External accessibility for computing devices
View Patent ↗Methods and apparati for permitting Computing Devices 200 to safely accept Payloads 220 from External Access Entity Devices 260 , and to safely access external Networks 710 . In an apparatus embodiment, a Computing Device 200 contains an Access Control Module 210 comprising an Access Verification Public Key 211 and a Device Signature Key 214 . The Access Control Module 210 is configured to verify authorization of an External Access Payload 220 by verifying a digital signature affixed to the Payload 220 using the Access Verification Public Key 211 . The authorized External Access Payload 220 is then permitted to execute on the Computing Device 200 . The Access Control Module 210 is also configured to receive from a Network Access Device 600 information associated with a Network 710 access request, and to create a plurality of digital signatures, using the Device Signature Key 214 , that link said information associated with the Network 710 access request with the Access Verification Public Key 211 . In some embodiments, an encryption/decryption key pair 291, 292 is associated with External Access Entity Device 260 to further enhance security.
1. A computing device operated by a user of the computing device, said computing device comprising:
a verification public key;
an access control module configured to authorize an external access entity to access a cryptographic module located within the computing device, wherein:
said authorization comprises verifying a digital signature affixed by the external access entity using the verification public key;
the external access entity is not the user and is not a module executing on the computing device;
the cryptographic module is configured to use one or more communication encryption keys for encrypted communications with other devices; and
the cryptographic module is configured to provide access to the one or more communication encryption keys to an external access entity authorized by the access control module for a specified amount of time, and said cryptographic module is further configured to discontinue the access to any of said communication encryption keys after the specified amount of time expires;
said computer device further comprising an access archive module configured to record any authorized access of the cryptographic module by an external access entity, wherein a record stored in the access archive module cannot be modified or deleted by an authorized external access entity; and
the access archive module is further configured to output recorded information pertaining to authorized access by an external access entity.
2. The computing device of claim 1 , where said access control module is further configured to:
receive from a network access device information associated with a network access request lodged by the computing device; and
create a plurality of digital signatures, using a signature key of the computing device, linking said information associated with the network access request with the verification public key, whereby granting the network access request is facilitated.
3. A method for providing authorized access to communication encryption keys used in a computing device, said method comprising the steps of the computing device:
using communication encryption keys in a cryptographic module located within the computing device;
receiving a request from an external access entity to access at least one of the communication encryption keys, wherein said request comprises a digital signature not created on the computing device;
validating the digital signature of the external access entity request using a public verification key embedded in the computing device;
providing the external access entity with access to the requested one or more communication encryption keys when the digital signature has been validated;
discontinuing the external access entity access to any of said communication encryption keys after a specified amount of time expires; and
recording information contained in the validated external access entity request in a record that cannot be deleted or modified by the external access entity.