Secure computer peripheral devices
A method for improving security of peripheral devices is described. In one embodiment, the method includes sending, by a processor of a peripheral device, at least one packet of data to an operating system of a computing device, identifying, by the processor, execution of a software application on the computing device, performing, by the processor, a handshake protocol between the secure input device and the software application based at least in part on the execution of the software application, and establishing, by the processor, a secure session over a secure channel between the secure input device and the software application based at least in part on the handshake protocol. In some cases, the at least one packet of data identifies the peripheral device to the operating system as two or more peripheral devices such as a default input device and a secure input device.
1. A method for improving security of peripheral devices, further comprising:
sending, by a processor of a peripheral device, at least one packet of data to an operating system of a computing device, the at least one packet of data identifying the peripheral device to the operating system as two or more peripheral devices, the at least one packet of data identifying the peripheral device at least as a default input device and a secure input device;
identifying, by the processor, execution of a software application on the computing device;
performing, by the processor, a handshake protocol between the secure input device and the software application based at least in part on the execution of the software application; and
establishing, by the processor, a secure session over a secure channel between the secure input device and the software application based at least in part on the handshake protocol.
2. The method of claim 1 , wherein at least one of the peripheral device and the software application generates a session key for the secure session.
3. The method of claim 2 , further comprising:
encrypting data generated from input received by the peripheral device based at least in part on the session key; and
communicating the encrypted data over the secure channel between the secure input device and the software application, wherein the software application is a predetermined software application.
4. The method of claim 2 , further comprising:
encrypting the session key using a public encryption key, wherein at least one of the peripheral device and the software application includes a private encryption key to decrypt the encrypted session key, and wherein the private encryption key is provisioned on the peripheral device at a time of manufacturing when the peripheral device includes the private encryption key.
5. The method of claim 1 , wherein performing the handshake protocol includes displaying a code, receiving a user input after displaying the code, comparing the user input to the displayed code, and enabling the establishing of the secure session based at least in part on a result of comparing the user input to the displayed code.
6. The method of claim 5 , wherein the code is displayed on a portion of a user interface of the software application or a display on the peripheral device, or both.
7. The method of claim 1 , further comprising:
upon establishing the secure session and while the software application controls focus of the operating system, implementing a secure driver associated with the secure input device and halting communications with a default driver associated with the default input device; and
upon terminating the software application or upon the software application losing the focus, re-enabling communications with the default driver associated with the default input device and disabling the secure driver associated with the secure input device.
8. The method of claim 7 , wherein the secure driver bypasses the operating system and communicates data directly between the software application and the secure input device.
9. The method of claim 1 , wherein the at least one packet of data includes a first identifier for the default input device and a second identifier for the secure input device, and wherein the operating system addresses communication to the default input device based at least in part on the first identifier, and wherein the software application addresses communication to the secure input device based at least in part on the second identifier.
10. The method of claim 1 , wherein the peripheral device includes a universal serial bus (USB) peripheral device connected to the computing device.
11. A peripheral device configured for improving security of peripheral devices, comprising:
a processor;
memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable by the processor to:
sending, by a processor of a peripheral device, at least one packet of data to an operating system of a computing device, the at least one packet of data identifying the peripheral device to the operating system as two or more peripheral devices, the at least one packet of data identifying the peripheral device at least as a default input device and a secure input device;
identifying, by the processor, execution of a software application on the computing device;
performing, by the processor, a handshake protocol between the secure input device and the software application based at least in part on the execution of the software application; and
establishing, by the processor, a secure session over a secure channel between the secure input device and the software application based at least in part on the handshake protocol.
12. The computing device of claim 11 , wherein at least one of the peripheral device and the software application generates a session key for the secure session.
13. The computing device of claim 12 , wherein the instructions are executable by the processor to:
encrypting data generated from input received by the peripheral device based at least in part on the session key; and
communicating the encrypted data over the secure channel between the secure input device and the software application, wherein the software application is a predetermined software application.
14. The computing device of claim 12 , wherein the instructions are executable by the processor to:
encrypting the session key using a public encryption key, wherein at least one of the peripheral device and the software application includes a private encryption key to decrypt the encrypted session key, and wherein the private encryption key is provisioned on the peripheral device at a time of manufacturing when the peripheral device includes the private encryption key.
15. The computing device of claim 11 , wherein performing the handshake protocol includes displaying a code, receiving a user input after displaying the code, comparing the user input to the displayed code, and enabling the establishing of the secure session based at least in part on a result of comparing the user input to the displayed code.
16. The computing device of claim 15 , wherein the code is displayed on a portion of a user interface of the software application or a display on the peripheral device, or both.
17. The computing device of claim 11 , wherein the instructions are executable by the processor to:
upon establishing the secure session and while the software application controls focus of the operating system, implementing a secure driver associated with the secure input device and halting communications with a default driver associated with the default input device; and
upon terminating the software application or upon the software application losing the focus, re-enabling communications with the default driver associated with the default input device and disabling the secure driver associated with the secure input device.
18. The computing device of claim 17 , wherein the secure driver bypasses the operating system and communicates data directly between the software application and the secure input device.
19. A computer-program product for improving security of peripheral devices, the computer-program product comprising a non-transitory computer-readable medium storing instructions thereon, the instructions being executable by a processor to:
sending, by a processor of a peripheral device, at least one packet of data to an operating system of a computing device, the at least one packet of data identifying the peripheral device to the operating system as two or more peripheral devices, the at least one packet of data identifying the peripheral device at least as a default input device and a secure input device;
identifying, by the processor, execution of a software application on the computing device;
performing, by the processor, a handshake protocol between the secure input device and the software application based at least in part on the execution of the software application; and
establishing, by the processor, a secure session over a secure channel between the secure input device and the software application based at least in part on the handshake protocol.
20. The computer-program product of claim 19 , wherein at least one of the peripheral device and the software application generates a session key for the secure session.