Trusted container

• US 10,333,926 B2
• Filed: 07/12/2016
• Issued: 06/25/2019
• Est. Priority Date: 12/23/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Von Bokern, Vincent Edward, Goel, Purushottam, Schrecker, Sven, Smith, Ned McArthur
• Primary Examiner(s): Henning, Matthew T
• Application Number:
  US15/207,568
• Publication Number:
  US 20160323268A1
• Time in Patent Office: 1,078 Days
• Field of Search: 726 1, 726 3, 726 7
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A secure identifier is derived, using a secured microcontroller of a computing device, that is unique to a pairing of the computing device and a particular domain. Secure posture data corresponding to attributes of the computing device is identified in secured memory of the computing device. The secure identifier and security posture is sent in a secured container to a management device of the particular domain. The particular domain can utilize the information in the secured container to authenticate the computing device and determine a security task to be performed relating to interactions of the computing device with the particular domain.

Claims

1. At least one storage device or storage disk comprising instructions that, when executed on at least one processor, cause the at least one processor to, at least:

establish a secure connection between a domain and a client computing device;

receive, from the client computing device, a secure identifier corresponding to the client computing device, the secure identifier including a one-time password unique to a pairing of the client computing device and the domain, the secure identifier derived based at least in part on seed data received from the domain, the seed data separate from a domain identifier corresponding to the domain and unique to the pairing of the client computing device and the domain;

receive, from the client computing device, a container including security posture data corresponding to the client computing device bound to the secure identifier, the security posture data to identify attributes of the client computing device; and

perform a security task relating to an interaction of the client computing device with the domain, the security task including identification of a driver corresponding to the client computing device, the identification of the driver based on the security posture data.

2. At least one storage device or storage disk comprising instructions that, when executed on at least one processor, cause the at least one processor to, at least:

establish a secure connection between a domain and a client computing device;

receive, from the client computing device, a secure identifier corresponding to the client computing device, the secure identifier including a one-time password unique to (a) a pairing of the client computing device and (b) the domain, the one-time password derived based at least in part on seed data received from the domain, the seed data separate from a domain identifier corresponding to the domain and unique to the pairing of the client computing device and the domain;

receive, from the client computing device, a container including security posture data corresponding to the client computing device bound to the secure identifier, the security posture data to identify attributes of the client computing device; and

perform a security task relating to an interaction of the client computing device with the domain, the security task including a load of an agent onto the client computing device.

3. A system comprising:

at least one processor;

memory in circuit with the at least one processor;

a controller manager isolated from the at least one processor and to interact with a client computing device, the controller manager to;

negotiate a secure session with a client computing device;

provision seed data to the client computing device in response to the negotiation of the secure session, the seed data (a) separate from a domain identifier of a domain, (b) unique to a pairing of the client computing device and the domain, and (c) to be stored in a secure memory of the client computing device;

receive, from the client computing device, a secure identifier including a one-time password unique to the pairing of the client computing device and the domain, the secure identifier derived based at least in part on the seed data;

authenticate the client computing device using the one-time password; and

receive a secured container including the secure identifier and security posture data from the client computing device; and

an agent manager to load an agent onto the client computing device via a cloud connection.

4. A system comprising:

at least one processor;

memory in circuit with the at least one processor; and

a controller manager isolated from the at least one processor and to interact with a client computing device, the controller manager to;

negotiate a secure session with a client computing device;

provision seed data to the client computing device in response to the negotiation of the secure session, the seed data (a) separate from a domain identifier of a domain, (b) unique to a pairing of the client computing device and the domain, and (c) to be stored in a secure memory of the client computing device;

receive, from the client computing device, a secure identifier including a one-time password unique to the pairing of the client computing device and the domain, the secure identifier derived based at least in part on the seed data;

authenticate the client computing device using the one-time password; and

receive a secured container including the secure identifier and security posture data from the client computing device, wherein the system is to receive the secured container over a secure communication channel, the secure communication channel including an out-of-band communication channel between the client computing device and the domain independent from an in-band communication channel between a central processing unit of the client computing device and the domain.

5. A system comprising:

at least one processor;

memory in circuit with the at least one processor; and

a controller manager isolated from the at least one processor and to interact with a client computing device, the controller manager to;

negotiate a secure session with a client computing device;

provision seed data to the client computing device in response to the negotiation of the secure session, the seed data (a) separate from a domain identifier of a domain, (b) unique to a pairing of the client computing device and the domain, and (c) to be stored in a secure memory of the client computing device;

receive, from the client computing device, a secure identifier including a one-time password unique to the pairing of the client computing device and the domain, the secure identifier derived based at least in part on the seed data;

authenticate the client computing device using the one-time password; and

receive a secured container including the secure identifier and security posture data from the client computing device, wherein the system is to establish a second secure communication channel with the client computing device according to a second secure identifier including a second one-time password.

6. A system comprising:

at least one processor;

memory in circuit with the at least one processor; and

a controller manager isolated from the at least one processor and to interact with a client computing device, the controller manager to;

negotiate a secure session with a client computing device;

provision seed data to the client computing device in response to the negotiation of the secure session, the seed data (a) separate from a domain identifier of a domain, (b) unique to a pairing of the client computing device and the domain, and (c) to be stored in a secure memory of the client computing device;

receive, from the client computing device, a secure identifier including a one-time password unique to the pairing of the client computing device and the domain, the secure identifier derived based at least in part on the seed data;

authenticate the client computing device using the one-time password;

receive a secured container including the secure identifier and security posture data from the client computing device; and

validate the client computing device based at least in part on a certificate from a trusted authority.

7. A system comprising:

at least one processor;

memory in circuit with the at least one processor; and

a controller manager isolated from the at least one processor and to interact with a client computing device, the controller manager to;

negotiate a secure session with a client computing device;

provision seed data to the client computing device in response to the negotiation of the secure session, the seed data (a) separate from a domain identifier of a domain, (b) unique to a pairing of the client computing device and the domain, and (c) to be stored in a secure memory of the client computing device;

receive, from the client computing device, a secure identifier including a one-time password unique to the pairing of the client computing device and the domain, the secure identifier derived based at least in part on the seed data;

authenticate the client computing device using the one-time password;

receive a secured container including the secure identifier and security posture data from the client computing device; and

negotiate a form of the secure identifier via a combination of the seed data and the domain identifier.

8. A method comprising:

establishing, by executing an instruction with at least one processor, a secure connection between a domain and a client computing device;

receiving from the client computing device, by executing an instruction with the at least one processor, a secure identifier corresponding to the client computing device, the secure identifier including a one-time password unique to a pairing of the client computing device and the domain, the secure identifier derived based at least in part on seed data received from the domain, the seed data separate from a domain identifier corresponding to the domain and unique to the pairing of the client computing device and the domain;

receiving from the client computing device, by executing an instruction with the at least one processor, a container including security posture data corresponding to the client computing device bound to the secure identifier, the security posture data to identify attributes of the client computing device; and

performing a security task relating to an interaction of the client computing device with the domain, wherein the security task includes identification of a driver corresponding to the client computing device based on the security posture data.

9. A method comprising:

establishing, by executing an instruction with at least one processor, a secure connection between a domain and a client computing device;

receiving from the client computing device, by executing an instruction with the at least one processor, a secure identifier corresponding to the client computing device, the secure identifier including a one-time password unique to a pairing of the client computing device and the domain, the secure identifier derived based at least in part on seed data received from the domain, the seed data separate from a domain identifier corresponding to the domain and unique to the pairing of the client computing device and the domain;

receiving from the client computing device, by executing an instruction with the at least one processor, a container including security posture data corresponding to the client computing device bound to the secure identifier, the security posture data to identify attributes of the client computing device; and

performing a security task relating to an interaction of the client computing device with the domain, wherein the security task includes a load of an agent onto the client computing device.