Root of trust of geolocation

• US 10,601,787 B2
• Filed: 06/06/2016
• Issued: 03/24/2020
• Est. Priority Date: 06/06/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Pritikin, Max, Montalvo, Rafael Mantilla, Shenefiel, Chris Allen
• Primary Examiner(s): Lagor, Alexander
• Assistant Examiner(s): Lane, Gregory A
• Application Number:
  US15/174,350
• Publication Number:
  US 20170353435A1
• Time in Patent Office: 1,387 Days
• Field of Search: 713156
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 30/018 Certifying business or products
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A root-of-trust of geolocation is provided for an apparatus that includes a trust anchor module with a cryptographic processor and a secure memory. The apparatus further includes a main processor coupled to the trust anchor module and configured to receive a digital geolocation certificate, the geolocation certificate including information identifying the apparatus, information regarding a physical location of the apparatus, information identifying an authorized entity that has verified the physical location of the apparatus, and a digital signature of the authorized entity. The main processor is further configured to cause the trust anchor module to store the digital geolocation certificate in the secure memory such that the digital geolocation certificate is cryptographically bound to the apparatus. The trust anchor module may also include, or otherwise communicate over a secure channel with, a movement sensor associated with the apparatus.

Claims

1. An apparatus comprising:

a network interface unit configured to enable network communications;

a trust anchor module including a cryptographic processor and a secure memory; and

a main processor coupled to the network interface unit and the trust anchor module and configured to;

receive, via the network interface unit, a digital geolocation certificate for the apparatus, the digital geolocation certificate including information identifying the apparatus, information regarding a physical location of the apparatus, information identifying an authorized entity that has verified the physical location of the apparatus, and a digital signature of the authorized entity;

cause the trust anchor module to store the digital geolocation certificate in the secure memory such that the digital geolocation certificate is cryptographically bound to the apparatus in a manner that renders the digital geolocation certificate immutable; and

measure a location of the apparatus based on communications with external sources;

wherein the trust anchor module is configured to store a log of location measurements based on the communications with external sources in the secure memory, wherein the location measurements stored in the log are protected from tampering by only allowing additional location measurements stored in the log to be added, and not to be removed or modified, using a privileged process that is executed by the cryptographic processor, and wherein a trustworthiness associated with a location measurement of the log of location measurements is determined based on a weighted sum of positive weighted values for each external source that agrees with the information regarding the physical location of the apparatus in the digital geolocation certificate and negative weighted values for each external source that disagrees with the information regarding the physical location of the apparatus in the digital geolocation certificate; and

wherein a configuration of the apparatus is attested to external entities by providing the digital geolocation certificate from the trust anchor module.

2. The apparatus of claim 1, wherein the information regarding the physical location of the apparatus includes longitude and latitude information.

3. The apparatus of claim 1, wherein the trust anchor module further includes a movement sensor, and wherein the trust anchor module is configured to store measurements from the movement sensor in the secure memory.

4. The apparatus of claim 3, wherein the trust anchor module is configured to cause a notification to be sent, via the network interface unit, when a measurement from the movement sensor exceeds a predetermined threshold.

5. The apparatus of claim 3, wherein the movement sensor is an accelerometer.

6. The apparatus of claim 1, wherein the main processor is configured to measure a location of the apparatus by communicating with at least one of GPS satellites, trusted ping servers, or wireless wide area network cell towers.

7. The apparatus of claim 1, wherein the main processor is configured to send the log of location measurements stored in the secure memory to another device in response to a trust request.

8. A system comprising the apparatus of claim 1 and a computing device in communication with the apparatus via a network, the computing device being configured to:

send to the apparatus, via the network, a communication seeking an assertion of current location and stored measurements;

receive from the apparatus, via the network, information from the trust anchor module regarding the physical location of the apparatus, the information including the digital geolocation certificate, the log of the location measurements stored in the secure memory of the apparatus, and the digital signature of the apparatus; and

determine, based on the information received from the apparatus, trustworthiness of the assertion of the current location.

9. The system of claim 8, wherein the computing device is configured to determine trustworthiness of the assertion of the current location by comparing the physical location asserted in the digital geolocation certificate with the log of location measurements.

10. The system of claim 8, wherein the computing device is configured to determine trustworthiness of the assertion of the current location based on whether or not a stored movement measurement exceeds a predetermined threshold.

19. The system of claim 8, wherein the computing device is further configured to determine compliance with at least one policy or legal requirement based on the location of the apparatus.

11. A method of establishing a root of trust of geolocation for an apparatus including a trust anchor module having a cryptographic processor and a secure memory, the method comprising:

receiving, at the apparatus, a digital geolocation certificate for the apparatus, the digital geolocation certificate including information identifying the apparatus, information regarding a physical location of the apparatus, information identifying an authorized entity that has verified the physical location of the apparatus, and a digital signature of the authorized entity;

storing the digital geolocation certificate in the secure memory of the apparatus such that the digital geolocation certificate is cryptographically bound to the apparatus in a manner that renders the digital geolocation certificate immutable;

measuring a location of the apparatus based on communications with external sources;

storing a log of location measurements based on the communications with external sources in the secure memory, wherein the location measurements stored in the log are protected from tampering by only allowing additional location measurements stored in the log to be added, and not to be removed or modified, using a privileged process that is executed by the cryptographic processor, and wherein a trustworthiness associated with a location measurement of the log of location measurements is determined based on a weighted sum of positive weighted values for each external source that agrees with the information regarding the physical location of the apparatus in the digital geolocation certificate and negative weighted values for each external source that disagrees with the information regarding the physical location of the apparatus in the digital geolocation certificate; and

attesting to a configuration of the apparatus to external entities by providing the digital geolocation certificate from the trust anchor module.

12. The method of claim 11, further comprising storing, in the secure memory, measurements from a movement sensor associated with the apparatus.

13. The method of claim 12, wherein the apparatus is connected to an external computing device via a network connection, and further comprising sending a notification that the apparatus has been moved when the measurements from the movement sensor exceed a predetermined value.

14. The method of claim 11, further comprising sending, from the apparatus to another device, the digital geolocation certificate and the log of location measurements stored in the secure memory.

20. The method of claim 13, wherein the external computing device is further configured to determine compliance with at least one policy or legal requirement based on the location of the apparatus.

15. A non-transitory computer-readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

receive, at an apparatus including a trust anchor module having a cryptographic processor and a secure memory, a digital geolocation certificate for the apparatus, the digital geolocation certificate including information identifying the apparatus, information regarding a physical location of the apparatus, information identifying an authorized entity that has verified the physical location of the apparatus, and a digital signature of the authorized entity;

store the digital geolocation certificate in the secure memory of the apparatus such that the digital geolocation certificate is cryptographically bound to the apparatus in a manner that renders the digital geolocation certificate immutable;

measure a location of the apparatus based on communications with external sources;

store a log of location measurements based on the communications with external sources in the secure memory, wherein the location measurements stored in the log are protected from tampering by only allowing additional location measurements stored in the log to be added, and not to be removed or modified, using a privileged process that is executed by the cryptographic processor, and wherein a trustworthiness associated with a location measurement of the log of location measurements is determined based on a weighted sum of positive weighted values for each external source that agrees with the information regarding the physical location of the apparatus in the digital geolocation certificate and negative weighted values for each external source that disagrees with the information regarding the physical location of the apparatus in the digital geolocation certificate; and

attest to a configuration of the apparatus to external entities by providing the digital geolocation certificate from the trust anchor module.

16. The computer-readable storage media of claim 15, further comprising instructions operable to store, in the secure memory, measurements from a movement sensor associated with the apparatus.

17. The computer-readable storage media of claim 16, further comprising instructions operable to send a notification that the apparatus has been moved when the measurements from the movement sensor exceed a predetermined value.

18. The computer-readable storage media of claim 15, further comprising instructions operable to send, from the apparatus to another device, the digital geolocation certificate and the log of location measurements stored in the secure memory.

21. The computer-readable storage media of claim 16, further comprising instructions operable to determine compliance with at least one policy or legal requirement based on the location of the apparatus.