Self regulation of the subject of attestation

• US 8,880,667 B2
• Filed: 02/09/2011
• Issued: 11/04/2014
• Est. Priority Date: 02/09/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Novak, Mark F., Thom, Stefan, Tor, Yair, Efron, Alexey, Ortal, Amos
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Torres-Diaz, Lizbeth
• Application Number:
  US13/024,288
• Publication Number:
  US 20120204020A1
• Time in Patent Office: 1,364 Days
• Field of Search: 713/155, 713/159, 713/161, 713168-170, 713176-179, 705/67, 726 1- 36, 380/258
• US Class Current: 709/223
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Attestation by a self-regulating attestation client. The attestation client requests a credential of health from an attestation service, which includes an ordered attestation log and proof of integrity and freshness of the log. The attestation client receives the requested credential of health, which certifies the attestation client was healthy when it requested the credential of health and that the attestation service trusts the attestation client to be healthy each time the attestation client authenticates using the credential of health. The attestation client receives a request to authenticate that it is healthy using the credential of health, verifies that it is currently healthy, and performs the requested authentication.

Claims

1. A method implemented within a self-regulating attestation client computing system and that includes one or more processors and memory storing instructions which, when executed by the one or more processors, implement the method for using a certificate of health from an attestation service to authenticate that the self-regulating attestation client computing system is currently healthy upon request, the method comprising the acts of:

the computing system of the attestation client requesting a credential of health from an attestation service, the credential of health from the attestation service comprising a digital certificate or token that is signed by a public cryptographic key provided by the computing system, the request comprising an ordered attestation log as well as a proof of integrity and freshness of the ordered attestation log, the proof of integrity and freshness being implemented by the attestation service to verify the integrity and freshness of the log itself;

the computing system receiving the credential of health from the attestation service, the credential of health uniquely identifying the computing system and certifying that the computing system was healthy when the computing system requested the credential of health and that the attestation service trusts the computing system to be healthy each time the computing system authenticates using the credential of health, such that the credential of health is only sent to and received by the computing system in response to the attestation service having verified the past health attestation of the computing system and, upon verifying the past health attestation of the computing system, the ability for the computing system to verify that the computing system will only use the credential of health when the computing system is currently in a healthy state and when the credential of health is not expired;

the computing system receiving a request to use the credential of health to authenticate that it is currently healthy;

the computing system verifying that it is currently healthy; and

the computing system using the credential of health to authenticate that it currently healthy.

2. The method in accordance with claim 1, wherein certifying that the computing system was healthy when the computing system requested the credential of health comprises:

certifying that one or more components that were loaded at the computing system when the computing system made the request comprises a healthy state.

3. The method in accordance with claim 2, wherein certifying that the attestation service trusts the computing system to be healthy each time the computing system authenticates using the credential of health comprises:

certifying that the computing system includes one or more monitoring agents that are trusted by the attestation service to enforce one or more security policies, such that the computing system is trusted to defend itself to maintain a healthy state and such that the computing system is trusted to use the credential of health to authenticate that is it currently healthy only when the computing system is in a healthy state.

4. The method in accordance with claim 3, wherein the ordered attestation log includes:

an ordered log of all of the one or more components that were loaded at the computing system when the computing system made the request, along with a configuration of the components;

an identity of the one or more monitoring agents; and

information regarding the one or more security policies.

5. The method in accordance with claim 3, wherein the computing system refuses to use the credential of health to authenticate that is it currently healthy either by voluntarily refusing to authenticate or by irrevocably yielding access to a private cryptographic key necessary for authentication.

6. The method m accordance with claim 1, further comprising:

the computing system generating the public cryptographic key and a private cryptographic key; and

the computing system sending the public cryptographic key to the attestation service.

7. The method in accordance with claim 6, wherein the credential of health uniquely identifying the computing system comprises the credential of health including or being based on the public cryptographic key;

and wherein the computing system using the credential of health to authenticate that it currently healthy comprises the computing system using the private cryptographic key in connection with the credential of health to perform the authentication.

8. The method in accordance with claim 1, wherein the computing system verifying that it is currently healthy comprises one or more of:

the computing system verifying that it has not violated the one or more security policies, the computing system verifying whether it has access to a private cryptographic key necessary to perform the authentication, or the computing system verifying that one or more monitoring agents are running and report a healthy state.

9. The method in accordance with claim 1, further comprising:

the computing system determining that a misdemeanor event has occurred;

the computing system temporarily leaving a healthy state and entering an impaired state;

the computing system receiving a different request to authenticate that it is currently healthy; and

the computing system voluntarily refusing to authenticate that it is currently healthy as a result of being in the impaired state.

10. The method in accordance with claim 9, further comprising:

the computing system determining that a remediation event has occurred; and

the computing system to leaving the impaired state and entering the healthy state.

11. The method in accordance with claim 1, further comprising:

the computing system determining that a felony event has occurred;

the computing system permanently leaving a healthy state or an impaired state and entering a failed state;

the computing system relinquishing access to a private key that is necessary to authenticate using the credential of health, such that the computing system is no longer able to authenticate; and

the computing system writing an event to the ordered attestation log which causes any future requests for a credential of health to fail.

12. The method in accordance with claim 1, wherein the ordered attestation comprises a Trusted Computing Group (TCG) log.

13. A method implemented within a computing system that includes one or more processors and memory storing instructions which, when executed by the one or more processors, implement the method for generating a credential of health for a self-regulating attestation client, the method comprising the acts of:

the computing system receiving a request from a self-regulating attestation client for a credential of health, the credential of health from the attestation service comprising a digital certificate or token that is signed by a public cryptographic key provided by the computing system, the request comprising an ordered attestation log as well as a proof of integrity and freshness of the ordered attestation log, the proof of integrity and freshness being implemented by the attestation service to verify the integrity and freshness of the log itself;

the computing system verifying that the self-regulating attestation client was healthy when the self-regulating attestation client requested the credential of health, based on the ordered attestation log and the proof of integrity and freshness of the ordered attestation log;

the computing system verifying that the self-regulating attestation client is trusted to be healthy, each time the self-regulating attestation client authenticates using the credential of health, based on the ordered attestation log having information that verifies that the computing system is a self-regulating client that actively defends itself against malware and other untrusted code and verifies that the computing system will only use the credential of health when the computing system is currently in a healthy state and when the credential of health is not expired, and based on the proof of integrity and freshness of the ordered attestation log;

the computing system generating the credential of health, the generated credential of health uniquely identifying the self-regulating attestation client and certifying both that the self-regulating attestation client was healthy when the self-regulating attestation client requested the credential of health and also that the attestation service trusts the self-regulating attestation client to be healthy each time in the future that the self-regulating attestation client authenticates using the credential of health; and

the computing system sending the generated credential of health to the self-regulating attestation client.

14. The method in accordance with claim 13, wherein verifying that the self-regulating attestation client was healthy when the self-regulating attestation client requested the credential of health comprises:

certifying that one or more components that were loaded at the self-regulating attestation client when the self-regulating attestation client made the request comprises a healthy state.

15. The method in accordance with claim 13, wherein verifying that the self-regulating attestation client is trusted to be healthy each time the self-regulating attestation client authenticates using the credential of health comprises:

certifying that the self-regulating attestation client includes one or more monitoring agents that are busted by the attestation service to enforce one or more security policies, such that the self-regulating attestation client is busted to defend itself to maintain a healthy state and such that the self-regulating attestation client is trusted to use the credential of health to authenticate that is it currently healthy only when the self-regulating attestation client is in a healthy state.

16. The method in accordance with claim 15, wherein the ordered attestation log includes:

an ordered log of all of the one or more components that were loaded at the self-regulating attestation client when the self-regulating attestation client made the request, along with a configuration of the components;

an identity of the one or more monitoring agents; and

information regarding the one or more security policies.

17. The method in accordance with claim 13, further comprising:

receiving a public cryptographic key from the self-regulating attestation client that uniquely identifies the self-regulating attestation client; and

including or basing the credential of health on the public cryptographic key so that the generated credential of health uniquely identifies the self-regulating attestation client.

18. The method in accordance with claim 13, wherein the generated credential of health comprises a cryptographic digital certificate or token.

19. The method in accordance with claim 13, wherein at least one of the acts of verifying comprises:

validating that the ordered attestation log is valid based on the proof of integrity and freshness; and

processing the entire ordered attestation log.

20. A hardware storage device having stored thereon computing executable instructions that, when executed by one or more processors of a self-regulating attestation client computing system, implement a method for the computing system performing a self-regulated attestation of health, the method comprising the acts of:

performing a measured boot of the computing system by loading one or more trusted boot-time components while recording information about the busted boot-time components in an ordered attestation log;

loading one or more trusted internal monitoring agents that enforce one or more security policies at the computing system and that protect the integrity of the computing system through enforcement of the security policies, while recording information about the identity of the trusted internal monitoring agents and the security policies in the ordered attestation log;

generating a public cryptographic key and a private cryptographic key unique to the computing system and sending the public cryptographic key to an attestation service;

sending a request for a credential of health to the attestation service, the credential of health from the attestation service comprising a digital certificate or token that is signed by the public cryptographic key provided by the computing system, the request including the ordered attestation log and proof of integrity and freshness of the ordered attestation log, the proof of integrity and freshness being implemented by the attestation service to verify the integrity and freshness of the log itself;

receiving the credential of health from the attestation service, the credential of health indicating that the attestation service trusts the integrity of the measured boot of the computing system, that the attestation service trusts the computing system to defend itself to maintain a healthy state using the internal monitoring agents and the security policies, and that the attestation service trusts the computing system to use the credential of health to authenticate that is it currently healthy only when the computing system is in a healthy state, such that the credential of health is only sent to and received by the computing system in response to the attestation service having verified the past health attestation of the computing system and, upon verifying the past health attestation of the computing system, the ability for the computing system to verify that the computing system will only use the credential of health when the computing system is currently in a healthy state and when the credential of health is not expired;

receiving a request to verify the health of the computing system;

verifying that the computing system is currently healthy based on at least whether the computing system has violated any of the security policies; and

using the credential of health and the private cryptographic key to authenticate that the computing system is currently healthy.

21. The hardware storage device of claim 20, wherein the method further includes relinquishing access to the credential of health in response to detecting a security condition and thereafter requiring a reboot and re-attestation upon relinquishing access to the credential of health prior to using the credential of health again.

22. The hardware storage device of claim 20, wherein the method fuIlher includes distinguishing between felony events and misdemeanor events, wherein the misdemeanor events cause the attestation client computing system to be only temporarily removed from a healthy state without requiring a reboot and/or re-attestation and wherein the felony events cause the attestation client computing system to be removed from the healthy state until the attestation client computing system is first restarted and performs re-attestation.