=mmW
`
`ISSUECLASSIFICATION
`'
`AL6/V
`608880: \
`\\\\E
`\\\T\\x\\\\\\\\\\\\\\T\\\\\
`PAENT DATE
`
`*
`PATENT
`NUMBER
`JUL 11 Hm
`
`
`
`.%Ei‘n"§En
`
`
`
`ATTOHNEY‘S
`D as
`DOCKET NO.
`
`DJ
`
`
`
`Foreign priority claimed
`5 USC 119 oondiiiona me!
`
`U.S. DEPT. OF COMM./ PAT. &TM"’F’TO-436L (Rev.12-94)
`
`
`
`PARTS OF APPLICATION
`FILED SEPARATELY
`NOTICE OF ALLOWANCE MAILED A
`
`Assistant Examiner
`
`
`
`
`'1
`
`
`
`EY\Ll4LU
`PWMARYEXAMWER
`
`
`
`
`DRAWING
`
`Figs. Drwg.o
`
`//
`
`
`
`Print Fig.9
`
`ISSUE
`
`BATCH
`NUMBER
`
`
`
` FormaJ Drawi. s (_____sht§
`
` 1
`
`KINGSTON 1002
`
`1
`
`KINGSTON 1002
`
`

`

`vvgu.
`
`‘
`
`~
`
`»
`
`_;,#_____ _,_. _‘
`
`PATENT APPLICATION
`
`APPROVED FOR LICENSE .
`Hill“||I|lilflmflflllllll||\|\|W
`
`
`
`
`
`
`Date
`Received
`or
`_ Mailed
`
`2
`
`

`

`
`
`
`
`T
`
`M
`
`Staplé lssue;S|ip Here
`
`VERIFIER
`conps CORR.
`
`
`DRAFTING
`
`SPEC. HAND
`FILE MAINT.
`
`INDEX OF CLAIMS
`
`g
`
`«
`
`-
`
`__
`
`+ ”_
`
`1
`
`4
`
`‘E
`'
`‘
`
`‘
`
`Date
`
`—«—.
`
`’
`
`"‘
`
`L
`
`I
`
`h
`2
`
`A
`
`L
`
`__
`
`Claim
`E ~§.
`LE
`——
`
`51
`52
`53
`54
`55
`56
`57
`55
`L_ 59
`so
`61
`52
`es
`64
`65 J
`‘'56
`57
`631
`69
`70
`7‘
`72
`73
`74
`75
`76
`77
`We
`79
`80
`31
`82
`
`85
`as
`87
`53
`39
`£0
`91
`92
`
`93
`94
`95
`95
`97
`as
`99
`100
`
`
`
`\_ ‘Date
`ax
`Claim’
`éxifi ‘Q
`LT.
`'5
`.
`Pg)‘ »/
`J47 2 wk z?
`3 ;+ 2‘
`3%
`tab ,4_LV =
`Z
`.
`5
`=3
`‘"3 ” f”t}‘J"= ‘#7
`6 '
`‘ L *=
`I
`-
`ag / : ,
`id; 9’ i.—;« *‘
`'5 11
`‘ cu
`/5_19
`7+
`4:
`J Z
`V!
`121,12
`:2‘
`2
`3 9 ~*~
`2 _ A V’ 1;
`‘La’ 15 +£
`_
`39 we
`.1; =
`4,1 17 .
`'
`*3
`'3‘ 18
`2:
`--r
`_
`’_._
`1
`20 + -=
`W,
`‘\L
`17 22
`.L_‘=
`I23
`-
`=
`' .
`r/ ,
`2025 J *1
`g_ 6 M =
`I -3;
`V’
`
`’
`
`1
`
`:
`
`‘
`
`‘
`"=
`3
`’
`g,g_; J u
`:
`‘gig
`’
`:2
`L;
`:
`5
`__j____:__5
`E2 35
`2:
`H3 36
`"'5
`/35 37
`‘~‘‘
`/5 g: 33
`‘~‘
`gg 39
`_ m
`.27 40
`3
`I2._!—‘_f“
`_'“—' 44“
`”
`4
`5
`ll
`
`_,
`
`‘
`
`‘
`
`7 “~
`43
`7; 44‘L___ =‘
`" ' 45
`:i
`_4s
`_
`47
`48
`"”‘ 49 L
`50'
`
`EL
`v;,
`
`*
`
`4..
`
`fl
`__ _
`
`-———J——-J
`
`1
`
`A _
`
`_
`
`1
`
`" _+_7'
`
`J
`
`4
`
`SVMBOLS R’ mu
`:7:
`3337
`(Through numberan E'2?:aerIs\::iBe:lim
`."n‘2e"&‘.'fe°n“2‘Z
`Appeal
`Wohjecled
`
`
`
`:
`
`Z‘
`0
`
`(I FFT INQIDFS
`
`3
`
`3
`
`

`

`
`
`AREA
`
`..L£§..._i0VEFINMENT PRINTING OFFICE: I996—440*759
`I
`
`‘I
`
`cnoss aerenewcasn
`
`APPLICAN 'S NAME (PLEAS PRINT)
`
`IF REISSUE, ORIGINAL PATENT NUMBER
`
`
`
`INTERNATIONAL CLASSIFICATION
`
`FEEL! T171
`
`PTO 270
`(REV. 5-91)
`
`
`
`
`
`
`
`ART UNIT ASSISTANT EXAMINER (PLEASE STAMP OFI FFIINT FULL NAMEI
`
`
`
`PRIMARY XAMINER IPLEASEf:IAMP OR PRINT FULL NAME)
`
`
`L V U
`US. DEPARTMENT OF COMMERCE
`PATENT AND TRADEMARK OFFICE
`
`
`4
`
`

`

`' SEARCHED
`
`5
`
`

`

`-
`[[3
`
`lilllllllilllli,_
`
`ON
`-——_.
`___;;
`°§§e.l
`0 gg§zExs>
`===
`3?:-==
`I‘
`HEEE
`
`
`
`‘W
`
`M
`
`(Q)//(30!//ff’/Q
`
`Attorney Docket No.:
`
`SPY-O04
`
`IN THE UNIT*D STATHS PATPNT AND TRADEMARK OFFICE
`
`June 4, 1997
`
`Assistant Commissioner for Patents
`Washington, D. C.
`20231
`ATTN:
`BOX PATENT APPLICATION
`
`Transmitted herewith for filing is a patent application, as
`follows:
`
`Inventors: William P. Bialick, Mark J. Sutherland, Janet L.
`Dolphin—Peterson, Thomas K. Rowland, Kirk W. Skeba
`and Russell D. Housley
`PERIPHERAL DEVICE WITH INTEGRATED SECURITY FUNCTIONALITY
`
`Title:
`
`Enclosed with :his transmittal letter are:
`w> 2
`
`pages of specification, claims and abstract
`sheets of drawings:
`___ (Formal) _§
`(Informal)
`pages of Declaration and Power of Attorney (Unexecuted)
`Power of Attorney
`Assignment of invention to Spyrus,
`Small Entity Declaration
`Independent Inventor's Declaration
`PTO Form-1449
`Preliminary amendment
`
`IIIC
`
`llllllw
`
`The filing fee is calculated as follows
`claimed):
`
`(small entity status is
`4!
`
`CLAIMS As FILED (fees computed under §1.9(f))
`
`Number
`Filed
`
`Number
`Extra
`
`Rate
`
`Fee
`
`Basic Filing Fee:
`
`Total Claims:
`
`Independent Claims:
`
`32
`
`12
`
`~
`
`—
`
`20
`
`3
`
`=
`
`=
`
`12
`
`9
`
`X
`
`X
`
`$11
`
`$40
`
`=
`
`=
`
`Application contains one or more multiple
`dependent claims (S260 total fee)
`
`TOTAL FILING FEE:
`
`$ 385.00
`
`$ 132.00
`
`S 360.00
`
`S
`
`$
`
`0.00
`
`877.00
`
`A Return Post Card and this sheet in duplicate are also enclosed.
`
`I hereby certify that this correspondence is being
`deposited with the United States Postal Service as
`Express Mail
`in an envelope addressed to:
`Assistant Commissioner for Patents, Washington,
`D.C., 20231, on June 4, 1997.
`Express Mail
`Receipt No. EF 557 934 406 US
`wv
`fiaaaitmlaal Jlmzfi
`Davi
`R. Gra am
`Date
`
`Respectfully submitted.
`
`AW/%.»w~
`
`David R. Graham
`Reg. No. 36,150
`Attorney for Applicants
`
`6
`
`

`

`IN THE UNITED STATES PATENT AND TRADEMARK OFFICE
`
`Attorney Docket No.2
`
`June 4, 1997
`Assistant Commissioner for Patents
`Washington, D. C.
`20231
`ATTN:
`BOX PATENT APPLICATION
`
`Ci
`
`guh
`E
`“
`
`same/an
`
`
`
`Old'S'fl#6199
`
`Transmitted herewith for filing is a patent application, as
`follows:
`
`Inventors: William P. Bialick, Mark J. Sutherland, Janet L.
`Dolphin-Peterson, Thomas K. Rowland, Kirk W. Skeba
`and Russell D. Housley
`PERIPHERAL DEVICE WITH INTEGRATED SECURITY FUNCTIONALITY
`
`Title:
`
`Enclosed with this transmittal letter are:
`
`pages of specification; claims and abstract
`sheets of drawings:
`___ (Formal) _g
`(Informal)
`pages of Declaration and Power of Attorney (Unexecuted)
`Power of Attorney
`Assignment of invention to Spyrus,
`Small Entity Declaration
`Independent Inventor's Declaration
`PTO Form-1449
`Preliminary amendment
`
`Inc.
`
`'
`
`iH|ll‘”$
`
`The filing fee is calculated as follows (small entity status is
`claimed):
`
`CLAIMS AS FILED fee
`
`com uted under
`‘
`
`l.9 f
`
`Number
`Filed
`
`Number
`Extra
`
`Rate
`
`Fee
`
`Basic Filing Fee:
`
`Total Claims:
`
`Independent Claims:
`
`32
`
`12
`
`-
`
`-
`
`20
`
`3
`
`=
`
`=
`
`12
`
`9
`
`X
`
`X
`
`$11
`
`$40
`
`=
`
`=
`
`Application contains one or more multiple
`dependent claims (S260 total fee)
`
`TOTAL FILING FEE:
`
`S 385.00
`
`S 132.00
`
`S 360.00
`
`S
`
`$
`
`0.00
`
`877.00
`
`A Return Post Card and this sheet in duplicate are also enclosed.
`I hereby certify that this correspondence is being
`deposited with the United States Postak Service as
`Express Mail
`in an envelope addressed to:
`Assistant Commissioner for Patents, Washington,
`D.C., 20231, on June 4, 1997.
`Express Mail
`Receipt No. EF 55? 934 406 US
`-‘V
`flafimiéuxi _u1J_7_
`Devi
`R. Gra am
`Date
`
`/§LM;€.wW
`
`David R. Graham
`Reg. No. 36.150
`Attorney for Applicants
`
`Respectfully submitted,
`
`7
`
`

`

`
`
`PERIPHERAL DEVICE WITH INTEGRATED SECURITY FUNCTIONALITY
`
`._ 1 _
`
`William P. Bialick
`Mark J. Sutherland
`
`Janet L. Dolphin—Peterson
`Thomas K. Rowland
`Kirk W. Skeba
`
`Russell D. Housley
`
`CROSS~REFERENCE TO RELATED APPLICATION
`
`10
`
`This application is related to the commonly owned, co‘
`pending United States Patent Application entitled "Modular
`Security Device," by William P. Bialick, Mark J. Sutherland,
`
`Janet L. Dolphin-Peterson,
`Thomas K. Rowland, Kirk W. Skeba
`’
`and Russell D. Housley, filed on the same date as the present
`SPY-003,
`the
`application and having Attorney Docket No.
`disclosure of which is incorporated by reference herein.
`
`15
`
`BACKGROUND OF THE INVENTION
`
`1.
`
`Field of the Invention
`
`This invention relates to a peripheral, often portable,
`device (as well as the methods employed by such a peripheral
`device, and systems including such a peripheral device and a
`
`20
`
`host computing device with which the peripheral device
`communicates)
`that can communicate with a host computing
`device to enable one or more security operations to be
`performed by the peripheral device on data stored within the
`host computing device, data provided from the host computing
`device to the peripheral device, or data retrieved by the
`host computing device from the peripheral device.
`2.
`Related Art
`
`Computing capability is becoming increasingly portable.
`In particular,
`there are more and more portable peripheral
`devices that are adapted for communication with a host
`computing device (e.g., desktop computer, notebook computer
`or personal digital assistant) to enable particular
`
`8
`
`

`

`_ 2 _
`
`These portable Peripheral
`functionality to be achieved.
`(e.g., PCMCIA
`devices can take a variety of physical forms
`cards, smart cards, CD-ROMs)
`and can perform an assortment of
`functions (e.g., storage, communications and cryptography).
`
`However, while portable computing affords a number of
`advantages, it has a significant disadvantage in that the
`computational environment
`(including the portable peripheral
`devices,
`the host computing devices in which they are used,
`
`and any other computational devices that communicate with
`those devices)
`is more susceptible to security breaches,
`i.e., unauthorized access to, or modification of, programs
`and/or data resident within the environment. Consequently,
`cryptographic devices and methods have been developed for use
`with such computational environments (as well as other~
`computational environments)
`to enable increased levels of
`environment security to be obtained.
`FIG.
`1 is a block diagram of a prior art system for
`
`enabling a host computing device to provide secured data to,
`and retrieve secured data from,
`FIG. 1,
`
`In
`a portable device.
`a system 100 includes a host computing device 101 and
`a portable Gevice 102.
`The host computing device 101 and
`portable device 102 are adapted to enable communication
`between the devices 101 and 102.
`The host computing
`device 101 includes a security mechanism 101a (which can be
`embodied by appropriately configured hardware, software
`and/or firmware, such as, for example, a general purpose
`microprocessor operating in accordance with instructions of
`one or more computer programs stored in a data storage device
`such as a hard disk) which can be directed to perform one or
`more cryptographic operations.
`
`In the system 100, if it is desired to provide secured
`data from the host computing device 101 to the portable
`
`the host computing device 101 causes the security
`device 102,
`mechanism 101a to perform appropriate cryptographic
`operations on data before the data is transferred to the
`
`10
`
`15
`
`20
`
`25
`
`30
`
`
`
`9
`
`

`

`_
`
`3
`
`_
`
`the host computing
`portable device 102. Similarly,
`device 101 can receive secured data from the portable
`device 102 and perform appropriate cryptographic operations
`on the data to convert the data into a form that enables the
`
`data to be accessed and/or modified by a person who is
`authorized to do so.
`
`A significant deficiency of the system 100 is that the
`security mechanism 101a is itself typically not adequately
`secure.
`It is commonly accepted that the components
`(including hardware, software and/or firmware) of most host
`Computing devices are inherently insecure. This is because
`
`10
`
`typically,
`the system design of host computing devices is,
`intentionally made.open so that components made by different
`
`15
`
`Thus, an _
`manufacturers can work together seamlessly.
`unauthorized person may obtain knowledge of the operation of
`the security mechanism 101a (e.g.,
`identify a cryptographic
`
`thereby enabling that person to gain access to, and/or
`key),
`modify,
`the (thought to be secured) data.
`
`2 is a block diagram of anotherfiprior art system
`FIG.
`for enabling a host computing device to provide secured data
`to, and retrieve secured data from, a portable device.
`In
`FIG. 2, a system 200 includes a host computing device 201, a
`portable device 202 and a security device 203.
`The host
`computing device 201,
`the portable device 202 and security
`device 203 are adapted to enable communication between the
`devices 201 and 202, and between the devices 201 and 203.
`
`The security device 203 includes appropriately configured
`hardware, software and/or firmware which can be directed to
`
`perform one or more cryptographic operations.
`In the system 200, if it is desired to provide secured
`data from the host computing device 201 to the portable
`device 202,
`the host computing device 201 first causes data
`to be transferred to the security device 203, where
`appropriate cryptographic operations are performed on the
`data.
`The secured data is then transferred back to the host
`
`20
`
`25
`
`30
`
`35
`
`
`
`10
`
`10
`
`

`

`11
`
`

`

`-
`
`5
`
`_
`
`one may
`is desired to perform a secure data exchange (e.g.,
`even if both
`
`Second,
`have been forgotten or misplaced).
`devices 202 and 203 are available, it may not be passible to
`connect both devices 202 and 203 at the same time to the host
`
`computing device 201, making use of the devices 202 and 203
`cumbersome and increasing the likelihood that unsecured data
`is provided by the host computing device 201 to the portable
`device 202.
`
`SUMMARY OF THE INVENTION
`
`l0
`
`A peripheral device according to the invention can be
`used to communicate with a host computing device to enable
`one or more security operations to be performed by the
`
`
`
`25
`
`30
`
`peripheral device on data stored within the host computing
`device, data provided from the host computing device to the
`
`for example, stored in
`peripheral device (which can then be,
`the peripheral device or transmitted to yet another device),
`
`or data retrieved by the host computing device from the
`peripheral device (e.g., data that has been stored in the
`
`data,
`
`peripheral device egltransmitted to the peripheral device
`In particular,
`the peripheral device
`from another devicfif.
`can be adapted to enable,
`in a single integral peripheral
`device,
`performance of one or more security operations on
`and a defined interaction with a host computing device
`that has not previously been integrated with security
`The defined
`operations in a single integral device.
`interactions can provide a variety of types of functionality
`data storage, data communication, data input and
`(e.g.,
`output,
`user identification), as described further below.
`
`The peripheral device can be implemented so that the
`
`peripheral device can be operated in any one of multiple
`user-selectable modes:
`a security functionality only mode, a
`target functionality mode, and a combined security and target
`functionality mode.
`The peripheral device can also be
`implemented so that the security operations are performed in-
`
`12
`
`12
`
`

`

`-6-
`
`the security operations are performed between the
`line, i.e.,
`communication of data to or from the host computing device
`and the performance of the defined interaction. Moreover.
`
`the peripheral device can be implemented so that the security
`functionality of the peripheral device is transparent to the
`host computing device.
`A peripheral device according to the invention can
`advantageously enable application of security operations to a
`wide variety of interactions with a host computing device.
`In particular, a peripheral device according to the invention
`can accomplish this without necessity to use two peripheral
`devices:
`one that’performs the security operations and one
`that performs the defined interaction. This can,
`for
`example, minimize the possibility that the device adapted to
`perform the defined interaction will be used with the host
`computing system without proper application of security
`operations to that interaction. Moreover,
`the provision of
`in-line security in a peripheral device according to the
`invention enables a more secure exchange of data between a
`host computing %evice and the peripheral device, overcoming
`the problems identified above in previous systems for
`performing security operations on data exchanged between such
`Additionally,
`devices.
`implementing a modular device
`according to the invention so that the performance of
`security operations by the modular device is transparent can
`reduce or eliminate the need to modify aspects of the
`operation of the host computing device (e.g., device drivers
`of the host computing device), making implementation and use
`
`of a data security system including the modular device
`Thus,
`simpler and easier.
`the possibility that a user will
`use the system incorrectly (e.g., fail to apply security
`operations to an interaction with the host computing device,
`or apply the security operations incorrectly or incompletely)
`
`10
`
`15
`
`2O
`
`25
`
`30
`
`is reduced. Making the security operations transparent can
`also enhance the security of those operations.
`
`35
`
`
`
`13
`
`13
`
`

`

`BRIEF DESCRIPTION OF THE DRAWINGS
`
`-7-
`
`FIG. 1/is a block diagram of a prior art system for
`enabling a host computing device to provide secured data to,
`
`and retrieve secured data from, a portable device.
`FIG. 2'is a block diagram of another prior art system
`for enabling a host computing device to provide secured data
`
`to, and retrieve secured data from, a portable device.
`FIG.
`3A is a block diagram of a system according to the
`invention.
`,/f
`FIG. 33/is a perspective View of a physical
`implementation of the system of FIG.
`3A according to one
`embodiment bI the invention.
`FIG.
`4 is a block diagram of a peripheral device
`according to ’n embodiment of the invention.
`
`FIG.
`
`5 is a flow chart of a method, according to an
`
`embodiment of_the invention,
`according tg/the invention.
`FIG.
`6’is a block diagram of a system, according to an
`
`for initiating use of a system
`
`illustratingvoperation of the
`embodiment of the invention,
`system during a method according to the invention as in
`FIG. 5.
`FIG.
`
`7 is a flow chart of a method, according to an
`
`for using a peripheral device
`
`embodiment of the invention,
`according tofithe invention.
`FIG. 8‘d§ a block diagram of a peripheral device
`according tofanother embodiment of the invention.
`FIG. 9A.§s a block diagram illustrating the flow of data
`through the interface control device of FIG. 8.
`FIG.
`9B is a block diagram of a particular embodiment of
`an interface control device for use in a peripheral device
`according to the invention.
`
`10
`
`15
`
`20
`
`25
`
`30
`
`DETAILED DESCRIPTION OF THE INVENTION
`
`FIG.
`
`3A is a block diagram of a system 300 according to
`
`the invention.
`
`The system 300 includes a host computing
`
`
`
`14
`
`14
`
`

`

`,
`
`62
`
`61
`
`CL
`
`LL
`
`
`
`_ 8 _
`
`device 301 and a peripheral device 302 that communicate via a
`communications interface 303. Herein, "peripheral device”
`
`can re er to any device that operates outside of a host
`°‘3gR;§g§3$3§al device and that is connected to the host
`,4,
`‘
`,
`5 é:§§§é:§§§l device.
`The peripheral device 302 includes a
`I.
`security mechanism 302a that enables security operations
`(examples of which are described in more detail below)
`to be
`
`performed on data that is stored within the host computing
`device 301, data tha
`is transmitted from the host computing
`afib
`'
`3cnL
`10 device 501
`oflfi
`devicg, or data that is transmitted
`fromA_'
`device to the host computing device 301. As
`explained in more detail below,
`the peripheral device 302
`also provides additional functionality (referred to herein as
`"target functionality") to the system 300,
`such as,
`for
`15 example,
`the capability to store data in a solid—state disk
`storage device,
`the capability to enable communications from
`the host computing device 301 to another device,
`the
`
`capability to accept biometric input to enable user
`authentication to the host computing device 301, and the
`20 capability to receive and read a smart card inserted into the
`peripheral device 302.
`Generally,
`the communications interface 303 can be any
`
`embodied by any of a variety of communication interfaces,
`such as a wireless communications interface, a PCMCIA
`25 interface,
`a smart card interface, a serial interface (such
`
`as an RS-232 interface), a parallel interface, a SCSI
`interface or an IDE interface.
`Each embodiment of the
`
`communications interface 303 includes hardware present in
`each of the host computing device 301 and peripheral device
`30 302 that operates in accordance with a communications
`
`for example, by software
`(which can be embodied,
`protocol
`stored in a memory device and/or firmware that is present in
`the host computing device 301 and/or peripheral device 302)
`
`appropriate for that type of communications interface, as
`35 known to those skilled in the art.
`Each embodiment of the
`
`15
`
`15
`
`

`

`_
`
`9
`
`_
`
`communications interface 303 also includes mechanisms to
`
`enable physical engagement, if any, between the host
`computing device 301 and peripheral device 302.
`Generally,
`the security mechanism 302a can be configured
`to perform any electronic data security operation (herein,
`
`for
`including,
`referred to simply as "security operation")
`example, operations that provide one or more of the basic
`cryptographic functions,
`such as maintenance of data
`
`10
`
`confidentiality, verification of data integrity, user
`authentication and user non-repudiation. Particular security
`operations that can be implemented in a peripheral device
`according to the invention are described in more detail
`below.
`’
`
`for example,
`The security mechanism 302a can be,
`embodied as a security token. Herein, "security token"
`refers to a device that performs security operations and that
`includes one or more mechanisms
`use of
`(such as,
`for example,
`
`a hardware random number generator and/or‘protected memory)
`to provide security for the content of those operations.
`FIG.
`3B is a perspective view of a physical
`
`20
`
`implementation of the system 300 of FIG. 3A, according to one
`embodiment of the invention.
`In FIG.;§g,
`the peripheral
`device 302 is embodied as a card 312 that can be inserted
`into a corresponding slot 313 formed in a portable
`in FIG. 3B.
`computer 311 that,
`embodies the host computing
`device 301.
`Often a peripheral device according to the
`such as the card 312 shown in
`invention is a portable device,
`FIG. 3B.
`
`Herein, "portable device" can refer generally to
`any device that is capable of being easily carried by hand.
`FIG.
`4 is a block diagram of a peripheral device 400
`The peripheral
`according to an embodiment of the invention.
`
`25
`
`30
`
`target
`device 400 includes security functionality 401,
`functionality 402 and a host interface 403 that are formed
`
`For example,
`together as part of a single physical device.
`the security functionality 401 and target functionality 402
`
`35
`
`
`
`16
`
`16
`
`

`

`-
`
`_
`
`can be enclosed in a single,
`FIG.
`4 by the numeral 404) conforming to a PCMCIA card or
`smart card standard.
`
`card—like housing (designated in
`
`The peripheral device 400 can have a number of
`advantageous characteristics.
`The peripheral device 400 can
`be implemented in a manner that enables the security
`operations of the security functionality 401 to be performed
`in a manner that is transparent to a host computing device
`(and, depending upon the particular implementation of the
`peripheral device 400,
`to a user of a system including the
`of a system according to the
`peripheral device 400)
`so that the
`invention,
`host computing device (and, perhaps.
`the presence of the target
`is aware only of
`user)
`functionality 402. Additionally,
`the peripheral device 400
`can be implemented so that security operations are performed
`"in~line," i.e.,
`the security operations are performed
`between the communication of data to or from the host
`
`computing device and the performance of the target
`
`functionality provided by the peripheral device. Further,
`the peripheral device 400 enables a wide variety of secure
`target functionality to be easily provided to a host
`computing device.
`FIG.
`5 is a flow chart of a method 500,
`embodiment of the invention,
`
`according to an
`for initiating use of a system
`The method 500 enables an aspect
`according to the invention.
`of the invention in which the presence of security
`functionality as part of a peripheral device is not detected
`by a host computing device,
`thus making the security
`
`10
`
`15
`
`20
`
`25
`
`functionality transparent to the host computing device and.
`depending upon the particular manner in which the security
`functionality is implemented,
`to a user of the system.
`FIG.
`6 is a block diagram of a system 600, according to
`an embodiment of the invention,
`illustrating operation of the
`system 600 during a method according to the invention such as
`the method 500 of FIG. 5.
`The system 600 includes a host
`
`30
`
`35
`
`
`
`17
`
`17
`
`

`

`_
`
`_
`
`computing device 601 and a peripheral device 602.
`computing device 601 includes a display device 603a
`(e.g.. a
`conventional computer display monitor) and user input
`device 603b (e.g ,
`a keyboard, mouse,
`trackball,
`joystick or
`
`The host
`
`other appropriate device), referred to collectively
`hereinafter as user interface device 603.
`The host computing
`
`device 601 also includes, mounted within a housing 604, a
`processing device 605,
`a memory device 606, an input/output
`(1/0)
`device 607 for enabling communication with the user
`device 608
`interface device 603.
`and an input/output
`(1/0)
`The
`for enabling communication with peripheral device 602.
`606,
`devices 605,
`607 and 608 can each be implemented by
`
`conventional such devices and can communicate with each other
`via a conventional computer bus 609, as is well known and
`
`The peripheral device 602 includes security
`understood.
`(I/O)
`functionality 611, a memory device 612, an input/output
`device 613 for enabling communication with the host computing
`device 601 and target functionality 614.
`The security
`
`l0
`
`l5
`
`20
`
`I/O‘device 613 and
`functionality 611, memory device 612,
`target functionality 614 can each be implemented by
`conventional devices and can communicate with each other via
`
`a conventional computer bus 615, as is well known and
`
`The host computing device 601 and the peripheral
`understood.
`6 to
`device 602 aretshown in simplified form in FIG.
`facilitate
`clarity in illustration of this aspect of the
`as described in more detail below and as
`
`invention;
`
`understood
`device 601
`will -
`
`by those skilled in the art,
`
`the host computing
`and the peripheral device 602 can - and typically
`include other devices not shown in FIG. 6.
`
`Returning to FIG.
`
`5,
`
`use of a system according to
`invention begins when,
`as shown by step 501,
`a user of
`system connects a peripheral device according to the
`invention to a host computing device.
`Such connection can
`occur in any manner that enables the peripheral device to
`communicate with the host computing device. Frequently,
`
`the
`the
`
`this
`
`
`
`25
`
`30
`
`35
`
`18
`
`

`

`_
`
`_
`
`will occur as a result of a physical connection of the
`peripheral device to the host computing device.
`(In general,
`
`such physical connection can occur either before or after the
`host computing device begins operating; however,
`in the
`former case, subsequent steps of the method 500 — with the
`exception of, depending upon the implementation of the
`
`the step 503.~ cannot be performed until
`peripheral device,
`the host computing device begins operating.)
`For example,
`
`the peripheral device can be embodied in a card or disk
`(e g., a card conforming to a PCMCIA form factor as
`
`10
`
`that is inserted
`established by the appropriate standard)
`into a corresponding socket formed in the host computing
`device. Or,
`the peripheral device can be embodied in a
`
`15
`
`20
`
`25
`
`30
`
`housing from which a cord extends, a plug of the cord being
`inserted into a mating receptacle formed in the host
`computing device. However, such physical connection need not
`necessarily occur;
`the peripheral device can also be
`
`connected to the host computing device by any type of
`
`wireless communication for which the hostqcomputing device
`contains an appropriate interface.
`Once connection between the peripheral device and the
`host computing device is made,
`the host computing device
`detects the presence of the peripheral device, as shown by
`step 502.
`Such detection of the presence of a peripheral
`device is typically enabled as a standard aspect of the
`operating system software of the host computing device.
`Typically, once the presence of a new peripheral device
`is detected by the operating system software of the host
`computing device,
`the operating system software (or companion
`software program) also identifies the type of the peripheral
`
`for example, by a standard
`device. This can be accomplished,
`software device driver (hereinafter, "host driver")
`for
`
`devices of the type that use the host computing device
`
`interface that is being used by the peripheral device 602.
`In FIG. 6,
`the host driver is shown stored in the memory
`
`35
`
`
`
`19
`
`19
`
`

`

`_
`
`_
`
`section 606a of the memory device 606 of the host computing
`device 601.
`(The Card Services or Socket Services programs
`
`that often are bundled with the Windows95” operating system
`software for use in performing various "housekeeping"
`functions associated with a PCMCIA interface are an examples
`of such drivers.) However,
`
`in the method 500, before the
`operating system software can perform such identification,
`the peripheral device according to the invention suspends
`operation of this aspect of the operating system software,
`that the peripheral device can establish its identity. as
`shown by step 503, and explained further below.
`As will be
`
`so
`
`from that explanation, performance of the step 503
`apparent
`advantageously enables the peripheral device to assume"the
`identity of the target functionality that is part of the
`peripheral device.
`Since, as described elsewhere herein, a
`peripheral device according to the invention can include a
`
`variety of types of target functionality,
`device can take a variety of identities.
`
`the peripheral
`
`The particular manner in which operation of the
`operating system software is suspended so that the peripheral
`device can establish its identity can depend on the
`characteristics of the operating system software and/or the
`device interface. However,
`for many combinations of
`operating system software and device interface,
`the operating
`system software waits for confirmation that the device
`connected to the device interface is ready for further
`interaction with the operating system software before the
`
`operating system software seeks to identify the type of the
`device connected to the interface
`(the standard for PCMCIA
`In such
`for example,
`interfaces,
`specifies such operation).
`cases,
`the peripheral device can be configured to delay
`informing the operating system software that the peripheral
`device is ready for further interaction until the peripheral
`device has established its identity.
`The following description of one way in which the
`
`20
`
`
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`20
`
`

`

`-14-
`
`step 503 can be implemented can best be understood by
`
`reference to the system 6gg shown in FIG. 6. One way in
`which the operating system software of a host computing
`device can identify the type of a peripheral device is to
`access a known memory section of a memory device of the
`
`peripheral device, as established by an interface standard
`developed for that type of peripheral device,
`that stores
`data representing the type of the peripheral device. This is
`true for a variety of types of peripheral devices, such as,
`for example, peripheral devices that conform to the PCMCIA
`includes a
`(The PCMCIA standard.
`standard.
`for example,
`that
`called the Card Information Structure,
`specification,
`defines,
`among other things,
`
`a location in a portion of
`
`memory of a PCMCIA card, denoted as "attribute memory”.
`stores data identifying the type of the PCMCIA card.)
`600,
`system
`the peripheral device 602 is such a device.
`memory
`section of the memory device 612 of the peripheral
`device 602 which the host computing device 601 seeks to
`and the
`access is shown in FIG.
`6 as the memory section 612a,
`data stored therein is referred to herein as
`"peripheral
`device identification data."
`
`The
`
`that
`In the
`
`The peripheral device 602 can be implemented so that the
`peripheral device 602 assumes the identity of the target
`functionality 614 (whether or not the security functionality
`of the peripheral device is also being used). This enables
`the host computing device 601 to interact with the peripheral
`
`device 602 as though the peripheral device 602 were a device
`of the type of the target functionality 614, without
`recognizing that security functionality 611 is present that
`may be
`Thus,
`the need to
`performing security operations.
`aspects of the operation of the host computing device
`the host device driverf¢§s reduced or eliminated,
`implementation and use of a data security system
`
`modify
`(e.g.,
`making
`
`
`
`10
`
`15
`
`20
`
`25
`
`30
`
`including the peripheral device 602 simpler and easier.
`Since use of the data security system is easier (e.g., a user
`
`35
`
`21
`
`21
`
`

`

`..
`
`_
`
`need not provide input to cause the host driver to be
`appropriately tailored to enable desired interaction with a
`
`the possibility that a user will use the
`security device),
`system incorrectly (e.g., fail to apply security operations
`
`to an interaction with the host computing device, or apply
`the security operations incorrectly or incompletely)
`is
`reduced.
`
`Though, as shown in FIG. 6.
`the peripheral device 602
`includes security functionality 611 and target
`
`the system 690 can be operated so that
`functionality 614,
`The peripheral
`only the security functionality 611 is used.
`device 602 and peripheral device driver (discussed below) can
`
`be implemented so that, when the peripheral device 602”is
`operated in that way.
`the peripheral device identification
`data stored in the memory location 612a identifies the
`peripheral device 602 as a security device.
`Returning to FIG. 5, after the peripheral device has
`established its identity,
`the host computing device
`identifies the peripheral device, as shown by step 504. This
`can be implemented as part of the host driver, as indicated
`above.
`
`Once the host computing device has identified the
`peripheral device (and other host computing device operating
`the
`system software operations concluded, if applicable),
`(in particular,
`user can be