Authentication of Computing and Communications Hardware

• US 20110093703A1
• Filed: 10/13/2010
• Published: 04/21/2011
• Est. Priority Date: 10/16/2009
• Status: Active Grant

• Current Assignee: Cryptosoft Limited
• Original Assignee: DeviceAuthority Inc. (f/k/a NetAuthority, Inc.) (Device Authority Ltd.)
• Inventors: Etchegoyen, Craig S.
• Granted Patent: US 8,726,407 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A method for authenticating a computing device or hardware component includes computer-implemented process steps for assigning a unique identifier to the hardware component, generating a baseline fingerprint for the hardware component using algorithm-processing characteristic configuration data determined from the hardware component as input, wherein the baseline fingerprint is capable of being regenerated from the hardware component so long as configuration of the hardware component is not changed, transmitting the identifier in association with the baseline fingerprint for storage in a computer-readable data structure, and generating a data signal, in response to a query comprising the assigned identifier, indicating whether the stored baseline fingerprint for the assigned identifier matches a second fingerprint regenerated from the hardware component at a time after the baseline fingerprint is generated.

Claims

1. A method comprising:

generating a current machine fingerprint for a client device comprising a processor and memory, at least in part by reading data indicating current configuration states of hardware making up the client device and processing the data to generate the current machine fingerprint;

retrieving an identifier assigned to the client device;

using the identifier to obtain a stored machine fingerprint for the client device; and

providing an indication that the client device is authentic in response to determining that the current machine fingerprint matches the stored machine fingerprint.

2. The method of claim 1, further comprising generating the machine fingerprint further determined by current configuration states of software stored on the client device.

3. The method of claim 1, further comprising transmitting the identifier and the current machine fingerprint from the client device to a server for comparison to the stored machine fingerprint.

4. The method of claim 3, further comprising encrypting the current machine fingerprint before transmitting to the server.

5. The method of claim 1, wherein the current machine fingerprint is generated by a server in communication with the client device.

6. The method of claim 5, further comprising retrieving, using the server, raw configuration data from the client device for use in generating the current machine fingerprint.

7. The method of claim 6, wherein less than an entirety of the raw configuration data is used to generate the current machine fingerprint at the server.

8. The method of claim 6, further comprising transmitting an application from the server to the client, the application configured for retrieving the raw configuration data.

9. The method of claim 1, further comprising providing an indication that the client device is not authentic in response to determining that the current machine fingerprint does not match the stored machine fingerprint.

10. A method, comprising:

assigning a unique identifier to a hardware component;

generating a baseline fingerprint for the hardware component using an algorithm processing characteristic configuration data determined from the hardware component as input, wherein the baseline fingerprint is capable of being regenerated from the hardware component so long as configuration of the hardware component is not changed;

transmitting the identifier in association with the baseline fingerprint for storage in a computer-readable data structure; and

generating a data signal, in response to a query comprising the assigned identifier, indicating whether the stored baseline fingerprint for the assigned identifier matches a second fingerprint regenerated from the hardware component at a time after the baseline fingerprint is generated.

11. The method of claim 10, further comprising serving an application from a server in response to the query, the application configured to regenerate the second fingerprint on the hardware component and cause transmission of the second fingerprint to the server.

12. The method of claim 11, wherein the application is further configured to delete the second fingerprint from the hardware component after the transmission of the second fingerprint and to go dormant.

13. The method of claim 10, further comprising retrieving raw configuration data from the hardware component for use in regenerating the second fingerprint, in response to the query.

14. The method of claim 13, further comprising regenerating the second fingerprint using less than an entirety of the raw configuration data retrieved from the hardware component.

15. The method of claim 14, further comprising transmitting an application from a server to the hardware component in response to the query, the application configured for retrieving the raw configuration data.

16. A computer-readable medium encoded with instructions configured to cause a computer to:

generate a baseline fingerprint for a hardware component by processing characteristic configuration data determined from the hardware component as input, wherein the baseline fingerprint is capable of being regenerated from the hardware component so long as configuration of the hardware component is not changed;

transmit the baseline fingerprint for storage in a computer-readable data structure in association with a unique identifier assigned to the hardware component; and

generate a data signal, in response to a query comprising the assigned identifier, indicating whether the stored baseline fingerprint for the assigned identifier matches a second fingerprint regenerated from the hardware component subsequent to generation of the baseline fingerprint.

17. The computer-readable medium of claim 16, wherein the encoded instructions are further configured to cause a computer to serve an application from a server in response to the query, the application configured to regenerate the second fingerprint on the hardware component and cause transmission of the second fingerprint to the server.

18. The computer-readable medium of claim 16, wherein the encoded instructions are further configured to cause a computer to retrieve raw configuration data from the hardware component for use in regenerating the second fingerprint.

19. The computer-readable medium of claim 18, wherein the encoded instructions are further configured to cause a computer to regenerate the second fingerprint using less than an entirety of the raw configuration data retrieved from the hardware component.

20. The computer-readable medium of claim 16, wherein the encoded instructions are further configured to cause a computer to transmit an application to the hardware component configured for retrieving the raw configuration data.