System and method to securely transfer data
Various embodiments of the invention achieve optimal data security by adding a security layer to data at the point of generation. Some embodiments add a security feature to data that controls or configures a device at a physical interface.
1. A state-machine based secure data-converting apparatus comprising:
a signal converter coupled to receive a first signal from a physical data interface, the signal converter converts the first signal into a second signal;
a logic circuit coupled to the signal converter and the data securing device, the logic circuit configured to receive a third signal from a host via a bidirectional communication channel and determine validity of the third signal that comprises at least one of a digital command, identifier information, and a shared secret;
a data securing device coupled to the signal converter, the data securing device comprises a secret and applies a security protocol to the second signal without executing microcode.
2. The apparatus according to claim 1 , wherein the logic circuit to generate a request signal in response to determining that the third signal is valid.
3. The apparatus according to claim 2 , wherein the signal converter is configured to convert the first signal into the second signal in response to the fourth signal.
4. A secure data converting apparatus comprising:
a data securing device coupled to exchange secure data with a host via a bidirectional communication channel, the data securing device receives a first signal comprising at least one of a digital command, identifier information, and a shared secret and applies a security protocol to the first signal to output a second signal;
a logic circuit coupled to the data securing device to verify the authority of at least a portion of the second signal and output a verified signal; and
a signal converter coupled to receive the verified signal to generate a control signal.
5. A method for securing data, comprising:
receiving from a physical data interface a first set of data having a first format, the physical data interface configured for bidirectional data transmission between a host and a secured system;
converting, within a first device, the first set of data into a second set of data having a second format and comprising at least one of a digital command, identifier information, and a shared secret;
applying, within the first device, a security protocol to the second set of data without executing microcode to generate secured data; and
outputting the secured data.
6. The method according to claim 5 , wherein applying the security protocol further comprises receiving and authenticating at least a part of the second set of data.
7. The method according to claim 5 , wherein applying the security protocol further comprises encrypting the second set of data.
8. The method according to claim 5 , wherein applying the security protocol further comprises applying a secret.
9. The method according to claim 8 , wherein the secret is at least one of a digital signature, a pre-installed digital certificate, and a hash algorithm.
10. The method according to claim 5 , further comprising, applying the secured data to an external device to initiate an action.
11. A method for securing data, comprising:
receiving digital data from a host, the digital data comprises a command;
loading the digital data into a security device;
applying, within the security device, a security protocol to at least a first portion of the digital data without executing microcode;
applying a secret that is at least one of a digital signature, a pre-installed digital certificate, and an authentication code;
determining via a logic circuit whether the first portion of the digital data is valid; and if the first portion of the digital data is valid,
executing the command.
12. The method according to claim 11 , further comprising, if the first portion of the digital data is invalid, rejecting the command.
13. The method according to claim 11 , wherein executing comprises converting, within the first device, data in a first format to data in a second format.
14. The method according to claim 11 , wherein applying the security protocol further comprises:
performing a hash operation;
generating hash data; and
comparing the hash data to a message authentication code.
15. The method according to claim 11 , wherein determining further comprises validating a source or destination associated with the data.