said file to the electronic device.

Brief description of the drawings

Next, a series of drawings that help to better understand the invention and that expressly relate to an embodiment of said invention that is presented as a non-limiting example thereof is described very briefly. '

Figure 1 shows a block structure of the elements of the invention.

Figure 2 shows the general scheme of the cold start process with the electronic device of the invention.

Figure 3 shows the hot start process with the electronic device object of the invention.

Figure 4 shows the boot process in a mobile device.

Figure 5 shows the method of generating the electronic devices object of the invention.

Figure 6 shows a management process to control and manage electronic devices.

Figure 7 shows a scenario of use of the present invention, applied to the remote connection for telecommuting users.

Description of a preferred embodiment of the invention

The present invention provides a security operating system (or cold boot or autoboot process), a hot boot solution (autorun), a mobile device boot process, a generation console and a remote management console.

Security operating system

With respect to the security operating system, the present invention allows secure access to internal networks, applications and customer systems, based in the use of a secure operating system that is booted from different types of external devices, without using the hard disk of the PC on which it runs. The solution is based on the Ubuntu distribution of Linux, which supports more than 85% of the hardware that has been released in the last two years. Multiple modifications have been carried out on this distribution aimed at creating an ultra secure environment. Among the improvements included in the distribution are:

• Incorporation of the physical encryption technology and logical encryption of the physical medium that houses the distribution (the CD or DVD, USB Disk, etc.).

• Possibility of pre-boot authentication (PBA, 'Pre-Boot Authentication'), including the incorporation of different robust authentication systems, based on the use of smart cards, certificates, electronic ID, etc.

• Strengthening the Linux kernel -or kernel- against buffer overflows, preventing potential vulnerabilities in any program from being exploited.

• Custom configuration of the Linux firewall -included in the core of the system-, to protect the workstation from unauthorized network traffic.

• Limitation of bandwidth consumed by the user, to ensure, as an option available depending on the user's needs.

Based on this base, called LIME Access, solutions are offered that can be adapted to each user in particular, based on three models of secure environment:

1 Thin Client: The concept is to boot a clean Linux system, exclusively with the necessary software for strictly necessary connectivity. Likewise, it is recommended - it is an option - to deactivate the support for CD / DVD recorders, and hard drives and portable memories via USB / Firewire. As an example, some of the connectivity software that can be included is:

o VPN client (SSL, IPSEC, PPTP, etc.).

o Browser (Firefox / Microsoft Internet Explorer).

o E-Mail Client (Thunderbird / Lotus Notes).

o Voice over IP, VoIP (Skype, SIP client).

o Messenger client.

o Terminal Server Client / Citrix.

2. Secure Virtual Environment: Using LIME Access as the starting and securing base of a virtual operating system - which can be Windows with the necessary applications preinstalled - totally isolated and secured - to the extent required by the user. No connectivity software will be incorporated into the Linux part, but this will be the mere support and security platform of the virtual operating system. The virtual operating system (Windows normally) will enjoy connectivity with the outside, always going through a filter that will limit to what IP's / ports, protocols can be connected.

3. Mixed Secure Virtual Environment (Thin Client + Virtual):

to. Part I: Secure connectivity environment: Internet connectivity is carried out exclusively from the Linux part of the system, with the clients mentioned in the Thin Client type.

b. Part II: Secure virtual operating system: The virtual operating system

(Windows) will be isolated from the Internet, even from the Linux part, to avoid leaks of sensitive information, except in cases considered safe, such as allowing the virtual operating system, to connect only with the IP of the central server of the office, but Not with the Internet.

Therefore, the applications will be those of Linux or those accessible via virtualizer on a secure operating system. Figure 1 shows a block structure of the elements of the invention.

The type of device used as physical media can be, among others, CD, pen drive, USB hard drive, being able to store encrypted data on the last two media. In all cases: access is secure to unique addresses (ports) of Web applications or client / server models; OS boot in RAM is inviolable due to network threats (Internet / external or internal), viruses, worms, Trojans, spyware, etc .; The solution is 100% secure against phishing or pharming attacks by limiting addresses and resolving domain names locally; Access is ubiquitous from any PC or Laptop; does not allow access to the storage system of the workstation or laptop; All data stored on the media is encrypted with pre-boot authentication.

The general scheme of the boot process in autoboot mode (cold start) is shown in Figure 2. The cold start start process is as follows:

- The host computer 1 is connected to the external storage device 6 via the appropriate connection or reading system. Host computer 1 must be turned off at this point.

- The power button of the host computer 1 is pressed. - During the initialization process of the host computer 1, the firmware 5 verifies the existence of some mass storage device connected to the USB 2 ports. In the case shown in Figure 2 it is found with the external storage device 6.

- The firmware 5 reads the load manager 7 from the external storage device 6 and stores it in the memory 3 of the host computer 1, then passing the control to it.

- Load manager 7 loads kernel 8 and boot file system 9 into memory, and passes control to kernel 8.

- Kernel 8, after its automatic initialization, passes control to the boot file system 9.

- The boot file system 9 loads the PBA 10 program (Pre-Boot Authentication, pre-boot authentication), which is responsible for authenticating the user.

- The PBA 10 program authenticates the user asking for a password.

Optionally, you can use a smart card reader 15 in which a smartcard or smart card 16 with electronic user certificates is inserted, in which case what the PBA 10 program will request from the user will be the access PIN to the card 16. In both cases, the PBA program obtains an encryption key.

- With this encryption key, the boot file system 9 decrypts the encrypted operating system 11 and passes control.

- The encrypted operating system 11 loads the encrypted work environment 12, which contains the user's work environment and its data and documents, and initializes the communications manager 13.

Hot start solution

The present invention also provides a remote access solution to applications and systems, developed for the specifications of each user with boot over the Windows operating system of the equipment. It is a self-contained and protected solution that only needs to be launched on a computer already started with

Windows

This solution creates a security bubble within the computer where all the programs that are launched from that environment are executed without mixing with the programs that are launched from the base operating system. Said solution is based on the same protected operating system as the cold start solution, allowing the customized generation of applications and the application of secure access policies to unique addresses (ports) of Web applications or client / server models. It also carries out a secure closure of the environment preventing leaving traces in the equipment of the operations performed.

The boot process, when Lime Access works in hot boot

(autorun), shown in Figure 3, is similar to the previous case of cold start, although some differences are introduced due to the existence of a host operating system 14 (usually Windows, although it could also be Linux or Mac

Os X).

- The host computer 1 is connected to the external storage device 6 via the appropriate connection or reading system. The PC must be turned on at this point, and the host operating system 14 must have booted.

- The host operating system 14 detects the presence of the mass storage device 6, loads the load manager 7 present therein and stores it in the memory 3 of the host computer 1, then passing the control to the load manager.

- Optionally, the load manager 7 loads an anti-keylogger 17, marked in dashed lines, into memory, which will prevent any potential spyware pre-existing in the host operating system 14 from capturing the keystrokes.

- The boot file system 9 loads the PBA 10 program, which is responsible for authenticating the user.

- The PBA 10 program authenticates the user asking for a password. Optionally, you can make use of a smart card reader 15 in which a smart card 16 with electronic user certificates is inserted, in which case the PBA program 10 will request the user to be the card access PIN 16. In both cases , the PBA program obtains an encryption key.

- With this encryption key, the boot file system 9 decrypts the encrypted operating system 11 and passes control. - The encrypted operating system 11 loads the encrypted work environment 12, which contains the user's work environment and its data and documents, and initializes the communications manager 13. The operating system is encrypted, but is also encrypted, separately, the user's work environment, data and documents. All the free space of the device is encrypted, so that any new document stored in it is stored encrypted.

Boot process on mobile device

Figure 4 shows the boot process on a mobile device, for example an Android-based mobile phone, it is very similar to cold start:

- The power button of the mobile phone based on Android 6 is pressed.

- The firmware 5 reads the load manager 7 resident in the mobile phone 6 itself and stores it in the memory 3, then passing the control to it.

- The PBA 10 program authenticates the user asking for a password. The result is that an encryption key is obtained.

Generation console

The present invention also provides a system that has a web console for the generation and layout of the LIME Access system, allowing parameterization of its contents as well as some of its security features.

The generation console allows system administrators, in a simple way, to define different parameters and characteristics that the LIME Access system will have to implement in each device or support: • Graphic creation of the screen or screens to welcome the system, so that the corporate image of each company / user can be included.

• Specification of domains and IP addresses, DNS, URLs to which the connection will be allowed.

• Limitations on navigation.

• Selection of certificates, for the establishment of connections.

• Selection of the components that will be able to be used within the generated safe environment: browser, office applications, etc.

• The method of user authentication to be used by the system will be specified.

• Management of encryption keys, necessary for the personalization of each support.

• Connectivity possibilities will be selected: Ethernet, WiFi, 3G.

• Selection of the virtual machine to load, if necessary.

Likewise, other aspects such as storage possibilities, user privileges, etc. may be configured.

The generation process, shown in Figure 5, is the one that is performed to customize the image of the software that will then be turned over to the mass storage device. The administrator 51 can define all the configuration of that software, as well as the security policies.

The process is as described below:

- The system administrator 51 uses a web browser 53 installed on his own computer, the administrator computer 52, to access 100 to the generation console 57, which is installed on the server 56.

- The administrator 51 uses the generation console 57 to configure and define the security policies that he wishes to be installed in the external storage device 6.

- Generation 57 console passes 101 that information to generation 58 backend.

- The generation 58 backend creates a file containing the software and configuration chosen by the administrator 51, and stores it 102 on the server's hard disk 59.

- The administrator 51 downloads said file using the generation console 57.

- The administrator 51 uses a dump tool 54 to record 106 said file in the external storage device 6. Remote management console

For environments where remote management of all distributed LIME Access systems is required, both on devices running from different computers, and on systems residing on remote computers, a centralized management console is provided where policies are defined, applied and maintained of security to be applied on the different systems, thus minimizing the maintenance and local management needs.

The management console has, among others, the following remote configuration options for LIME Access systems:

- Connectivity options: IP addresses to which connectivity is allowed

r as 'internal zone' (connection to internal servers); IP addresses to which connectivity is allowed as 'external zone' (navigation); TCP ports allowed in 'internal zone'; TCP ports allowed in 'external zone'; UDP ports allowed in 'internal zone'; UDP ports allowed in 'external zone'; list of accessible hosts; IP addresses allowed for name servers; allow or not 3G connections.

- Security options: system boot password; minimum size of the boot password; maximum size of the boot password; allow or not external storage to the support where the system resides.

- Application settings: URL of the homepage of the 'Firefox' browser; links for 'Firefox';

- Remote queries: list of applications.

The management process is shown in Figure 6, comprising the following steps:

- The administrator 51 accesses the management console 63, which is installed on the administration server 62.

- In said console, the administrator 51 can view and modify the security policies and configurations associated with the external storage device 6. The policies are stored in the policy database 64.

- At any time, the external storage device 6 is connected to the policy engine 65, possibly via the Internet 67 and / or a firewall 66. - The external storage device 6 passes to the policy engine 65 its serial number, with which the policy engine 65 obtains the appropriate policy from the policy database 64.

- The policy engine returns to the external storage device 6 a file that contains all the applicable policies that correspond to the device 6.

- The external storage device 6 applies these policies and configurations to itself.

Scenarios

The use scenarios that are intended to secure and provide greater control are the following:

• Scenario 1: Remote access, by internal users of the company. This is the case of users who perform teleworking activities, commercial agents that may require to connect to the internal network from various locations, high positions working interchangeably connected to the internal network or from remote accesses, etc.

• Scenario 2: Access, by companies or users, to perform secure operations through the Internet (electronic transactions with the. Public Administration -like electronic voting-, transactions with banks, etc.).

In these cases it is necessary to provide the user with a work environment equal to what he would have if he were working on a computer in the internal network, with adequate security and control mechanisms. Scenario 1: Remote access for internal users or telecommuting

Users who need to connect remotely (for example, by telecommuting) should be able to work as if they will be on a computer in the internal network.

For this, the alternatives shown in Figure 7 are considered:

0 • Use any host computer 1 (provided by the company, private user or third party) together with an external device 6 (pen-drive or USB disk)

^• that includes the LIME Access object of the invention. From the start ^v external device secure virtual environment (securized operating system) without having to access the hard drive of the computer, using only their memory capacity Y5 process. • Use a secure virtual environment where the work equipment, host computer 1 is provided directly, and the secure virtual environment (LIME Access) is loaded from an SD card, without using any other equipment.

In both cases, user authentication can be carried out directly against corporate or local servers, and different access control mechanisms can be used (username / password, token with certificate, etc.).

Once the system is started, the user can start a Windows virtual machine that will allow him to work directly with the tools he normally uses.

The connection with the internal network 75 of the company to connect with the corporate servers 76 will be carried out through IPSec tunnels or VPNs (depending on the client's requirements). The system must include the necessary connection clients and all the necessary elements to be able to work normally through the internal network.

In the case of not having a connection, the user can work, thanks to the capacity of the local storage system.

Scenario 2: Electronic transactions

Companies or external users that must perform certain electronic procedures (with the administration, banks, etc.). In order for this connection to be made securely, an external storage device 6 is distributed among these companies or users, preferably in a CD or pendrive format, which performs all the necessary processes in a secure manner. There will be a specific authentication for each user, if necessary.

The external storage device 6 includes a browser that allows the user to connect, via the Internet, to carry out the procedures, but which will not allow navigation outside certain addresses. There is a limitation of IPs, ports, addresses, etc. to which you can connect, and the connection method to use: for example, via VPN. The system only allows the user to take the necessary actions to perform the electronic procedure (e.g., e-banking).

Claims

1. Electronic secure environment generation device, configured to communicate with a host hardware equipment where the secure environment is generated and which includes data storage media (3), data processing media (4) and firmware (5) , characterized in that said electronic device (6) comprises:

- a load manager (7) configured for, once the host hardware device has detected the electronic device (6):

• force your load on the data storage media (3);

• obtain, once loaded, control of the host hardware equipment;

• load a kernel (8) and a boot file system included in the electronic device (6) into the data storage media (3); • pass control of the host hardware equipment to the kernel (8);

- the kernel (8), configured to, after automatic initialization, pass control to the boot file system (9);

- the boot file system (9) configured to:

• load a PBA program included in the electronic device (6) onto the data storage media (3), said PBA program being responsible for authenticating the user and obtaining an encryption key;

• decrypt an encrypted operating system (11) included in the electronic device (6);

• pass control of the host hardware equipment to said encrypted operating system (11);

- the encrypted operating system (11) configured to:

• decrypt an encrypted work environment (12);

• loading an encrypted work environment (12) onto the data storage media (3) that contains the user's work environment including access to data and applications previously stored in said encrypted work environment (12);

• Initialize a communications manager (13) responsible for enabling predefined communications systems and which are also supported by the host hardware equipment.

one

2. Electronic device according to claim 1, wherein the electronic device is an external storage device.

3. Electronic device according to claim 2, wherein the external storage device is selected from the following:

- a USB disk;

- a CD;

- a DVD;

- a pendrive;

- an SD memory card;

- a Mobile phone.

4. Electronic device according to claim 2 or 3, wherein the kernel (8) is an adaptation of a Linux-based operating system core.

5. Electronic device according to any of claims 2-4, wherein the host hardware equipment is a host computer (1).

6. Electronic device according to claim 5, wherein the load manager (7) is configured to, in the event that the host computer (1) has an active host operating system (14), load into the storage media of data (3) an anti-keylogger (17) to prevent pre-existing spyware on the host operating system (14) from capturing the keystrokes of the host computer (1).

7. Electronic device according to claim 1, wherein the electronic device (6) and the host hardware equipment are included in the same mobile device.

8. Electronic device according to claim 7, wherein the kernel (8) is an adaptation of an operating system core based on Android.

9. Electronic device according to any of the preceding claims, where once the electronic device (6) has generated the secure environment, the encrypted operating system (11) is configured to store the user's work data in an encrypted manner in the encrypted work environment (12).

10. Electronic device according to any of the preceding claims, wherein the kernel (8) has a configurable firewall responsible for allowing communications of the host hardware equipment only with predetermined servers.

11. A secure environment generation system, comprising an electronic device according to any of claims 1-10 and the host hardware equipment where the secure environment is generated.

12. Safe environment generation method, said secure environment generated by an electronic device (6) on a host hardware equipment with data storage means (3), data processing means (4) and a firmware (5), characterized in that it comprises:

- detect the electronic device (6) connected to the host hardware equipment;

- loading a load manager (7) of the electronic device in the data storage means (3);

- obtain the load manager (7) control of the host hardware equipment;

- load, in the data storage media (3), a kernel (8) and a boot file system (9) included in the electronic device (6);

- pass control of the host hardware equipment to the kernel (8);

- initialize the kernel (8);

- pass control to the boot file system (9);

- loading a PBA program included in the electronic device (6) onto the data storage media (3), said PBA program being responsible for authenticating the user and obtaining an encryption key;

- decrypt an encrypted operating system (11) included in the electronic device (6);

- passing control of the host hardware equipment to said encrypted operating system (11);

- decrypt an encrypted work environment (12);

- loading an encrypted work environment (12) into the data storage media (3) that contains the user's work environment including access to data and applications previously stored in said data environment. encrypted work (12);

- Initialize a communications manager (13) responsible for enabling predefined communications systems and which are also supported by the host hardware equipment.

13. Method of generating a secure environment according to claim 12, wherein the authentication of the user by the PBA program is carried out in any of the following ways:

- password;

- cryptographic smart card (16);

- Electronic ID; '

- cryptographic token;

- biometric device.

14. Method of generating a secure environment according to any of claims 12-13, wherein the electronic device (6) is connected to the host hardware by USB port. <

15. Method of generating electronic devices according to any of claims 1-10, characterized in that it comprises:

- access (100) a generation console (57) installed on a server (56) through a web browser (3) installed on an administrator's computer (52);

- choose in said generation console (57) the configuration to be installed in the device, electronic (6), said configuration defining the applications ^ security policies to be included in the electronic device (6);

- generate a file with the chosen configuration;

- download (104) from the administrator's computer (52) said file using the generation console (57);

- record (106) said file in the electronic device.