Hardware-based device authentication

• US 9,294,478 B2
• Filed: 09/29/2014
• Issued: 03/22/2016
• Est. Priority Date: 12/23/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Von Bokern, Vincent Edward, Goel, Purushottam, Schrecker, Sven, Smith, Ned McArthur
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US14/500,130
• Publication Number:
  US 20150200937A1
• Time in Patent Office: 540 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/71 Hardware identity

Abstract

An opportunity for a computing device to participate in a secure session with a particular domain is identified. A domain identifier of the particular domain is received and a secured microcontroller of the computing device is used to identify a secured, persistent hardware identifier of the computing device stored in secured memory of the computing device. A secure identifier is derived for a pairing of the computing device and the particular domain based on the hardware identifier and domain identifier of the particular domain and the secure identifier is transmitted over a secured channel to the particular domain. The particular domain can verify identity of the computing device from the secure identifier and apply security policies to transactions involving the computing device and the particular domain based at least in part on the secure identifier.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

detect that a computing device has entered a particular domain;

receive a domain identifier of the particular domain over a network associated with the particular domain, the domain identifier included in a domain certificate;

identify, using a secured microcontroller of the computing device, a secured, persistent hardware identifier of the computing device stored in secured memory of the computing device, wherein the secured microcontroller is independent of an operating system of the computing device and values of secure identifiers derived by the secured microcontroller are hidden from the operating system, the hardware identifier derived from a fuse key stored in a non-volatile memory of the computing device during fabrication; and

derive, using the secured microcontroller, a secure identifier for a pairing of the computing device and the particular domain based on the hardware identifier and the domain identifier of the particular domain.

2. The storage medium of claim 1, wherein at least some of the secure identifiers are to map to a user profile.

3. The storage medium of claim 1, wherein the value of the secure identifier is derived by the secured microcontroller via a hash operation.

4. The storage medium of claim 1, wherein the secure identifier is a unique identifier within a system to correspond to the pairing of the computing device and the particular domain.

5. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to:

receive a request to reset the hardware identifier;

reset the hardware identifier; and

derive a replacement hardware identifier, wherein the replacement hardware identifier comprises a secured, persistent identifier.

6. The storage medium of claim 5, wherein the secure identifier is a first secure identifier, and the instructions, when executed, further cause the machine to:

identify an opportunity for the computing device to participate in a secure session with the particular domain following the reset;

derive a second secure identifier for the pairing of the computing device and the particular domain based on the replacement hardware identifier and the domain identifier of the particular domain, wherein the second secure identifier is different from the first secure identifier; and

communicate the second secure identifier to a computing system associated with the particular domain.

7. The storage medium of claim 1, wherein the secure identifier is a first secure identifier, and the instructions, when executed, further cause the machine to:

identify an opportunity for the computing device to participate in a secure session with a second domain;

receive a domain identifier of the second domain;

derive a second secure identifier for a pairing of the computing device and the second domain based on the hardware identifier and the domain identifier of the second domain, wherein the second secure identifier is different from the first secure identifier; and

transmit the second secure identifier over a secured channel to the second domain.

8. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to send security posture data over the secured channel, the security posture data describing attributes of the computing device.

9. A mobile computing device comprising:

a secured microcontroller;

secured memory;

secure identifier generation logic, executable by the secured microcontroller to;

identify a domain identifier of a particular one of a plurality of domains, the domain identifier included in a domain certificate received from the particular domain;

identify a secured, persistent hardware identifier stored in the secured memory of the computing device, the hardware identifier derived from a fuse key stored in a non-volatile memory of the secured microcontroller during fabrication; and

derive a secure identifier for a pairing of the mobile computing device and the particular domain based on the hardware identifier and the domain identifier; and

a transmitter to transmit the secure identifier over a secured channel to a computing device associated with the particular domain, wherein the secured microcontroller is independent of an operating system of the mobile computing device and values of secure identifiers derived by the secured microcontroller are hidden from the operating system.

10. The mobile computing device of claim 9, wherein the secured memory comprises flash memory of the secured microcontroller.

11. The mobile computing device of claim 9, wherein the mobile computing device comprises a computer-assisted household appliance.

12. The mobile computing device of claim 9, wherein the mobile computing device comprises a media player.

13. The mobile computing device of claim 9, wherein the mobile computing device comprises a computing system of an automobile.

14. The mobile computing device of claim 9, wherein the mobile computing device comprises one of a tablet computer and a smart phone.

15. The mobile computing device of claim 9, further comprising a communication manager to provide the secure identifier to the transmitter while the operating system is inactive, the communication manager comprising an out-of-band communication channel.

16. A method comprising:

detecting that a computing device has entered a particular domain;

receiving a domain identifier of the particular domain over a network associated with the particular domain, the domain identifier included in a domain certificate;

identifying, using a secured microcontroller of the computing device, a secured, persistent hardware identifier of the computing device stored in secured memory of the computing device, wherein the secured microcontroller is independent of an operating system of the computing device and values of secure identifiers derived by the secured microcontroller are hidden from the operating system, the hardware identifier derived from a fuse key stored in a non-volatile memory of the computing device during fabrication; and

deriving, using the secured microcontroller, a secure identifier for a pairing of the computing device and the particular domain based on the hardware identifier and the domain identifier of the particular domain.

17. The method of claim 16, further comprising communicating the secure identifier, over a secure channel, to a computing system associated with the particular domain.

18. The method of claim 17, wherein the domain identifier is to be received during negotiation of a key exchange protocol used in establishing the secure channel.

19. The method of claim 16, further comprising authenticating the particular domain, wherein authentication of the particular domain permits derivation of the secure identifier.

20. The method of claim 16, wherein deriving the secure identifier comprises generating a hash from the hardware identifier and the domain identifier.