Stateless attestation system

• US 8,474,037 B2
• Filed: 01/05/2009
• Issued: 06/25/2013
• Est. Priority Date: 01/07/2008
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Weiss, Yoav, Bogner, Etay
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): SCHMIDT, KARI L
• Application Number:
  US12/348,357
• Publication Number:
  US 20090178138A1
• Time in Patent Office: 1,632 Days
• Field of Search: 726/22, 726 25- 26, 726/29, 726/2, 726/5, 726/8, 713187-188, 713/155, 713/168, 713/182, 709/217
• US Class Current: 726/22
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method includes assessing a trustworthiness level of a user computer by communication between the user computer and a first server. A record indicating the trustworthiness level is sent from the first server to the user computer, for storage by the user computer. A request is sent from the user computer to a second server, different from the first server, for a service to be provided to the user computer by the second server. The record is provided from the user computer to the second server by communicating between the user computer and the second server. At the second server, the trustworthiness level is extracted from the record, and the requested service is conditionally allowed to be provided to the user computer depending on the extracted trustworthiness level.

Claims

1. A method, comprising:

running on a user computer a first operating environment for performing general purpose operations and a second operating environment configured exclusively for providing a secure communication session, wherein the second operating environment is isolated from the first operating environment, wherein general-purpose operations performed in the first operating environment do not affect operation of the second operating environment;

communicating between the user computer and a first server to assess a trustworthiness level of the second operating environment of the user computer by communication between the second operating environment of the user computer and the first server;

receiving by the user computer, a record from the first server indicating the trustworthiness level for storage by the second operating environment of the user computer;

sending a request from the user computer to a second server, different from the first server, for a service to be provided to the user computer by the second server; and

providing the record from the user computer to the second server by communicating between the user computer and

the second server, to cause the second server to extract the trustworthiness level from the record, and conditionally allow the requested service to be provided to the user computer depending on the extracted trustworthiness level.

2. The method according to claim 1, wherein assessing the trustworthiness level comprises obtaining from the user computer information regarding a configuration of the user computer, and computing the trustworthiness level based on the obtained information.

3. The method according to claim 2, wherein Obtaining the information comprises obtaining a secure signature of at least part of an operating system of the user computer, and wherein computing the trustworthiness level comprises comparing the obtained signature to a list of legitimate signatures.

4. The method according to claim 1, wherein sending the record comprises signing the record with a secure signature by the first server.

5. The method according to claim 1, wherein sending the record comprises encrypting the record by the first server.

6. The method according to claim 1, wherein sending the record comprises including in the record at least one parameter selected from a group of parameters consisting of a time stamp indicating a time at which the trustworthiness was assessed, a unique identifier of the user computer provided to the first server upon initial interaction with the user computer, a Platform Configuration Register (PCR) obtained from a Trusted Platform Module (TPM) in the user computer, an indication of a network location of the user computer, an identity of a user of the user computer, and an identifier of a trusted site with which the user computer communicates.

7. The method according to claim 1, wherein assessing the trustworthiness comprises obtaining from the user computer a value of a secure counter that is incremented in accordance with predefined logic during each interaction of the user computer with the first server, and wherein sending the record comprises storing the value of the secure counter in the record.

8. The method according to claim 1, wherein the first server comprises multiple first servers, and wherein assessing the trustworthiness comprises obtaining from the user computer a value of a secure counter that is incremented in accordance with predefined logic during each interaction of the user computer with the first servers, and detecting, based on the value of the secure counter, that a previous interaction of the user computer with one of the first servers was terminated abnormally.

9. The method according to claim 8, wherein detecting that the previous interaction was terminated abnormally comprises verifying whether the value of the secure counter is an integer multiple of a predefined number.

10. The method according to claim 8, wherein obtaining the value comprises obtaining from the user computer a first value of the secure counter that is stored in the record, and a second value indicating a current value of the secure counter, and wherein detecting that the previous interaction was terminated abnormally comprises comparing the first value to the second value.

11. The method according to claim 1, and comprising, responsively to allowing the requested service, communicating between the user computer and the second server so as to provide the service.

12. A networked computer system, comprising:

one or more user computers, each to run a first operating environment for performing general purpose operations and a second operating environment configured exclusively for providing a secure communication session, wherein the second operating environment is isolated from the first operating environment, wherein general-purpose operations performed in the first operating environment do not affect operation of the second operating environment;

one or more first servers, which are configured to assess respective trustworthiness levels of the second operating environments of the respective user computers, and to forward records indicating the assessed trustworthiness levels to the user computers for storage by respective second operating environments of the user computers; and

second server, separate from the first servers, which is configured to obtain the records from the user computers along with requests from the user computers for service to be provided by the second server, to extract the trustworthiness levels from the records, and to conditionally provide the service to the user computers depending on the extracted thustworthiness levels.

13. The system according to claim 12, wherein at least one of the first servers is configured to obtain from a given user computer information regarding a configuration of the given user computer, and to compute a trustworthiness level of the given user computer based on the obtained information.

14. The system according to claim 13, wherein the at least one of the first servers is configured to obtain from the given user computer a secure signature of at least part of an operating system of the given user computer, and to compare the obtained signature to a list of legitimate signatures.

15. The system according to claim 12, wherein at least one of the first servers is configured to sign the records with secure signatures.

16. The system according to claim 12, wherein at least one of the first servers is configured to encrypt the records.

17. The system according to claim 12, wherein at least one of the first servers is configured to include in the records at least one parameter selected from a group of parameters consisting of a time stamp indicating a time at which a given trustworthiness was assessed, a unique identifier of a given user computer provided upon initial interaction with the given user computer, a Platform Configuration Register (PCR) obtained from a Trusted Platform Module (TPM) in the given user computer, an indication of a network location of the given user computer, an identity of a user of the given user computer, and an identifier of a trusted site with which the given user computer communicates.

18. The system according to claim 12, wherein at least one of the first servers is configured to obtain from a given user computer a value of a secure counter that is incremented in accordance with predefined logic during each interaction of the given user computer with the first servers, and to store the value of the secure counter in a record forwarded to the given user computer.

19. The system according to claim 12, wherein at least one of the first servers is configured to obtain from a given user computer a value of a secure counter that is incremented in accordance with predefined logic during each interaction of the given user computer with the first servers, and to detect, based on the value of the secure counter, that a previous interaction of the given user computer with one of the first servers was terminated abnormally.

20. The system according to claim 19, wherein the at least one of the first servers is configured to detect that the previous interaction was terminated abnormally by checking whether the value of the secure counter is an integer multiple of a predefined number.

21. The system according to claim 19, wherein the at least one of the first servers is configured to obtain from the given user computer a first value of the secure counter that is stored in the record, and a second value indicating a current value of the secure counter, and to detect that the previous interaction was terminated abnormally by comparing the first value to the second value.

22. The system according to claim 12, wherein the second server is configured to communicate with a given user computer and to provide the service to the given user computer responsively to allowing the requested service to the given user computer.

23. A user computer, comprising:

an network interface device, which is operative to communicate with multiple servers over a communication network; and

a processor device, which is coupled to run a first operating environment configured to perform general-purpose operations, and a second operating environment configured exclusively for providing a secure communication session, wherein the second operating environment is isolated from the first operating environment, wherein general-purpose operations performed in the first operating environment do not affect operation of the second operating environment, to communicate with a first server over the network interface device to assess a trustworthiness level of the second operating environment, to receive a record from the first server indicating the trustworthiness level for storage by the second operating environment of the user computer, send a request to a second server different from the first server for a service to be provided to the user computer by the second server, and provide the record to the second server to cause the second server to extract the trustworthiness level from the record and conditionally obtain the requested service depending on the extracted trustworthiness level.