Targeted secure software deployment

• US 10,218,696 B2
• Filed: 06/30/2016
• Issued: 02/26/2019
• Est. Priority Date: 06/30/2016
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Thom, Stefan, Kapadia, Merzin
• Primary Examiner(s): Shiferaw, Eleni A
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US15/198,336
• Publication Number:
  US 20180007040A1
• Time in Patent Office: 971 Days
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

The techniques and systems described herein are directed to providing targeted, secure software deployment in a computing system. An identity of the computing device can be determined and verified using a trusted platform module (TPM) of the computing device, and a software update can be expressly configured to operate solely on the computing device. Further, a configuration of the computing device can be ascertained using platform configuration registers (PCRs) of the TPM to determine that the computing device has not been modified from a trusted configuration. For example, if malware or unauthorized software is operating on the computing device, the software update may be prevented from being installed. Further, the software update can be targeted for a particular computing device, such that when the software update is received at the computing device, the software update may not be duplicated and provided to an additional, unauthorized device.

Claims

1. A system comprising:

one or more processors; and

memory storing modules that, when executed by the one or more processors, cause the system to perform operations comprising;

determining that a remote device is to receive a software update;

identifying a public storage root key (SRK) associated with the remote device;

determining a first set of platform configuration registers (PCRs) associated with a trusted operation of firmware operating on the remote device;

determining a second set of PCRs associated with an expected operation of at least a portion of the software update on the remote device;

determining a random symmetric key (RSK);

encrypting, as an encrypted software package, the software update using the RSK;

encrypting, as encrypted configuration settings, the first set of PCRs and the second set of PCRs using the RSK;

encrypting, as an encrypted RSK, the RSK with the public SRK of the remote device; and

transferring the encrypted software package, the encrypted configuration settings, and the encrypted RSK to the remote device, wherein at least a portion of the encrypted software package is imported by the remote device based at least in part on a private SRK of the remote device and after a determination that the first set of PCRs of the encrypted configurations settings correspond to firmware PCRs of the remote device and the second set of PCRs of the encrypted configurations settings correspond to boot manager PCRs of the remote device.

2. The system of claim 1, the operations further comprising:

receiving a first indication from the remote device that the encrypted software package is uniquely associated with the remote device; and

receiving a second indication from the remote device that the remote device is in a trusted state.

3. The system of claim 1, the operations further comprising determining the first set of PCRs during an initialization of the remote device by the service provider.

4. The system of claim 1, wherein the public SRK of the remote device is associated with a trusted platform module (TPM) of the remote device.

5. A computer-implemented method comprising:

receiving, at a device and from a service provider an encrypted volume, wherein the encrypted volume includes one or more encrypted configuration settings and one or more encrypted keys;

decrypting at least a first portion of the encrypted volume based at least in part on a private storage root key (SRK) associated with the device;

determining that the at least the first portion of the encrypted volume is uniquely associated with the device;

determining that the device is in a trusted state by;

decrypting, as one or more decrypted keys, the one or more encrypted keys based at least in part on the private SRK associated with the device;

decrypting, as decrypted configuration settings, at least a portion of the one or more encrypted configuration settings based at least in part on the one or more decrypted keys;

comparing a first platform configuration register (PCR) configuration included in the decrypted configuration settings with a second PCR configuration determined by a trusted platform module (TPM) of the device; and

determining that the first PCR configuration corresponds to the second PCR configuration; and

importing, as an imported volume and based at least in part on the device being in the trusted state, at least a second portion of the encrypted volume to the device, the importing based at least in part on the private SRK of the device.

6. The computer-implemented method of claim 5, wherein the encrypted volume includes an encrypted software package, and wherein the importing comprises at least:

decrypting, as a decrypted software package, at least a portion of the encrypted software package based at least in part on the one or more decrypted keys; and

encrypting, as an imported software package, at least a portion of the decrypted software package based at least in part on a symmetric SRK associated with the device.

7. The computer-implemented method of claim 6, wherein the importing further comprises deleting the at least the portion of the encrypted software package corresponding to the at least the portion of the decrypted software package encrypted in the imported software package.

8. The computer-implemented method of claim 5, further comprising determining that the device is in the trusted state based at least in part on platform configuration register (PCR) values associated with an operation of firmware of the device at a time of initializing the device.

9. The computer-implemented method of claim 5, further comprising:

loading the decrypted first portion of the encrypted volume into a boot manager of the device; and

based at least in part on the loading, determining at least one platform configuration register (PCR) value associated with the boot manager.

10. The computer-implemented method of claim 5, further comprising establishing trust between the device and a service provider based at least in part on a public endorsement key associated with the device.

11. The computer-implemented method of claim 5, further comprising storing at least a portion of the imported volume in a memory of the device in an encrypted form.

12. The computer-implemented method of claim 5, wherein at least a portion of the computer-implemented method is performed in association with trusted platform module (TPM) of the device.

13. The computer-implemented method of claim 5, wherein the encrypted volume comprises a set of encrypted platform configuration registers (PCRs) associated with a trusted operation of firmware operating on the device.

14. The computer-implemented method of claim 5, wherein the encrypted volume is received based on a determination that the device is to receive a software update and the encrypted volume comprises a set of encrypted platform configuration registers (PCRs) associated with an expected operation of at least a portion of the software update.

15. A system comprising:

one or more processors; and

memory storing modules that, when executed by the one or more processors, cause the system to perform operations comprising;

receiving an encrypted volume from a service provider, wherein the encrypted volume includes one or more encrypted configuration settings and one or more encrypted keys;

decrypting at least a first portion of the encrypted volume based at least in part on a private storage root key (SRK) associated with a device;

determining that the at least the first portion of the encrypted volume is uniquely associated with the device;

determining that the device is in a trusted state by;

decrypting, as one or more decrypted keys, the one or more encrypted keys based at least in part on the private SRK associated with the device;

decrypting, as decrypted configuration settings, at least a portion of the one or more encrypted configuration settings based at least in part on the one or more decrypted keys;

comparing a first platform configuration register (PCR) configuration included in the decrypted configuration settings with a second PCR configuration determined by a trusted platform module (TPM) of the device; and

determining that the first PCR configuration corresponds to the second PCR configuration; and

importing, as an imported volume based at least in part on the device being in the trusted state, at least a second portion of the encrypted volume to the device, the importing based at least in part on the private SRK of the device.

16. The system as recited in claim 15, wherein the encrypted volume includes an encrypted software package, and wherein importing comprises at least:

decrypting, as a decrypted software package, at least a portion of the encrypted software package based at least in part on the one or more decrypted keys; and

encrypting, as an imported software package, at least a portion of the decrypted software package based at least in part on a symmetric SRK associated with the device.

17. The system as recited in claim 15, the operations further comprising determining that the device is in the trusted state based at least in part on platform configuration register (PCR) values associated with an operation of firmware of the device at a time of initializing the device.

18. The system as recited in claim 15, further comprising a plurality of sensors providing data to a service provider, the operations further comprising, determining that at least one sensor of the plurality of sensors is to receive a software update.

19. The system as recited in claim 15, wherein the encrypted volume is received based on a determination that the device is to receive a software update and the encrypted volume comprises a set of encrypted platform configuration registers (PCRs) associated with an expected operation of at least a portion of the software update on the device.