(12) Patent Application Publication (10) Pub. No.: US 2007/0208949 A1 Lu Et Al
Total Page:16
File Type:pdf, Size:1020Kb
US 20070208949A1 (19) United States (12) Patent Application Publication (10) Pub. No.: US 2007/0208949 A1 Lu et al. (43) Pub. Date: Sep. 6, 2007 (54) INFORMATION SECURITY DEVICE OF Publication Classification UNIVERSAL SERAL BUS HUMAN (51) Int. Cl. INTERFACE DEVICE CLASS AND DATA H04LK LM00 (2006.01) TRANSMISSION METHOD FOR SAME (52) U.S. Cl. ....................................................... 713/186 (75) Inventors: Zhou Lu, Beijing (CN); (57) ABSTRACT Huazhang Yu, Beijing (CN) The present invention relates to an information security device of Universal Serial Bus (USB) Human Interface Correspondence Address: Device (HID) class and the data transmission method for the Richard L. Wood same. With a master chip that has a built-in HID descriptor and a USB interface chip connected to the master chip, the 22nd Floor, 120 South Riverside Plaza device of the present invention itself may be designed to be Chicago, IL 60606-3945 compact and easy to use, and provide powerful functions. With the USB HID interface, the device user does not need (73) Assignee: Feitian Technologies, Co., Ltd, to install a driver and the user can use the device anywhere Beijing (CN) and anytime. And the user does not need to manage the driver whose version updates constantly, consider the com patibility of various product drivers, face the risk caused by (21) Appl. No.: 111534,991 the driver when running OS, and worry about the pollution to the system resulted from the installation and uninstalla (22) Filed: Sep. 25, 2006 tion of the driver. CPU, SCM or smart card chip used as the master chip ensures that the security of identity authentica Foreign Application Priority Data tion is reliable. Moreover, the security of identity authenti (30) cation device can be further improved by adding biometric Jan. 27, 2006 (CN) ....... 20061OOOO2400.1 identification module and/or the like. 101 <1 Initialization > i 102 erform two-factor - ... | authentication File management encryption/d 3. mow tion a Y Operation ' ---. ends Patent Application Publication Sep. 6, 2007 Sheet 1 of 2 US 2007/0208949 A1 : t Ol < Initialization ) - 102 erform tWO-factor - --. authentication--- -- 106 ----- - - - - - - -*/Ose service o Service - 108 re Operation - denied --- ends FIG. 1 Initialization -> - - - - 202 re-PKI auth.- - - nonUse the services offered by f device l 206 Date R/W Algorithm------ Data - download encryption'd --- ecryption v-uum Y----,- 2094U. (Use serviceby app offered / Service ends Patent Application Publication Sep. 6, 2007 Sheet 2 of 2 US 2007/0208949 A1 301 CPU orchip smart card r — FIG. 3 401 USB HID host - chip -----------m-www.m-rm-mm-mm USB HID-------------- host 1 - 501 4N or w ------ - - - ------m - a - - - - - - - - - - - - SO2 - -- N4-, -i-m-- -t |- sni 4.Y - Y - u-1504 Other master chip - - - - Y - -- 505 Sensor - US 2007/0208949 A1 Sep. 6, 2007 INFORMATION SECURITY DEVICE OF class, comprising a master chip with a built-in HID descrip UNIVERSAL SERAL BUS HUMAN tor, and a USB interface module connected to the master INTERFACE DEVICE CLASS AND DATA chip. TRANSMISSION METHOD FOR SAME 0008. The information security device may comprise an additional authentication module, which is an intelligent FIELD OF THE INVENTION authentication module including a biometric identification module or a card reader module. 0001. The present invention relates to an information The USB interface module may be built in the master chip, security device of Universal Serial Bus (USB) Human or be a USB HID interface chip separated from the master Interface Device (HID) class and the data transmission chip. method for the same. 0009. The master chip may be a microprocessor or smart card chip, comprising a Central Processing Unit (CPU), a BACKGROUND OF THE INVENTION Microcontroller Unit (MCU), or a Single Chip Micyoco 0002. With the popularity of the Internet and the rise of (SCM). e-business and e-government, more and more people begin 0010. A data transmission method for the information to try online transactions. Meanwhile, more and more per security device, comprising the steps of Sonal privacy and business secrets information is transmitted 0011 1) the host recognizing the information security over the network. However, the malicious threats, such as device; virus, hacker, and phishing fraud, bring a great challenge to 0012. 2) the host sending control commands to the the security of online transactions. Endless network crimes device; lead to a trust crisis to the identity on network. We have to 0013 3) the device resolving and processing the control focus on the problems on how to prove “who am I?’ and commands after receiving them; how to prevent identify thefts again. It is urgent to safeguard 0014. 4) the device responding to the application and identify authentication/recognition which is the primary returning the execution results. problem in network security. The major identify authenti 0015 The control commands are transmitted through cation/recognition methods used in computer and network HID instructions between the host and the information systems are username?password, ID card, dynamic password security device. 0016. The control commands may include PIN authenti and USB Key (Token). cation, signature authentication, data downloading, file 0003 Username?password is the commonest and sim access, privilege management and/or read/write operation. plest method for identity authentication, but the password is 0017. The control commands may be transmitted in the easy to be doped out by other people. In addition, the form of cipher text after being encrypted. password is static data and is transmitted through computer 0018. The HID instructions may include Set Report and memory and network during authentication, So it is easy to Get Report commands. be captured by Trojan or listener on network. Therefore, its 0019. The algorithm used to encrypt the control com not a good method for identity authentication. mands is RSA, DES, 3DES, HMAC-MD5 or TEA, or the 0004 ID card authentication prevents user identity from combination of some of them. being counterfeited as ID card cannot be duplicated. But the 0020. The advantages of the present invention compared data read from ID card is also static and it is easy to be with existing technologies are: the information security captured by memory scan or network listening. The security device itself may be designed to be compact and easy to use, problems persist. and provide powerful functions. With the USB HID inter 0005. Dynamic password is a technology that allows user face, the device user does not need to install a driver and the password to change with time or the number of uses, and the user can use the device anywhere and anytime. And the user password can be used only once. Since each password must does not need to manage the driver whose version updates be generated by dynamic token and the private hardware of constantly, consider the compatibility of various product dynamic token is held only by valid user, the user identity drivers, face the risk caused by the driver when running OS, can be authenticated through password verification. But if and worry about the pollution to the system resulted from the the time or the number of uses between the client and the installation and uninstallation of the driver. CPU, SCM or server is not synchronized properly, a valid user probably Smart card chip used as the master chip ensures that the could not log in. And the user is required to enter a long security of identity authentication is reliable. Moreover, the string of ruleless password using keyboard each time the security of identity authentication device can be further user logs in, once there is a typo, the user must enter the improved by adding biometric identification module and/or password again. Obviously, it is not easy to use. the like. SUMMARY OF THE INVENTION BRIEF DESCRIPTION OF THE DRAWINGS 0006. The present invention overcomes above defects 0021. The present invention may be further understood and provides a simple and secure information security from the following description in conjunction with the device of the Universal Serial Bus (USB) Human Interface appended drawings. In the drawings: Device (HID) class, which is integrated with the features and 0022 FIG. 1 is a control flow diagram of the first advantages of both USB Key (Token) and HID devices, and embodiment of the present invention; the data transmission method for the device. 0023 FIG. 2 is a control flow diagram of the second 0007. The solution of the present invention to the tech embodiment of the present invention; nical problems is: an information security device of Uni 0024 FIG. 3 is a hardware structure diagram of the first versal Serial Bus (USB) Human Interface Device (HID) embodiment of the present invention; US 2007/0208949 A1 Sep. 6, 2007 0025 FIG. 4 is a hardware structure diagram of the command. This request can be PIN authentication, signature second embodiment of the present invention; authentication, data downloading, file access, privilege man 0026 FIG. 5 is a hardware structure diagram of the third agement or read/write. embodiment of the present invention. 0037 3. The device resolves and processes the command. 0038. After receiving Set Report command from the DETAILED DESCRIPTION OF THE host, the information security device resolves the command EMBODIMENTS according to the data resolving protocol defined previously and performs appropriate security operations, such as con 0027. As a more and more widely used PC interconnec ducting PIN authentication and signature authentication, tion protocol, USB makes the connection between periph downloading necessary data to the specified location, read erals and computer more effective and convenient. This kind ing/writing/modifying/adding/deleting files according to file of interface applies to many devices. It is quick, Supports for access privilege, or changing operation privileges on files.