Device with embedded certificate authority

• US 10,440,006 B2
• Filed: 06/21/2017
• Issued: 10/08/2019
• Est. Priority Date: 06/21/2017
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Thom, Stefan, Spiger, Robert Karl, Mattoon, Dennis, England, Paul
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US15/629,139
• Publication Number:
  US 20180375852A1
• Time in Patent Office: 839 Days
• Field of Search: 713156
• CPC Class Codes: G01G 19/44 for weighing persons
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A smart device, connected device, Internet of Things (IoT) device, etc. is configured with an embedded certificate authority. The embedded certificate authority generates a compound certificate that is signed at least by a manufacturer certificate securely stored on the device. The compound certificate includes a representation of a state of the device, which is based on one or more measurements of code executable on the device. The compound certificate may be used by an external device communicating with the smart device to determine whether the device is in a trusted state. Because the compound certificate is chained to a manufacturer certificate, the external device can communicate with the manufacturer (or an employed party) to determine whether the state of the device should be trusted.

Claims

1. A computing device comprising:

one or more hardware processors;

a trusted computing manager executable by the one or more hardware processors to access a secure memory;

a certificate authority embedded in the trusted computing manager at the computing device and executable by the one or more hardware processors to generate a compound certificate, the generated compound certificate including a representation of a state of the computing device and being chained at least to a manufacturer certificate,

wherein the manufacturer certificate is received from an external certificate authority and stored in the secure memory accessible by the trusted computing manager, wherein the state of the computing device is determined based on one or more measurements of code executable on the computing device; and

a server process executable by the one or more hardware processors to transmit the generated compound certificate to an external device in response to a certificate request sent by the external device, wherein the representation of the state of the computing device included in the generated compound certificate is usable by the requesting external device to determine whether the computing device is in a trusted state.

2. The computing device of claim 1 wherein the manufacturer certificate chained to the generated compound certificate is usable by the external device to determine that the state of the computing device represented in the generated compound certificate is a trusted state.

3. The computing device of claim 1 wherein the manufacturer certificate chained to the generated compound certificate is usable by the external device to determine whether the state of the computing device represented in the generated compound certificate is a trusted state, the server process being further executable to establish a secure communication channel with the external device, the state of the computing device represented in the generated compound certificate being trusted by the external device.

4. The computing device of claim 1 wherein the generated compound certificate is further chained to a device certificate, the device certificate including measurements of mutable code executable on the computing device, the measurements of the mutable code including at least measurements of code for executing a trusted execution environment.

5. The computing device of claim 1 wherein a public key associated with the generated compound certificate is limited in functionality by the embedded certificate authority.

6. The computing device of claim 1 wherein the one or more measurements of code executable on the computing device are generated during a boot sequence of the computing device.

7. The computing device of claim 1 wherein the computing device receives a payload including a device update, the payload transmitted to the computing device from the external device responsive to a determination by the external device that the computing device is in an untrusted state based on the generated compound certificate.

8. A method comprising:

storing a manufacturer certificate in a secure memory of a computing device, the secure memory accessible by a trusted computing manager;

generating, at the computing device, one or more measurements of code executable on the computing device, the one or more measurements of code representing a state of the computing device;

generating, by a certificate authority embedded in the trusted computing manager at the computing device, a compound certificate, wherein the compound certificate includes the one or more measurements of code and is chained to at least the stored manufacturer certificate, wherein the stored manufacturer certificate is received from an external certificate authority and stored in the secure memory accessible by the trusted computing manager; and

transmitting, by the computing device, the generated compound certificate to an external device in response to a certificate request sent from the external device, wherein the one or more measurements of code included in the generated compound certificate are usable by the external device to determine whether the computing device is in a trusted state.

9. The method of claim 8 wherein the manufacturer certificate chained to the generated compound certificate is usable by the external device to determine whether the state of the computing device represented in the generated compound certificate is a trusted state.

10. The method of claim 8 wherein the manufacturer certificate chained to the generated compound certificate is usable by the external device to determine whether the state of the computing device represented in the generated compound certificate is a trusted state, the method further comprising:

establishing a secure communication channel with the external device, the state of the computing device represented in the generated compound certificate being trusted by the external device.

11. The method of claim 8 wherein the generated compound certificate is further chained to a device certificate, the device certificate including measurements of mutable code executable on the computing device, the measurements of the mutable code including at least measurements of code for executing a trusted execution environment.

12. The method of claim 8 wherein the generated compound certificate is further chained to a device certificate, the device certificate including a representation of hardware included in the computing device.

13. The method of claim 8 wherein the one or more measurements of code executable on the computing device are generated during a boot sequence of the computing device.

14. The method of claim 8 further comprising:

receiving, at the computing device, a payload including a device update, the payload transmitted to the computing device from the external device responsive to a determination by the external device that the computing device is in an untrusted state based on the generated compound certificate.

15. One or more tangible processor-readable storage device embodied with instructions for executing on one or more hardware processors and circuits of a computing device a process comprising:

storing, at the computing device, a manufacturer certificate in a secure memory of the computing device, the secure memory accessible by a trusted computing manager;

generating, on the computing device, one or more measurements of code executable on the computing device, the one or more measurements of code representing a state of the computing device;

generating, by a certificate authority embedded in the trusted computing manager at the computing device, a compound certificate, wherein the compound certificate includes the one or more measurements of code and is chained to at least the stored manufacturer certificate, wherein the stored manufacturer certificate is received from an external certificate authority and stored in the secure memory accessible by the trusted computing manager; and

transmitting, by the computing device, the generated compound certificate to an external device, wherein the one or more measurements of code included in the generated compound certificate is usable by the external device to determine whether the computing device is in a trusted state.

16. The one or more tangible processor-readable storage device of claim 15 wherein the manufacturer certificate is usable by the external device to determine whether the state of the computing device represented in the generated compound certificate is a trusted state.

17. The one or more tangible processor-readable storage device of claim 15 wherein the manufacturer certificate chained to the generated compound certificate is usable by the external device to determine whether the state of the computing device represented in the generated compound certificate is a trusted state;

and

establishing a secure communication channel with the external device, the state of the computing device represented in the generated compound certificate being trusted by the external device.

18. The one or more tangible processor-readable storage device of claim 15 wherein the generated compound certificate is further chained to a device certificate, the device certificate including measurements of mutable code executable on the computing device, the measurements of the mutable code including at least measurements of code for executing a trusted execution environment.

19. The one or more tangible processor-readable storage device of claim 15 wherein the generated compound certificate is further chained to a device certificate, the device certificate including a representation of hardware included in the computing device.

20. The one or more tangible processor-readable storage device of claim 15, further comprising:

receiving, at the computing device, a payload including a device update, the payload transmitted to the computing device from the external device responsive to a determination by the external device that the computing device is in an untrusted state based on the generated compound certificate.