Location attestation service

• US 20080209515A1
• Filed: 02/22/2007
• Published: 08/28/2008
• Est. Priority Date: 02/22/2007
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Novoa, Manuel, Ibrahim, Wael
• Granted Patent: US 8,332,928 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

In one embodiment a computer system comprises a processor and a memory module coupled to the processor and comprising logic instructions stored in a computer readable medium. The logic instructions, when executed, configure the processor to initiate, in a client computing device, a service request, in response to the service request, initiate a request for a location attestation certificate, and complete the client service request when the location attestation certificate is granted.

Claims

1. A method, comprising:

initiating, in a client computing device, a service request;

in response to the service request, initiating a request for a location attestation certificate; and

completing the client service request when the location attestation certificate is granted.

2. The method of claim 1, wherein initiating, in a client computing device, a service request comprises initiating a service request during a boot operation.

3. The method of claim 1, wherein initiating, in a client computing device, a service request comprises initiating a request to access a resource on a partitioned section of a hard drive in the client computing device.

4. The method of claim 1, wherein initiating, in a client computing device, a service request comprises initiating a request to access a resource on a remote storage device.

5. The method of claim 1, wherein initiating, in a client computing device, a service request comprises initiating a request to start an application.

6. The method of claim 1, wherein initiating a request for a location attestation certificate comprises:

initiating a communication connection with a location attestation server;

verifying that the location attestation server is trusted; and

requesting a location attestation certificate from the location attestation server.

7. The method of claim 6, further comprising:

receiving, in the location attestation server, the request for the location attestation certificate;

verifying, in the location attestation server, a location of the client computing device; and

granting the location attestation certificate.

8. The method of claim 1, further comprising:

monitoring the validity of the location attestation certificate; and

terminating access to at least one service when the location attestation server is invalidated.

9. A computer system, comprising:

a processor;

a memory module coupled to the process and comprising logic instructions stored in a computer readable medium which, when executed, configure the processor to;

initiate, in a client computing device, a service request;

in response to the service request, initiate a request for a location attestation certificate; and

complete the client service request when the location attestation certificate is granted.

10. The computer system of claim 9, further comprising logic instructions stored in a computer readable medium which, when executed, cause the processor to initiate a service request during a boot operation.

11. The computer system of claim 9, further comprising logic instructions stored in a computer readable medium which, when executed, cause the processor to request to access a resource on a partitioned section of a hard drive in the client computing device.

12. The computer system of claim 9, further comprising logic instructions stored in a computer readable medium which, when executed, cause the processor to initiate a request to access a resource on a remote storage device.

13. The computer system of claim 9, further comprising logic instructions stored in a computer readable medium which, when executed, cause the processor to initiate a request to start an application.

14. The computer system of claim 9, further comprising logic instructions stored in a computer readable medium which, when executed, cause the processor to:

initiate a communication connection with a location attestation server;

verify that the location attestation server is trusted; and

request a location attestation certificate from the location attestation server.

15. The computer system of claim 14, further comprising logic instructions stored in a computer readable medium which, when executed, cause the processor to:

receive, in the location attestation server, the request for the location attestation certificate;

verify, in the location attestation server, a location of the client computing device; and

grant the location attestation certificate.

16. The computer system of claim 9, further comprising logic instructions stored in a computer readable medium which, when executed, cause the processor to:

monitor the validity of the location attestation certificate; and

terminate access to at least one service when the location attestation server is invalidated.

17. A computer system, comprising:

at least one resource accessible by a user; and

a location attestation module to manage access to the at least one resource based in part on a location-based access parameter.

18. The computer system of claim 17, wherein the at least one resource comprises at least one of a boot process resident on the computer system, an application resident on the computer system, a hard drive partition resident on the computer system, or a resource located on a remote computer system.

19. The computer system of claim 17, wherein the location attestation module comprises logic to:

initiate a communication connection with a location attestation server;

verify that the location attestation server is trusted; and

request a location attestation certificate from the location attestation server.

20. The computer system of claim 19, further comprising a location attestation server, wherein the location attestation server comprises a location attestation module to:

receiving the request for the location attestation certificate;

verify a location of the client computing device; and

granting the location attestation certificate.