Secure island computing system and method

1. A method for generating an-bit result comprising:

receiving, by a secure containment device (SCD), a request to generate the n-bit result, wherein the request is sent from an application executing on a host system using a first input/output (I/O) interface and wherein the request comprises a n-bit generator input;

disabling, by the SCD, the first I/O interface after receiving the request from the host system;

after disabling all the I/O interfaces between the host system and the SCD:

obtaining, by the SCD, a user credential from a user by the SCD, wherein the user credential is input by the user using a user interface on the SCD;

generating, by the SCD, a secrets file name and a secrets file encryption key using the user credentials and the n-bit generator input;

obtaining, by the SCD, a secrets file from secure storage using the secrets file name, wherein the secrets file is obtained from the secure storage using a second I/O interface between the SCD and the secure storage;

decrypting, by the SCD, the secrets file using the secrets file encryption key to obtain a decrypted secrets file;

generating, using a n-bit generator on the SCD, the n-bit result using the decrypted secrets file;

enabling, by the SCD, at least the first I/O interface after the n-bit result is generated; and

providing by the SCD, after enabling the first I/O interface, then-bit result to the application using the first I/O interface.

2. The method of claim 1 , further comprising:

determining, by the SCD, that the SCD is connected to the secure storage over the second I/O interface.

3. The method of claim 1 , wherein the user interface on the SCD is one selected from a group consisting of a twelve digit keypad, a touch screen, and a QWERTY keyboard.

4. The method of claim 1 , wherein the second I/O interface is disabled when the first I/O interface is enabled.

5. A non-transitory computer readable medium comprising instructions, which when executed perform a method, the method comprising:

receiving, by a secure containment device (SCD), a request to generate the n-bit result, wherein the request is sent from an application executing on a host system using a first input/output (I/O) interface and wherein the request comprises a n-bit generator input;

disabling, by the SCD, the first I/O interface after receiving the request from the host system;

after disabling all the I/O interfaces between the host system and the SCD:

obtaining, by the SCD, a user credential from a user by the SCD, wherein the user credential is input by the user using a user interface on the SCD;

generating, by the SCD, a secrets file name and a secrets file encryption key using the user credentials and the n-bit generator input;

obtaining, by the SCD, a secrets file from secure storage using the secrets file name, wherein the secrets file is obtained from the secure storage using a second I/O interface between the SCD and the secure storage;

decrypting, by the SCD, the secrets file using the secrets file encryption key to obtain a decrypted secrets file;

generating, using a n-bit generator on the SCD, the n-bit result using the decrypted secrets file;

enabling, by the SCD, at least the first I/O interface after the n-bit result is generated; and

providing by the SCD, after enabling the first I/O interface, the n-bit result to the application using the first I/O interface.

6. A secure containment device (SCD), comprising:

a first input/out (I/O) interface connected to a host system;

a second I/O interface connected to a secure storage;

a user interface;

a processor;

a memory comprising instructions, that when executed by the processor perform a method, the method comprising:

receiving a request to generate the n-bit result, wherein the request is sent from an application executing on the host system using the first I/O interface and wherein the request comprises a n-bit generator input;

disabling, by the SCD, the first I/O interface;

after disabling the first I/O interface between the host system and the SCD:

obtaining a user credential and a n-bit generator input by the SCD from a user, wherein the user credential is input by the user using a user interface on the SCD;

generating a secrets file name and a secrets file encryption key using the user credentials and the n-bit generator input;

obtaining a secrets file from the secure storage using the secrets file name, wherein the secrets file is obtained from the secure storage using the second I/O interface;

decrypting the secrets file using the secrets file encryption key to obtain a decrypted secrets file;

generating the n-bit result using the decrypted secrets file;

enabling the first I/O interface after the n-bit result is generated; and

providing, after enabling the first I/O interface, the n-bit result to the application using the first I/O interface.

7. A method for decrypting a file, comprising: receiving, by a secure island device (SID), an encrypted file from a host system using an input/output (I/O) interface and wherein a request comprises a n-bit generator input; disabling, by the SID, all interfaces on the SID; after disabling all the I/O interfaces on the SID: obtaining a user credential from a user by the SID, wherein the user credential is input by the user using a user interface on the SCD; generating a secrets file name and a secrets file encryption key using the user credentials and the n-bit generator input; obtaining a secrets file from secure storage, wherein the secrets file is obtained from the secure storage on the SID; decrypting the secrets file using the secrets file encryption key to obtain a decrypted secrets file; generating the decryption key using the decrypted secrets file and the n-bit generator; decrypting the encrypted file using the decryption key to obtain a decrypted file; presenting the decrypted file to the user on a user interface of the SID; removing all secure information from the SID; and enabling, after removing all secure information from the SID, the I/O interface.

8. The method of claim 7 , further comprising: after disabling all the I/O interfaces between the host system and the SID: generating a file on the SID; encrypting the file on the SID to obtain an encrypted file; and after enabling the I/O interface, providing the encrypted file to the application on the host system using the I/O interface.

9. The method of claim 8 , further comprising: after disabling all the I/O interfaces between the host system and the SID: generating a file on the SID; encrypting the filed on the SID using a second decryption key generated by the SID, to obtain an encrypted file; and after enabling the I/O interface, providing the encrypted file to the application on the host system using the I/O interface.

10. The method of claim 8 , wherein the secure information comprises all copies of the decrypted file located in volatile and non-volatile memory on the SID.

11. The method of claim 10 , wherein the secure information further comprises all copies of the secrets file name, the secrets file encryption key, the user credentials, and the n-bit generator input located in the volatile and non-volatile memory of the SID.

12. The method of claim 7 , wherein the SID is a tablet.

13. A non-transitory computer readable medium comprising instructions, which when executed perform a method, the method comprising: receiving, by a secure island device (SID), an encrypted file from a host system using an input/output (I/O) interface and wherein a request comprises a n-bit generator input; disabling, by the SID, all interfaces on the SID; after disabling all the I/O interfaces on the SID: obtaining a user credential from a user by the SID, wherein the user credential is input by the user using a user interface on the SCD; generating a secrets file name and a secrets file encryption key using the user credentials and the n-bit generator input; obtaining a secrets file from secure storage, wherein the secrets file is obtained from the secure storage on the SID; decrypting the secrets file using the secrets file encryption key to obtain a decrypted secrets file; generating the decryption key using the decrypted secrets file and the n-bit generator; decrypting the encrypted file using the decryption key to obtain a decrypted file; presenting the decrypted file to the user on a user interface of the SID; removing all secure information from the SID; and enabling, after removing all secure information from the SID, the I/O interface.

14. A secure island device (SID), comprising: an input/out (I/O) interface connected to a host system; a secure storage; a user interface; a processor; memory comprising instructions, when executed by the processor perform a method, the method comprising: receiving, by the secure island device (SID), an encrypted file from a host system using the input/output (I/O) interface and wherein a request comprises a n-bit generator input; disabling, by the SID, all interfaces on the SID; after disabling all the I/O interfaces on the SID: obtaining a user credential from a user by the SID, wherein the user credential is input by the user using a user interface on the SCD; generating a secrets file name and a secrets file encryption key using the user credentials and the n-bit generator input; obtaining a secrets file from the secure storage, wherein the secrets file is obtained from the secure storage on the SID; decrypting the secrets file using the secrets file encryption key to obtain a decrypted secrets file; generating the decryption key using the decrypted secrets file and the n-bit generator; decrypting the encrypted file using the decryption key to obtain a decrypted file; presenting the decrypted file to the user on a user interface of the SID; removing all secure information from the SID; and enabling, after removing all secure information from the SID, the I/O interface.