HARDWARE-BASED DEVICE AUTHENTICATION

• US 20150222629A1
• Filed: 02/09/2015
• Published: 08/06/2015
• Est. Priority Date: 12/23/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Von Bokern, Vincent Edward, Goel, Purushottam, Schrecker, Sven, Smith, Ned McArthur
• Granted Patent: US 10,432,616 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

An opportunity for a computing device to participate in a secure session with a particular domain is identified. A secured microcontroller of the computing device is used to identify a secured, persistent seed corresponding to the particular domain and stored in secured memory of the computing device. A secure identifier is derived based on the seed and sent for use by the particular domain in authenticating the computing device to the particular domain for the secure session. The particular domain can further apply security policies to transactions involving the computing device and particular domain based at least in part on the secure identifier.

Claims

1-29. -29. (canceled)

30. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

access, in secured memory of a secured microcontroller of a computing device, a persistent seed corresponding to a particular domain, wherein the persistent seed is to be accessed in association with an attempt to establish a secure session between the with the computing device and the particular domain;

derive, using the secured microcontroller, a one-time password based on the seed; and

send, using the secured microcontroller, the one-time password to another device associated with the particular domain to authenticate the computing device to the particular domain, wherein the one-time password is sent independent of a processor and operating system of the computing device.

31. The storage medium of claim 30, wherein the secured memory is inaccessible to resources of the operating system of the computing device.

32. The storage medium of claim 30, wherein the seed is unique within a system to a pairing of the computing device and the particular domain.

33. The storage medium of claim 30, wherein the particular domain corresponds to a website.

34. The storage medium of claim 30, wherein the particular domain corresponds to a web service.

35. The storage medium of claim 30, wherein the particular domain corresponds to an ecommerce site.

36. The storage medium of claim 30, wherein the seed is received from the particular domain over a secured channel.

37. The storage medium of claim 36, wherein the instructions, when executed, further cause the machine to establish the secured channel, and establishing the secured channel includes authenticating the particular domain.

38. The storage medium of claim 37, wherein establishing the secured channel includes using a key exchange protocol.

39. The storage medium of claim 38, wherein the key exchange protocol is a SIGMA protocol.

40. The storage medium of claim 30, wherein the instructions, when executed, further cause the machine to prompt a user of the computing device for permission to participate in the secure session with the particular domain.

41. The storage medium of claim 30, wherein the instructions, when executed, further cause the machine to derive the secure identifier based on the seed and a value known to both the computing device and the particular domain.

42. The storage medium of claim 41, wherein the value is an identifier of the particular domain.

43. The storage medium of claim 42, wherein the instructions, when executed, further cause the machine to receive the identifier from the particular domain.

44. The storage medium of claim 41, wherein the value comprises a system clock value.

45. The storage medium of claim 30, wherein the instructions, when executed, further cause the machine to communicate security posture data over a secured channel between the computing device and domain, the security posture data describing attributes of the computing device.

46. The storage medium of claim 30, wherein the instructions, when executed, further cause the machine to collect security data from the computing device and generate the security posture data.

47. A method comprising:

accessing, in secured memory of a secured microcontroller of a computing device, a persistent seed corresponding to a particular domain, wherein the persistent seed is to be accessed in association with an attempt to establish a secure session between the with the computing device and the particular domain;

deriving, using the secured microcontroller, a one-time password based on the seed; and

sending, using the secured microcontroller, the one-time password to another device associated with the particular domain to authenticate the computing device to the particular domain, wherein the one-time password is sent independent of a processor and operating system of the computing device

48. An apparatus comprising:

secured memory;

a secured microcontroller, wherein the secured microcontroller is configured to access a network interface of a computing device independent of a processor and operating system of the computing device;

code, executable by the secured microcontroller, to;

access, in secured memory of a secured microcontroller of a computing device, a persistent seed corresponding to a particular domain, wherein the persistent seed is to be accessed in association with an attempt to establish a secure session between the with the computing device and the particular domain;

derive, using the secured microcontroller, a one-time password based on the seed; and

send, using the secured microcontroller, the one-time password to another device associated with the particular domain to authenticate the computing device to the particular domain, wherein the one-time password is sent independent of a processor and operating system of the computing device.

49. The apparatus of claim 48, further comprising:

the network interface;

the processor; and

the operating system, wherein the operating system is executed using the processor.