Trusted execution of an executable object on a local device

• US 10,678,908 B2
• Filed: 12/21/2013
• Issued: 06/09/2020
• Est. Priority Date: 09/27/2013
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Grobman, Steve, Woodward, Carl, Beaney, Jr., James D., Raynor, Jimmy Scott
• Primary Examiner(s): Harris, Christopher C
• Application Number:
  US14/913,805
• Publication Number:
  US 20170039368A1
• Time in Patent Office: 2,362 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

In one example embodiment, an electronic device is provided and configured to: acquire authentication data for an authorized user; store the authentication data in an enclave; acquire identification data for a potential user; and compare, in the enclave, the identification data to the authentication data for recognizing if the potential user is the authorized user. In another embodiment, a server is provided and includes at least one processor; at least one memory; at least one driver, where the server is configured to: receive assertion data from an electronic device, where the assertion includes an authentication signing key and results from a comparison of acquired data and reference data; and determine if the assertion data is valid by: comparing the results to a threshold; and comparing the authentication signing key to an authentication signing key assigned to the electronic device.

Claims

1. An electronic client device, comprising:

an enclave;

at least one processor;

at least one memory;

at least one driver, wherein the electronic client device is configured to;

obtain an authentication signing key from an attestation server;

store the authentication signing key in the enclave, wherein the authentication signing key verifies the identity of the enclave;

acquire, after storing the authentication signing key, authentication data for an authorized user;

store the authentication data in the enclave;

acquire identification data for a potential user;

compare, by locally executing, with the processor, a biometric algorithm in the enclave, the identification data to the authentication data to determine if the potential user is the authorized user; and

send results of the comparison and the authentication signing key to an authentication server.

2. The electronic client device of claim 1, wherein the electronic client device is further configured to:

generate an assertion claim for the potential user using a claim building algorithm.

3. The electronic client device of claim 1, wherein the results of the comparison are encrypted.

4. The electronic client device of claim 1, wherein the results of the comparison are encrypted and stored in an untrusted memory that is separate from the enclave.

5. The electronic client device of claim 1, wherein the identification data is biometric data.

6. The electronic client device of claim 1, wherein the identification data is acquired outside of the enclave and a trusted services application program interface is used to bring the identification data into the enclave.

7. The electronic client device of claim 1, wherein the electronic client device is further configured to:

access a secure application based on the results of the comparison.

8. The electronic client device of claim 1, wherein the enclave operates in a trusted execution environment.

9. The electronic client device of claim 1, wherein the enclave is a protected region of memory that is accessible through a trusted services application program interface.

10. The electronic client device of claim 1, wherein the identification data is acquired by a hardware sensor.

11. One or more non-transitory computer readable medium having instructions stored thereon, the instructions, when executed by a processor, cause the processor to:

obtain an authentication signing key from an attestation server;

store the authentication signing key in the enclave, wherein the authentication signing key verifies the identity of the enclave;

acquire, after storing the authentication signing key, authentication data for an authorized user;

store the authentication data in an enclave on an electronic client device;

acquire identification data for a potential user; and

compare, by locally executing a biometric algorithm in the enclave, the identification data to the authentication data to determine if the potential user is the authorized user; and

send results of the comparison and the authentication signing key to an authentication server.

12. The medium of claim 11, further including instructions that, when executed by the processor, cause the processor to:

generate an assertion claim for the potential user using a claim building algorithm.

13. The medium of claim 11, wherein results of the comparison are encrypted and stored in an untrusted memory that is separate from the enclave.

14. The medium of claim 11, wherein the identification data is biometric data.

15. The medium of claim 11, wherein the identification data is acquired outside of the enclave and a trusted services application program interface is used to bring the identification data into the enclave.

16. The medium of claim 11, further including instructions that, when executed by the processor, cause the processor to:

access a secure application based on results of the comparison.

17. The medium of claim 11, wherein the enclave is a trusted execution environment.