Automatic data encryption and access control based on bluetooth device proximity

Method and system for protecting blue bud equipment

The present invention relates to wireless security, and more specifically, to a method and system for protecting Bluetooth devices. The invention is particularly suitable for a system that encrypts sensitive data on a Bluetooth device when the device is no longer in the vicinity of another trusted Bluetooth device.

More and more personal information is stored on smaller and more mobile devices. If one of these devices is misplaced, it may endanger the security of sensitive information about identities, access codes, or business information. This risk increases with the amount of information they can store and their widespread use. Requiring to enter a security code or password is a partial solution, but the effectiveness of this solution is reduced to such an extent: due to inconvenience, the device stays in an unlocked state or the security feature using this feature cannot be executed.

For those of ordinary skill in the art, comparing such a system with certain aspects of the present invention as described in the remainder of this application with reference to the accompanying drawings, the more limitations and deficiencies of conventional and traditional methods will change. Obviously.

The present invention relates to a method and system for protecting data stored on a Bluetooth device. For example, it is fully described in conjunction with at least one drawing, and is more fully described in the claims.

According to one aspect of the present invention, there is provided a method for protecting a Bluetooth device, including: pairing two Bluetooth devices; designating at least one of the paired devices as a trusted device of the other device, that is, the protected device; and designating that at least a part is stored in The data on the protected device is sensitive information; it is detected when the trusted device is no longer in the vicinity of the protected device; when the trusted device is no longer in the vicinity of the protected device, the sensitive data is encrypted, and when it is detected When the trusted device is in the vicinity of the protected device, decrypt the sensitive data.

Preferably, the method further includes encrypting the sensitive data after the timer expires.

Preferably, when the trusted device is no longer in the vicinity of the protected device, the protected device is locked.

Preferably, the protected device is paired with more than one trusted device.

Preferably, the protected device is also a trusted device.

Preferably, the trusted device is also a protected device.

Preferably, the protected device specifies different sensitive data for each of the plurality of trusted devices.

According to one aspect of the present invention, a system for protecting data on a Bluetooth device is provided, including two paired Bluetooth devices, wherein the first of the devices is designated as a trusted device, and the second of the devices is designated as a trusted device. Each contains sensitive data, and when the first one of the devices leaves the neighbor of the second one of the devices, the second device of the devices encrypts the sensitive data.

Preferably, after the timer expires, the second one of the device encrypts the data.

Preferably, when the first one of the devices is no longer in the second neighbor of the device, the second one of the devices is locked.

Preferably, the system further includes additional trusted and protected equipment.

Preferably, the second one of the devices is also a trusted device.

Preferably, the first one of the devices is also a protected device.

Preferably, the second one of the devices is paired with at least one more device than the first one of the devices.

Preferably, the second one of the devices includes the at least one or more devices and separate sensitive data of the first one of the devices.

According to one aspect of the present invention, there is provided an integrated circuit including an application layer, and the application layer executes a method including the following steps: pairing two Bluetooth devices; specifying at least one of the paired devices as The other device is the trusted device of the protected device; designate at least a part of the data stored on the protected device as sensitive information; detect when the trusted device is no longer in the vicinity of the protected device; when the trusted device is no longer there Encrypting the sensitive data when the neighbor of the protected device is the neighbor; when detecting that the trusted device is the neighbor of the protected device, decrypt the sensitive data.

Preferably, the integrated circuit further delays the encryption of sensitive data until the timer overflows.

Preferably, the integrated circuit incorporates a dedicated security fob.

Preferably, the integrated circuit is paired with the additional trusted device.

Preferably, the integrated circuit designates different sensitive data for each of the trusted devices.

Preferably, the integrated circuit is also designated as a trusted device.

From the following description and drawings, these and other advantages, aspects and novel features of the present invention, as well as the details of the exemplary embodiments thereof, will be more fully understood.

The embodiment of the present invention relates to a method and system for detecting the neighbors of a Bluetooth device. The embodiment of the present invention relates to a method and system for locating the neighbors of a Bluetooth device and exchanging keys. Another embodiment is to encrypt data or lock the device when the trusted device no longer exists.

Bluetooth wireless technology does not require a wired connection, so it can be used to reform personal connections. Bluetooth is a standard for miniaturized, low-cost wireless solutions that provide links between portable computers, mobile phones, and other portable and handheld devices. Bluetooth is characterized by low power consumption and small range, as well as the ability of Bluetooth devices to automatically detect and connect to other nearby Bluetooth devices, usually 10 meters or less.

About Bluetooth

Bluetooth wireless technology is an international open standard that allows smart devices to communicate with each other through wireless, short-range communications. This technology allows any type of electronic devices-from computers and cellular phones to keyboards and headsets-to establish their own connections, without the need for connecting wires, cables, and any other direct actions from the user. Bluetooth is currently integrated into many consumer products, including laptops, PDAs, cellular phones, and printers, as well as more products appearing every day.

How does Bluetooth work

Bluetooth is a frequency hopping spread spectrum (FHSS) radio frequency system operating in the 2.4GHz license-free frequency band. Its low power transmission can be used for a typical range of about ten meters. The connected devices form a known piconet, and there are up to seven active devices in the network. FIG. 1 shows a piconet 101 including three Bluetooth devices, namely a headset 103, a laptop computer 105, and a cellular phone 107. Devices in the piconet share data capacity, and the maximum data throughput between devices is approximately 723 kilobits per second.

Bluetooth has a protocol stack for transferring data and implementing advanced features required by applications. The protocol stack includes several different protocols designed for different purposes. The profile or application is located on the protocol stack. Bluetooth also has a low-level protocol stack for link management and baseband control. Figure 2 is a simplified typical protocol stack 201. The stack includes specification 203, BTM 205, RFCOMM 207, SDP 209, L2CAP 211, HCI 213, and low-level stack 215. The application layer 217 includes a computer program that actually executes an advantageous method of utilizing the Bluetooth function.

Bluetooth hardware devices are usually highly integrated systems that include one or two chips. FIG. 3 is a block diagram of a typical Bluetooth hardware device. The Bluetooth hardware device includes a radio frequency IC 303 and a baseband IC 305.

The Bluetooth baseband chip includes core processors such as ARM7 307 with integrated memory, Bluetooth baseband 309 and several other peripheral devices. The radio frequency is realized on a single chip 303. The ARM7 processor runs all required software including low-level protocol stacks, upper-level protocol stacks and embedded specifications. This type of single CPU device allows for small, low-power and low-cost solutions.

The software "stack" is expected to insert useful applications at the top of the stack. These applications can be designed to use Bluetooth low-level, Bluetooth-based RF links to achieve functions.

The short-range nature of the Bluetooth wireless network allows it to be used for device proximity detection. Based on the appearance and disappearance of the device, sensitive data on handheld devices or desktop computers can be automatically encrypted without user intervention. Encrypt and decrypt sensitive data based on whether you trust the Bluetooth devices neighbors or not. Establish a trust relationship by using the device pairing program to exchange the Bluetooth link code and clearly mark the device as trustworthy. Once such a relationship is established, sensitive data is automatically encrypted and decrypted based on the availability of trusted devices. Trusted devices can include cellular phones, desktop computers, laptops, or special devices such as Bluetooth keychains. The device performs regular Bluetooth scanning to detect trusted devices in the area. If no equipment is detected, the data on the file area marked as sensitive will be automatically encrypted after the timing overflow. Once the trusted device is close, the data is automatically decrypted and ready to be viewed/edited by the user. Optionally, when no trusted device is found, the device can lock access.

The method according to the present invention can be extended to bluetooth desktop devices. In addition, a certain file area can be marked as sensitive. Bluetooth software performs regular scans for trusted personal devices such as cellular phones, personal data assistants, or Bluetooth key chains. If no trusted device is found, sensitive data is automatically encrypted and the screen is optionally closed by the user. This allows the user to leave his desk and let the desktop computer automatically lock until he or she comes back.

The present invention can be fully integrated into an integrated circuit, such as a Bluetooth chip. The chip has a machine-readable memory on which is stored a computer program with a code part for detecting the vicinity of the Bluetooth device. The program includes at least one code portion, which can be executed by a machine to cause the machine to execute the steps including fully as shown and described below.

The integrated circuit of the present invention may further include an application layer that executes the method according to the present invention. The integrated circuit is best connected to the Bluetooth radio frequency. The integrated circuit can also have a unique hardware identifier.

The Bluetooth standard specifies a pairing program that allows one device to associate itself with another device. The pairing procedure is described in detail in the Bluetooth 1.2 Core Standard, Volume 3, and Section 3.3.

In a typical embodiment, the system uses at least two devices. Initially, the devices are not paired. Once the devices are close to each other, the user can allow them to associate with each other. Once paired, a method consistent with the invention can be used to mark the paired device as a trusted device. Then each device recognizes the other device as a trusted device. Once this association is established, whenever the absence of a trusted device is detected, the software of each device can be used to lock the device or encrypt the specified file. Any Bluetooth device can be a trusted device and/or a protected device. For example, the cellular phone 107 may be a trusted device of the protected device, that is, the laptop 105. The headset 103 may be a trusted device of the protected device, that is, the cellular phone 107.

The logic flow of a method of the present invention is described in conjunction with FIG. 4, and FIG. 4 shows the typical steps of the present invention in the form of a flowchart from the perspective of the protected device. First, the user selects a preferred "Bluetooth" password or trusted device in step 401. Next, in step 403, the protected device and the trusted device are paired. In step 405, at a time interval selected for power consumption or safety, it is determined whether the trusted device is still in range by using a Bluetooth inquiry scan. Step 407 determines whether the trusted device appears according to the result of the query scan. If the trusted device is present, in step 409, the sensitive area selected for the specific trusted device is decrypted, and optionally, the protected device is unlocked. If the trusted device does not appear, the program branches to step 411, where sensitive data is encrypted, and optionally, the device is locked. Step 413 is a delay timer, which is used to prevent excessive power consumption caused by too frequent query scanning before the encryption/decryption loop. It is believed that the too frequent scanning may occur when the device establishes a communication edge with the protected device. . Then control returns to step 405.

It should be understood that one advantage of this and other methods according to the present invention is that when the trusted device is not present, the protected device does not need to be completely disabled. Therefore, the cellular phone 107 can continue to be used without the headset 103. However, although the person borrowed from the cellular phone 107 makes a call, he cannot access the personal phone book of the owner such as the cellular phone 107 without the headset.

The following code illustrates an example of a software program that implements one or more embodiments of the present invention in a Bluetooth device. The following code encrypts sensitive memos based on whether a trusted Bluetooth device is in the neighborhood: //BlueMemoCEDlg.cpp: implementation file #include "stdafx.h" #include "BlueMemoCE.h" #include "BlueMemoCEDlg.h" #ifdef_DEBUG #define new DEBUG_NEW #undef THIS_FILE static char THIS_FILE[]=_FILE_; #endif #define TIMER_SCAN 4711 HWND gm_hDialog; //////////////////////////// ///////////////////////////////////////CBlueMemoCEDlg dialog CBlueMemoCEDlg:: CBlueMemoCEDlg(CWnd^＊pParent/^＊=NULL^＊/) :CDialog(CBlueMemoCEDlg::IDD,pParent) {//{{AFX_DATA_INIT(CBlueMemoCEDlg) //}}AFX_DATA_INIT m_hIcon=AfxGetApp()->LoadIcon(IDR_MAINFRAME); m_pWBtAPI=NULL; m_pWBtAPI=NULL; m_pWBtAPI=NULL; } CBlueMemoCEDlg::~CBlueMemoCEDlg() {delete m_pWBtAPI; m_pWBtAPI=NULL;} void CBlueMemoCEDlg:: DoDataExchange(CDataExchange^＊pDX) {CDialog:: DoDataExchange(pDX); //{{AFX_DATA_MAP(CBlueMemoCEDlg) DDX_Control(pDX,IDC_MEMO,m_cMemo); //}}AFX_DATA_MAP} BEGIN_MESSAGE_MAP(CBlueMemoCEDlg,CBlueDialog(TIMER) ON ) ON_REGISTERED_MESSAGE(WIDCOMM_WM_DISCOVER YEVENT,OnDiscoveryEventMsg) ON_REGISTERED_MESSAGE(WIDCOMM_WM_DEVICELOST,OnDeviceLost) //))AFX_MSG_MAP END_MESSAGE_MAP() ///////////// ///////////////////////////////////////CBlueMemoCEDlg message handlers BOOL CBlueMemoCEDlg:: OnInitDialog() {CDialog:: OnInitDialog(); SetIcon(m_hIcon,TRUE); //Set big icon SetIcon(m_hIcon,FALSE); //Set small icon CenterWindow(GetDesktopWindow()); //center to hpc screen gm_hDialog=this->GetSafeHwnd(); m_bDeviceFound=TURE; SetMemoState(); SetTimer(TIMER_SCAN, 50, NULL); return TURE;} void CBlueMemoCEDlg:: OnTimer(UINT nIDEvent) {switch(nIDEvent) {case TIMER_SCAN: ScanForDevice (); break; defaule: break;} CDialog:: OnTimer(nIDEvent);} BOOL CBlueMemoCEDlg:: InitBluetooth() { BOOL bRet=TRUE; if(NULL=m_pWBtAPI) {WBtRc rc=WBT_ERROR; m_pWBtAPI=new CWBtAPI; rc=m_pWBtAPI->ConnectToServer(); bRet=(rc==WBT_SUCCESS); if(bRet) {m_pWBtAPI->Callback(bRet) {m_pWBtAPI-> cbDiscoveryEvent,this); m_pWBtAPI->SetOnDeviceLostCallback(cbDeviceLost,this);}} return bRet;} void CBlueMemoCEDlg:: ScanForDevice() {KillTimer(TIMER_SCAN); if(!InitBluetooth()) {m_bDeviceM=FALSE); SetTimer(TIMER_SCAN,3000,NULL); Return;} //Hard coded device address for now.This should be //selected from the paired devices list by the user. BD_ADDR bda={0x00,0x0A,0xD9,0x5D,0x26,0x45}; GUID guid; static const GUID sBTBaseGUID={0,0,0x1000,0x80,0x00,0x00 ,0x80,0x5F,0x9B,0x34,0xFB}; memcpy(&guid,&sBTBaseGUID,sizeof(GUID)); guid.Data1=0x1101; WBtRc rc=m_pWBtAPI->GapStartServiceDiscovery(=bda,guid,TRUE); if(rc) WBT_SUCCESS) {AfxMessageBox(_T("Unable to startservice discovery!"));}} Void CBlueMemoCEDlg::cbDiscoveryEvent(void^＊pUserDate,BD_ADDR bda,UINT16 nRecs,long lResultCode) {class CDiscoveryEventPackage^＊pPackage=new CDiscoveryEventPackage; pPackage->m_pItemData=pUserData; memcpy(pPackage->m_bda,bda,sizeof(BD_ADDR)); pPackage->m_nRecs=nRecs; pPackage->m_lReturnCode=lResultCode=lResultCode0DialogMessage,WCOVERCode0 ,(LPARAM)pPackage);} void CBlueMemoCEDlg:: cbDeviceLost(void^＊pUserData,BD_ADDR bda) {BD_ADDR dev_bda={0x00,0x0A,0xD9,0x5D,0x26,0x45}; :: PostMessage(gm_hDialog,WIDCOMM_WM_DEVICELOST,0,0);} LRES CBlueMemoCPackMemoCEDRAMEventPargDiscoveryEventParg:OnageDiscoveryEvent: OnParg: On^＊pPackage=(CDiscoveryEventPackage^＊)lParam; if(pPackage && pPackage->m_nRecs) {m_bDeviceFound=TRUE; }else{ m_bDeviceFound=FALSE; SetTimer(TIMER_SCAN,3000,NULL);} SetMemoState(); Return 0;} LRESULT CBlueMemoCEDlg:: OnDeviceLam( ,LPARAM lParam) {SetTimer(TIMER_SCAN,3000,NULL); SetMemoState(); return 0;} inline BYTE GetHexDigit(TCHAR c) {return(_istalpha(c))? (10+toupper(c)-T('A')): (c-_T('0'));} void CBlueMemoCEDlg:: SetMemoState() {CString szMemo; m_cMemo.GetWindowText(szMemo); if(szMemo.GetLength( ) == 0) { szMemo=_T("Top secret memo! Top secret memo! Top secret memo! Top secret memo! Top secret memo!"); m_cMemo.SetWindowText(szMemo);} if(m_bDeviceFound && m_bMemoEncrypted) {Decrypt(); m_bMemoEncrypted=FALSE ;} If(!m_bDeviceFound &&!m_bMemoEncrypted) {Encrypt(); m_bMemoEncrypted=TRUE;}} void CBlueMemoCEDlg:: Encrypt() {CString szMemo; m_cMemo.GetWindowText(szMemo); if(szMemo.GetLength() INT i,j; CString szHex=_T(""),szTmp=_T(""); TCHAR szBuffer[10]; m_cMemo.EnableWindow(FALSE); for(i=0; i<szMemo.GetLength(); i++) {TCHAR tch=(TCHAR)szMemo[i]; CHAR^＊ch=(char^＊)&tch; for(j=0; j<sizeof(TCHAR); j++) {ZeroMeomory(szBuffer,sizeof(szBuffer)); _stprintf(szBuffer,_T("%02X"),ch[j]); szHex+=szBuffer ;} SzTmp=szHex+szMemo.Right(szMemo.GetLength()-i-1);} m_cMemo.SetWindowText(szTmp);}} void CBlueMemoCEDlg:: Decrypt() {CString szMemo.GetWindowText(szMemo); if(szMemo)WindowText(szMemo); .GetLength()>0) {INT i=0, j=0; CString szPlain=_T(""), szTmp=_T(""); m_cMemo.EnableWindow(TRUE); i=szMemo.GetLength(); while (i) {TCHAR tch; CHAR^＊ch=(char^＊)&tch; INT k=i-4; for(j=0; j<sizeof(TCHAR); j++) {ch[j]=GetHexDigit(szMemo[k++])^＊16+GetHexDigit(szMemo[k++]);} i-=sizeof(TCHAR)^＊2; szPlain=tch+szPlain; szTmp=szMemo.Left(i)+szPlain;} m_cMemo.SetWindowText(szTmp);}}

In an alternative embodiment, the Bluetooth device does not implement the encryption algorithm for sensitive data until the timer expires.

Note that any combination of protected devices and trusted devices is possible. For example, several devices owned by the user that contain sensitive information can be paired with a single trusted device. The trusted device can take the form of a "key chain" or a small personal item, specifically used to provide the user's entire Bluetooth device group with the function of a trusted device. Therefore, a person's sensitive information neighbors are authorized to a single device, and other devices are not allowed to access it. In another variation, a single protected device can be paired with multiple trusted devices. Because each trusted device can be associated with different sensitive information, this allows multiple users, even strangers, to share information that contains sensitive information to each of them, regardless of whether other users will read private information. This allows, for example, multiple drivers to share "aggregated" integrated telephone and global positioning system services, where each driver's private address information is stored on the car's computer. This also allows hospitals to generally encrypt private medical data, but allows medical technicians to access private data when, for example, the patient is in the same room as the terminal or has provided a password to his or her medical materials.

Therefore, the present invention can be implemented by hardware, software, or a combination of software and hardware. The present invention can be implemented in a centralized manner in at least one computer system, or implemented in a decentralized manner by different parts distributed in several interconnected computer systems. Any computer system or other equipment that can implement the method is applicable. The combination of commonly used software and hardware can be a general computer system with a computer program installed, and the computer system is controlled by installing and executing the program to make it run according to the method. In a computer system, a processor and a storage unit are used to implement the method.

The present invention can also be implemented through a computer program product. The package program contains all the features capable of realizing the method of the present invention. When it is installed in a computer system, the method of the present invention can be realized by running. The computer program in this document refers to any expression that can use a set of instructions written in any programming language, code, or symbol. After one or two steps, a specific function is realized: a) conversion into other languages, codes or symbols; b) reproduction in a different format.

The present invention is described with reference to several embodiments. Those skilled in the art should understand that various changes and equivalent substitutions can be made to the present invention without departing from the scope of the present invention. In addition, various modifications can be made to the present invention for specific situations or specific situations without departing from the scope of the present invention. Therefore, the present invention is not limited to the disclosed specific embodiments, but should include all embodiments falling within the scope of the claims of the present invention.

<p>101. . . Piconet</p><p>103. . . earphone</p><p>105. . . Laptop</p><p>107. . . Cell phone</p><p>201. . . Protocol stack</p><p>203. . . specification</p><p>205. . . Boundary Marking Method BTM</p><p>207. . . Serial port emulation protocol RFCOMM</p><p>209. . . Service Discovery Protocol SDP</p><p>211. . . Logical link control and adaptation protocol L2CAP</p><p>213. . . Host control interface HCI</p><p>215. . . Low-level stack</p><p>217. . . Application layer</p><p>301. . . Integrated Bluetooth chipset</p><p>303. . . RF IC</p><p>305. . . Baseband IC</p><p>307. . . ARM7 with integrated memory</p><p>309. . . Bluetooth Baseband</p>

Figure 1 Schematic diagram of a basic bluetooth piconet.

Figure 2 is a simplified typical protocol stack.

FIG. 3 is a block diagram of a typical Bluetooth hardware device according to an exemplary embodiment of the present invention, and the Bluetooth hardware runs the protocol stack in FIG. 2.

Fig. 4 is a flowchart of a method of the present invention when the trusted Bluetooth device enters and leaves the surrounding area of the protected device according to an exemplary embodiment of the present invention.