Methods and systems for protecting data in USB systems

A system comprising:

• a USB security module configured to process data associated with USB transfers;
• an encryptor associated with the module and configured to encrypt data from one or more USB devices that have been seized;
• and
• a decryptor associated with the module and configured to decrypt encrypted data that is intended for use by a seized USB device.

A USB Host Controller comprising:

• a security module configured to process data associated with USB transfers;
• an encryptor associated with the module and configured to encrypt data from one or more USB devices;
• a decryptor associated with the module and configured to decrypt encrypted data that is intended for use by a USB device;
• and
• a table having entries that indicate, on a device-by-device basis, where encryption and decryption is to be applied.

A USB Hub comprising:

• a security module configured to process data associated with USB transfers;
• an encryptor associated with the module and configured to encrypt data from one or more USB devices;
• a decryptor associated with the module and configured to decrypt encrypted data that is intended for use by a USB device;
• and
• a table having entries that indicate, on a device-by-device basis, where encryption and decryption is to be applied.

A method comprising:

• receiving data that is associated with a USB device;
• determining whether the received data is associated with a USB device that is intended to be secure;
• and
• if the USB device is intended to be secure, then encrypting or decrypting the data as appropriate.

A system comprising:

• means for processing data associated with USB transfers;
• means for encrypting data from one or more USB devices and being employable on a device-by-device basis;
• means for decrypting data that is intended for use by a USB device and being employable on a device-by-device basis;
• and
• said means for encrypting and means for decrypting being disposed at a location where there is no direct programmatic access by applications executing on a host computer.

A system comprising:

• one or more unsecure client applications;
• one or more secure client applications;
• an unsecure software stack comprising at least one driver that is not secure;
• a secure software stack comprising at least one driver that is secure;
• a USB host controller driver associated with the secure and unsecure software stack;
• the host controller driver being programmable to:
• route data to and from unsecure USB devices through the unsecure software stack for use by the one or more unsecure client applications;
• and
• route data to and from secure USB devices through the secure software stack for use by the one or more secure client applications.

A method comprising:

• determining whether an unsecure client application has focus;
• receiving encrypted data that is intended for use by a client application;
• and
• if the received data is intended for use by the unsecure client application and the unsecure client application has focus, then decrypting the encrypted data.

A method comprising:

• determining whether a secure or an unsecure client application has focus;
• if a secure client application has focus, instructing a USB host controller to apply encryption/decryption protection to data associated with the secure client application;
• and
• if an unsecure client application has focus, instructing the USB host controller to not apply encryption/decryption protection to data that is associated with the unsecure client application.

A method comprising:

• partitioning memory into protected and unprotected memory on a host computer;
• for USB devices that are secure, writing and reading data associated with such USB devices to and from the protected memory;
• and
• for USB devices that are not secure, writing and reading data associated with such USB devices to and from the unprotected memory.

A system comprising:

• a USB host controller;
• a table associated with the host controller and which indicates whether one or more USB devices are secure;
• and
• the host controller being configured to use the table and, if a USB device is indicated by the table as secure, copy data into and out of protected portions of memory that are associated with that USB device.

A system comprising:

• protected memory that is configured to be used in connection with secure USB devices;
• unprotected memory that is configured to be used with USB devices that are not secure;
• a USB host controller associated with the protected and unprotected memory;
• the host controller being configured to write and read data associated with secure USB devices to and from the protected memory;
• and
• the host controller further being configured to write and read data for USB devices that are not secure to and from the unprotected memory.

A method comprising:

• receiving a request from an application for a USB transaction;
• querying the application for a memory location that is to be the subject of the transaction;
• receiving a memory location indication from the application, the memory location indication comprising, in an event that the application is a secure application, an indication associated with protected memory;
• processing the memory location indication into a transaction description (TD);
• and
• processing the TD with a host controller effective to either copy in or copy out data relative to the protected memory location associated with the memory location indication.

A system comprising:

• a USB component assembly configured to:
• receive a request from an application for a USB transaction;
• query the application for a memory location that is to be the subject of the transaction;
• receive a memory location indication from the application, the memory location indication comprising, in an event that the application is a secure application, an indication associated with protected memory;
• process the memory location indication into a transaction description (TD);
• process the TD with a host controller effective to either copy in or copy out data relative to the protected memory location associated with the memory location indication.