TRUSTED PERIPHERAL DEVICE FOR A HOST IN A SHARED ELECTRONIC ENVIRONMENT

• US 20160149921A1
• Filed: 01/28/2016
• Published: 05/26/2016
• Est. Priority Date: 03/07/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Potlapally, Nachiketh Rao, Marr, Michael David
• Granted Patent: US 9,578,034 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A trusted peripheral device can be utilized with an electronic resource, such as a host machine, in order to enable the secured performance of security and remote management in the electronic environment, where various users might be provisioned on, or otherwise have access to, the electronic resource. The peripheral can have a secure channel for communicating with a centralized management system or service, whereby the management service can remotely connect to this trusted peripheral, using a secure and authenticated network connection, in order to run the above-described functionality on the host to which the peripheral is attached.

Claims

1. A peripheral device, comprising:

a device body including at least one connector for connecting to a host machine, the connector providing a first communication channel enabling communication between the host machine and the peripheral device;

a processor connected to the device body and operable to receive communications from the host machine over the first communication channel;

a second communication channel enabling secure communications to a management entity of a shared resource environment including the host machine, the second communication channel being inaccessible to the host machine; and

memory including instructions for performing privileged security functionality and management functionality, the memory further including instructions that, when executed by the processor of the peripheral device, enable the peripheral device to;

receive, from the management entity and over the second communication channel, a management instruction relating to at least one of the security or the management functionality;

utilize the instructions stored on the peripheral device in order to execute the management instruction; and

send, to the management entity and over the second communication channel, information resulting from the executing of the management instruction, wherein the information resulting from the executing of the management instruction is inaccessible to the host machine.