Patent Publication Number: US-2010115116-A1

Title: System and method for switching communication protocols in electronic interface devices

Description:
TECHNICAL FIELD 
     Embodiments of the present invention relate generally to electronic interface devices that can communicate with a host, such as a personal computer system. 
     BACKGROUND OF THE INVENTION 
     Chip cards or integrated circuit cards, both of which are commonly known as smart-cards, TPM (trusted platform Module) ICs, or the like, are devices with an embedded integrated circuit, such as a processor and a non-volatile memory device. The memory device may be, for example, a flash memory device and/or an EEPROM (electrically erasable programmable read-only memory) or the like. The memory device may store user data, and it may store an operating system for the processor as well as smart-card applications, such as electronic banking applications, telephone applications in the case of SIM (subscriber identity module) smart-cards, or the like. The memory device may also store user authentication protocols, which may be used, for example, to allow an authorized individual to log onto a secure network, such as an Ethernet network, or an operating system, such as Windows.® Such devices are commonly known as “tokens.” The memory device may also store personalization data, such as telephone or bank account data or the like, user data, such as financial data or the like, private data, certificates or signatures used in various encryption techniques, etc. User data may be protected using a PIN (personal identification number) or a password as an access control measure. In order to access the protected data stored in the card&#39;s memory device, a user must be authenticated by providing the correct PIN or password. 
     One example of an electronic interface device user authentication protocol that allows logging onto a network or operating system is a smart-card based device or similar interface device having a universal serial bus (“USB”) interface. If the host is configured to use the interface device for operating system or network logon, the host will communicate with the interface device when the interface device is connected to the host. In such case, it will be necessary for the host to include a CCID driver, which is a driver used in some operating systems. For example, Windows Vista® does include a CCID driver, but earlier versions of Windows,® such as Windows XP,® do not include a CCID driver. 
     The host may also run a client application that performs certain functions. The client application may be, for example, stored in the host, stored in the interface device and downloaded to the host, or downloaded through a network. The function performed by the client application may include user authentication to access protected storage and various Public Key Infrastructure (“PKI”) such as PKCS #11 functions that do not necessarily require CCID driver. 
     If the interface device is used for operating system or network logon, it will generally enumerate as a CCID-type device and as a mass storage device. As is well-known in the art, enumeration is a process by which an electronic device interfacing with another electronic device defines certain of its operating characteristics used in attempting to communicate with the other device. If the host has a CCID driver installed, it will then communicate with the interface device and prompts user to enter his logon credentials. Once the authentication is successful and the user is logged on, the mass storage of the interface device will be mounted on the host and protected and unprotected storage will be available. In another embodiment, after successful authentication to the host, the client application will prompt user to enter his credentials to access the protected storage. 
     If an application running on the host detects the lack of a CCID driver in the host, the host will then issue a command for the user to install a CCID driver. If a CCID driver is not available or the user does not have the necessary permission to install it, the interface device may not be used with the host. Therefore, functions that do not require a CCID driver, such as protected storage, will not be available since the interface device uses the same CCID driver to authenticate user to access protected storage. As a result, these USB interface devices cannot be used with a host that does not contain a CCID driver. This limitation reduces the usefulness of these USB interfaces devices outside of, for example, a corporate network in which they are normally used. For example, the user may want to use the interface device as simply an external memory device to transfer data between the interface device and a host. Similar problems also exist for other interface devices performing authentication functions that do not contain all of the components of a smart-card, but instead contain only communications support, non-volatile memory and a simple processor or controller. 
     There is therefore a need for an interface device that is capable of interfacing with hosts using a greater variety of communications protocols. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of an electronic interface device according to one embodiment of the invention. 
         FIG. 2  is a flow chart of an embodiment of an application running on the electronic interface device of  FIG. 1  or a host that may be used with the electronic interface device of  FIG. 1 . 
         FIG. 3  is a flow chart showing the manner in which an embodiment of the electronic interface device of  FIG. 1  switches from using a CCID protocol to using a HID protocol. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  is a block diagram of an electronic interface device  100  according to one embodiment of the invention. A central processing unit (“CPU”)  105  is embedded in the interface device  100 , and it may include a processor  110  and an integrated random access memory (“RAM”)  120 , a non-volatile memory  115 , such as an EEPROM or flash memory, and a read-only memory (“ROM”)  125 . The processor  110  may include a cryptography engine  126 , such as an advanced encryption system (“AES”), as a portion of access control circuitry of CPU  105 , that can perform AES protocols, user authentication protocols, such as Public Key Infrastructure (“PKI”) authentication, encryption and decryption of data, etc. An input/output interface  127  is in communication with the CPU  105  and may be a USB (universal serial bus) interface for connecting directly to a host  118 , such as a personal computer, a contactless interface, an ISO 7816 interface for use with an ISO 7816 card reader, etc. The ROM  125  typically stores the operating system of the interface device  100 . The interface device  100  may also include a file management system  130  that may be used to manage the address space of the non-volatile memory  115 , and a key management system  135  for managing and storing one or more encryption and/or decryption keys, such as one or more AES encryption and/or decryption keys or the like. The non-volatile memory  115  or the key management system  135  may store private keys, certificates that may include public keys as part of public/private key encryption, applications, such as electronic banking applications, telephone applications, etc. The non-volatile memory  115  may further include upgrades or patches for the interface device operating system. 
     Although the electronic interface device  100  includes all of the components shown in  FIG. 1 , other embodiments of an electronic interface device may dispense with many of these components as long as the device has a non-volatile memory, a communications interface of some type for communicating with a host, and a controlling device to control the operation of the electronic interface device, such as a processor, controller or the like. Also, of course, embodiments of the electronic interface device may include components in addition to or in place of the components used in the embodiment of the electronic interface device  100  of  FIG. 1 . 
     During operation of the electronic interface device  100 , the device is placed in communication with a host  118  via a communications interface, such as a USB port. The electronic interface device  100  may then pass authentication data, such as PIN, password or other authentication identifier, to the host  118 . The electronic interface device  100  thus indicates to the host  118  that the user is either authenticated or not authenticated. After user authentication, the host  118  logs the user onto the host and/or onto a network that is connected to the host. Alternatively, the host  118  may cause an operating system to load. For example, if the host  118  is a personal computer system, the host may not load the operating system for the system until the user has been authenticated. The electronic interface device  100  may also be used in connection with a client application running on the host  118 . The client application may also provide the user with access to protected data, may decrypt the data using the cryptography engine  126  and an encryption key stored in the key management system  135 . Additionally or alternatively, authentication may allow the user to securely sign e-mails using, for example, a public key encryption system. 
     Unlike conventional electronic interface devices performing user authentication, the electronic interface device  100  is able to dynamically alter the communications protocol that it uses to communicate with the host  118 . The electronic interface device  100  may be placed in communication with a host  118  that is equipped with a CCID driver. As shown in  FIG. 2 , after the host  118  has powered up at  140 , a client application running on the host  118  or the electronic interface device  100  may determine at  144  whether the electronic interface device  100  is attempting to communicate using a HID protocol. Insofar as the electronic interface device has enumerated using the CCID protocol, the operation branches from  148  to  150  where the application checks to determine if the host  118  is equipped with a CCID driver. If so, the application program branches to  154  where communication between the host  118  and the electronic interface device  100  proceeds using the CCID protocol. This is the normal path followed if the electronic interface device  100  is interfacing with a host  118  containing a CCID driver. If, however, if the application determines at  144  that the host  118  is not equipped with a CCID driver, the application branches to  156  where it passes a command to the electronic interface device to disconnect and re-enumerate using the HID protocol. This can be accomplished by the host passing one or more commands to the electronic interface device  100 . The application is also closed at  160 . The electronic interface device  100  will then re-enumerate as an HID device, and the application will then determine at  148  that the host  118  is now using the HID protocol. The application therefore branches to  164  where it causes the communication between the host  118  and the electronic interface device  100  to commence using the HID protocol. The electronic interface device  100  may then be used as a mass storage device and possibly for other functions such as protected data storage, although it may not be able to use the PKI features of the device  100 . Thus, unlike conventional electronic interface devices, the electronic interface device  100  is able to enumerate as a CCID device to take advantage of PKI authentication features, yet is able to switch to the HID protocol if the host  118  is not equipped with a CCID driver. The interface device  100  can then be used as a mass storage device. Therefore, unlike conventional electronic interface devices, the electronic interface device  100  can still be used even if a CCID driver is not available in the host  118 . 
     One embodiment of the operation of the electronic interface device  100  when interfacing with a host  118  is shown in  FIG. 3 . After the device  100  powers up at  170 , it enumerates as a CCID device at  174 , as explained above with reference to  FIG. 2 . The electronic interface device then monitors communications with the host  118  at  178  to detect at  180  a command by the host  118  to switch to the HID protocol. As previously explained with reference to  FIG. 2 , the host  118  provides this command at  156  if the application running on the host  118  or device  100  has determined at  150  that the host  118  is not equipped with a CCID driver. In response to receiving the command from the host  118 , the electronic interface device  100  re-enumerates as a HID device equipped with a mass storage device at  184 . The electronic interface device then implements a soft disconnect from the host  118  at  184  and re-enumerates as a HID device equipped with a mass storage device. The electronic interface device  100  may then be used with a host  118  that does not have a CCID driver, as explained above with reference to  FIG. 2 . 
     From the foregoing it will be appreciated that, although specific embodiments of the invention have been described herein for purposes of illustration, various modifications may be made without deviating from the spirit and scope of the invention. For example, although the electronic interface device embodiment shown in  FIG. 1  uses a USB port to interface with a host, other types of communication interfaces, such as communications ports and/or communication links, may be used. Also, the description of the electronic interface device embodiment shown in  FIG. 1  describes the use of a personal computer as the host, the host may be another type of electronic interface device such as a smart-card reader, a bank teller machine, or a security system, to name a few. Accordingly, the invention is not limited except as by the appended claims.