Protecting computers using an identity-based router

1. An apparatus for authenticating, a peripheral device to a computer when the apparatus is interposed between the peripheral device and the computer, the apparatus comprising:

a first hardware interface capable of transmitting data to, and receiving data from, the computer first;

a second hardware interface capable of transmitting data to, and receiving data from, the peripheral device, the peripheral device having a unique identifier;

a third hardware interface capable of transmitting data to, and receiving data from, an authentication service;

a memory in which is stored a set of unique identifiers; and

a processor coupled to the first, second, and third interfaces and to the memory, the processor being configured to:

(i) receive the unique identifier, a cryptographic nonce, and encrypted data from the peripheral device using the second interface,

(ii) transmit the unique identifier to the authentication service using the third interface,

(iii) receive, from the authentication service using the third interface, a decryption key associated with the unique identifier,

(iv) decrypt the encrypted data using the decryption key to form decrypted data, and (v) permit transmission of data from the second interface to the first interface, when simultaneously (1) the decrypted data comprise the cryptographic nonce and (2) the received unique identifier is contained in the set of unique identifiers stored in the memory;

wherein the peripheral device has a network address, and wherein the processor is further configured to:

(vi) receive input data and the network address from the first hardware interface,

(vii) transmit the network address to the authentication service using the third hardware interface,

(viii) receive, from the authentication service using the third interface, an encryption key associated with the network address,

(ix) encrypt the input data using the encryption key, and

(x) transmit the encrypted data to the network address of the peripheral device using the second hardware interface.

2. An apparatus according to claim 1 , wherein the first hardware interface includes a computer network interface.

3. An apparatus according to claim 1 , wherein the second hardware interface includes a USB interface, a Bluetooth interface, or a wireless near-field communication interface.

4. An apparatus according to claim 1 , wherein the third hardware interface includes a computer network interface.

5. An apparatus according to claim 1 , wherein the authentication service includes an identity service remote from the computer.

6. An apparatus according to claim 1 , wherein the unique identifier includes a network address.

7. An apparatus according to claim 1 , wherein the decryption key is contained in a digital certificate.

8. An apparatus according to claim 1 , wherein the computer is configured to prevent an executing software application from using any input data unless those input data are received from the first interface.

9. An apparatus according to claim 1 , wherein the peripheral device comprises a keyboard, a computer mouse, or an external storage device.

10. A method of authenticating, a peripheral device to a computer using an apparatus interposed between the peripheral device and the computer, to a first device, a second device transmitting data to the first device, using an apparatus coupled to both devices, the method comprising:

receiving, in the apparatus, from the peripheral device, input data, a unique identifier, a cryptographic nonce, and encrypted data;

transmitting the unique identifier from the apparatus to an authentication service; receiving, in the apparatus, from the authentication service, a decryption key associated with the unique identifier;

decrypting the encrypted data using the decryption key to form decrypted data; and permitting transmission of data from the peripheral device to the computer, when simultaneously (1) the decrypted data comprise the cryptographic nonce and (2) the received unique identifier is contained in a set of unique identifiers that is stored in the apparatus;

wherein the peripheral device has a network address, further comprising

receiving input data and the network address from the computer,

transmitting the network address to the authentication service,

receiving, from the authentication service, an encryption key associated with the network address,

encrypting the input data using the encryption key, and

transmitting the encrypted data to the network address of the peripheral device.

11. A method according to claim 10 , wherein the authentication service includes an identity service remote from the computer.

12. A method according to claim 10 , wherein the unique identifier includes a network address.

13. A method according to claim 10 , wherein the decryption key is contained in a digital certificate.

14. A method according to claim 10 , wherein the computer is configured to prevent an executing software application from using any input data unless those input data are received from the first interface.

15. A method according to claim 10 , wherein decrypting includes decrypting according to an encryption scheme that uses public and private keys.

16. A method according to claim 10 , further comprising notifying the computer about an unauthorized access attempt when either (1) the decrypted data do not comprise the cryptographic nonce or (2) the received unique identifier is not contained in the set of unique identifiers that is stored in the apparatus coupled to both devices.

17. A method according to claim 10 , wherein the peripheral device comprises a keyboard, a computer mouse, or an external storage device.