Enterprise platform verification

• US 9,391,980 B1
• Filed: 11/11/2013
• Issued: 07/12/2016
• Est. Priority Date: 11/11/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Krahn, Darren, Gwalani, Sumit, Drewry, William Alexander
• Primary Examiner(s): Jeudy, Josnel
• Application Number:
  US14/077,120
• Time in Patent Office: 974 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Systems and methods for enterprise platform verification are provided. In some aspects, a computing device includes a trusted platform module (TPM). The TPM includes an endorsement key (EK) physically embedded in the TPM. The TPM includes an attestation identity key (AIK), the AIK being used to verify that at least one TPM-protected key different from the EK and different from the AIK is generated at the TPM and is non-migratable. The TPM includes an enterprise machine key (EMK), the EMK being certified by the AIK, the EMK being uniquely associated with the client computing device, and the EMK being generated during enrollment of the client computing device with an enterprise and remaining active until a factory reset of the client computing device.

Claims

1. A client computing device comprising:

one or more processors;

a memory; and

a trusted platform module (TPM) residing on a separate application-specific integrated circuit (ASIC) from the one or more processors and from the memory, the TPM storing;

an endorsement key (EK) physically embedded in the TPM;

an attestation identity key (AIK), the AIK being used to verify that at least one TPM-protected key different from the EK and different from the AIK is generated at the TPM and is non-migratable;

an enterprise machine key (EMK), the EMK being certified by the AIK, the EMK being uniquely associated with the client computing device, and the EMK being generated during enrollment of the client computing device with an enterprise and remaining active until a factory reset of the client computing device;

one or more enterprise user keys (EUKs), each EUK being certified by the AIK, each EUK being associated with the client computing device, and each EUK being associated with a user account of the client computing device and remaining active until the associated user account is removed from the client computing device;

the memory comprising a platform verification module, the platform verification module storing instructions for;

receiving, via an application server, a request for platform verification of the client computing device and processing the request; and

providing, in response to the request for platform verification, identifying information of the EMK to a platform verification server while foregoing providing the identifying information of the EMK to the application server.

2. The client computing device of claim 1, the platform verification module further storing instructions for:

providing, in response to the request for platform verification, identifying information of a specified EUK from among the one or more EUKs to the platform verification server while foregoing providing the identifying information of the specified EUK to the application server.

3. The client computing device of claim 1, the platform verification module further storing instructions for:

signaling for the platform verification server to notify the application server that the platform verification is successful in response to the platform verification server receiving the identifying information of the EMK.

4. The client computing device of claim 1, wherein the identifying information of the EMK comprises a certificate or a proof-of-possession of the EMK.

5. The client computing device of claim 1, wherein the AIK is activated by the EK and certified by a privacy certificate authority.

6. The client computing device of claim 1, wherein the AIK is generated during initial setup of the client computing device by a user, using a TPM owner privilege accessible via a TPM owner password, and wherein the TPM owner password is deleted after the initial setup of the client computing device.

7. The client computing device of claim 1, the memory further comprising a user initialization module, the user initialization module storing instructions for:

receiving an indication of a user initialization of the client computing device;

reading the EK upon receiving the indication of the user initialization;

generating the AIK using a fake privacy certificate authority public key and the EK;

generating data regarding a platform state of the client computing device using the AIK;

connecting to a network; and

after connecting to the network;

certifying the AIK to acquire an encrypted AIK certificate from the privacy certificate authority over the network; and

decrypting the encrypted AIK certificate.

8. The client computing device of claim 7, wherein the receiving, reading, and two generating instructions are executed while the client computing device is not connected to the network.

9. The client computing device of claim 1, wherein the AIK is used to verify that each and every TPM-protected key different from the EK and different from the AIK is generated at the TPM and is non-migratable.

10. The client computing device of claim 1, wherein the one or more EUKs are generated in response to an attempt, by a user of the client computing device, to access an enterprise resource via the client computing device.

11. The client computing device of claim 1, wherein the EMK and the one or more EUKs are certified by the AIK and by a privacy certificate authority.

12. The client computing device of claim 1, wherein at least one user account of the client computing device is associated with a plurality of EUKs.

13. A method implemented at a platform verification server, the method comprising:

receiving, at the platform verification server and from an application server, a request for platform verification of a client computing device, the platform verification server being separate from the application server;

transmitting, from the platform verification server to the client computing device, in response to the request for platform verification, a request that the client computing device provide identifying information of an enterprise machine key (EMK) of the client computing device to the platform verification server, wherein the client computing device comprises a trusted platform module (TPM) storing an endorsement key (EK), an attestation identity key (AIK), the EMK, and an enterprise user key (EUK), the EMK being certified by the AIK, the EUK being certified by the AIK and associated with a user account of the client computing device;

receiving, at the platform verification server and from the client computing device, the identifying information of the EMK, wherein receiving of the identifying information of the EMK at the application server from the client computing device is avoided;

verifying, using a certificate associated with the client computing device and stored at the platform verification server, whether the EMK of the client computing device is valid;

providing, from the platform verification server to the application server, a direct indication that the platform verification of the client computing device is successful in a case where the EMK of the client computing device is valid; and

providing, from the platform verification server to the application server, a direct indication that the platform verification of the client computing device is unsuccessful in a case where the EMK of the client computing device is invalid.

14. The method of claim 13, further comprising:

transmitting, from the platform verification server to the client computing device, a request to verify that the client computing device verify that the client computing device is being accessed via a valid user account, the request to verify that the client computing device verify that the client computing device is being accessed via the valid user account comprising a request for identifying information of the EUK corresponding to the user account accessing the client computing device;

receiving, at the platform verification server and from the client computing device, the identifying information of the EUK;

verifying, using a certificate associated with the client computing device and stored at the platform verification server, whether the EUK is valid;

providing, from the platform verification server to the application server, the indication that the platform verification of the client computing device is successful in a case where the EUK of the client computing device is valid; and

providing, to the application server, the indication that the platform verification of the client computing device is unsuccessful in a case where the EUK of the client computing device is invalid.

15. The method of claim 13, further comprising:

extracting, from the identifying information of the EMK, a signed public key and challenge (SPKAC) of the client computing device;

providing, to the application server, the SPKAC of the client computing device for creating, at the application server, a certificate for the client computing device.

16. The method of claim 15, further comprising:

signaling for providing, from the application server to the client computing device for installation at the client computing device, the certificate associated with the client computing device.

17. The method of claim 15, further comprising:

discarding, at the platform verification server, metadata in the identifying information of the EMK that is not relevant to the SPKAC; and

signaling for the client computing device to discard the metadata in the identifying information of the EMK that is not relevant to the SPKAC.

18. The method of claim 13, wherein the identifying information of the EMK comprises a certificate or a proof-of-possession of the EMK.

19. The method of claim 13, wherein the indication that the platform verification of the client computing device is successful comprises a first Boolean value, and wherein the indication that the platform verification of the client computing device is unsuccessful comprises a second Boolean value different from the first Boolean value.

20. A non-transitory computer-readable medium comprising instructions which, when executed by one or more computers, cause the one or more computers to implement a method, the method comprising:

receiving, at a platform verification server and from an application server, a request for platform verification of a client computing device, the platform verification server being separate from the application server;

receiving, at the platform verification server and from the client computing device, identifying information of an enterprise machine key (EMK) of the client computing device, wherein receiving of the identifying information of the EMK at the application server from the client computing device is avoided, wherein the client computing device comprises a trusted platform module (TPM) storing an endorsement key (EK), an attestation identity key (AIK), the EMK, and an enterprise user key (EUK), the EMK being certified by the AIK, the EUK being certified by the AIK and associated with a user account of the client computing device;

verifying, using a certificate associated with the client computing device and stored at the platform verification server, whether the EMK of the client computing device is valid;

providing, from the platform verification server to the application server, a direct indication that the platform verification of the client computing device is successful in a case where the EMK of the client computing device is valid, while foregoing providing the identifying information of the EMK to the application server; and

providing, from the platform verification server to the application server, a direct indication that the platform verification of the client computing device is unsuccessful in a case where the EMK of the client computing device is invalid, while foregoing providing the identifying information of the EMK to the application server.