System, method, and computer security device having virtual memory cells
View Patent ↗A computer security system may include a removable security device adapted to connect to the input/output port of a computer. The security device may include: a random access memory (RAM) cell; and a processor. The security system may further include: at least one encrypted update packet stored remotely from the security device and adapted to modify the contents of the RAM cell; and a private key located on the security device and adapted to decrypt the update packet; and at least one of a device driver, a software application, and/or a library stored remotely from, and in communication with, the security device and adapted to cause the contents of the at least one cell to be switched out of the cell, stored remotely from the cell, and loaded back into the cell.
1. A method of providing a virtual cell on a security device coupled to a computer, the method comprising:
encrypting storing by a processor of the computer security device first data used by a processor of the security device for an application running on the computer and residing, in a memory in the security device,
storing the encrypted first data by a processor of the computer in a location remote from the security device, in response to an application context switch based on a need for the security device memory by a software application running on the computer;
storing by the processor of the computer second data in the memory of the security device;
thereafter, in response to a second application context switch, loading by the processor of the computer the remotely stored data back into the memory of the security device in the same memory location where it originally resided;
at the security device, performing encryption operations on data transferred between the security device and the computer, using a session key K generated at the security device by a method comprising:
receiving a value V generated by the software application, wherein V is generated by combining a random number r and a base point P; and
combining V with a private key s of the device, wherein the combination results in the session key K; and
at the computer, performing encryption operations on the data transferred between the security device and the computer, using the session key K generated at the computer by a method comprising:
generating r and obtaining a public key Q of the device, wherein Q is generated by combining s with P; and
combining r with Q, wherein the combination results in the session key K.
2. The method of claim 1 , further comprising:
receiving an application program interface (API) call from a software application while the first data is resident on the security device and executing a first function in the security device; and
receiving a second API call from a software application while the second data is resident on the security device and executing a second function in the security device.
3. The method of claim 1 , wherein the base point is a point on an elliptic curve, and V is a different point on the elliptic curve; and wherein combining V with the private key comprises:
multiplying V with the private key and calculating an x coordinate of the multiplied point; and
wherein Q is another different point on the elliptic curve, and wherein combining r with Q comprises multiplying Q with r and calculating the x coordinate of the multiplied point.
4. The method of claim 2 , wherein executing at least one of the first and second functions includes at least one of:
encrypting data on the security device, decrypting data on the security device, incrementing a counter, decrementing a counter, updating a device time, reading data from the device memory, signing data on the security device, and writing data to the device memory.