Authentication objects with attestation

• US 10,050,787 B1
• Filed: 03/25/2014
• Issued: 08/14/2018
• Est. Priority Date: 03/25/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Johansson, Jesper Mikael, Roth, Gregory Branchek, Platz, David Matthew, Vippagunta, Rajendra Kumar
• Primary Examiner(s): Vostal, O. C.
• Application Number:
  US14/225,302
• Time in Patent Office: 1,603 Days
• Field of Search: 713176, 713276
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Representations of authentication objects are selectable through a user interface, such as through a drag and drop operation. When an authentication object is selected by a user, a corresponding authentication object (e.g., in the form of an authentication claim) is transmitted to s system for authentication. The authentication object may contain information that is sufficient for authentication with the system and the information may include an attestation to the state of a computing environment from which the authentication object is transmitted.

Claims

1. A computer-implemented method, comprising:

under the control of a client computing device configured with executable instructions,

generating a graphical user interface that makes a plurality of graphical representations available for selection, at least a subset of the graphical representations including a graphical representation that represents a set of actions for authenticating an identity with a service provider system;

receiving, from a user input device, user input indicating a user selection from the plurality of graphical representations of the graphical representation and a request to authenticate with the service provider system, wherein the selection of the representation is a result of a drag and drop operation using the graphical user interface; and

as a result of receiving the user input;

obtaining an attestation that a component of the client computing device is of a particular version;

obtaining an authentication claim that is based at least in part on the attestation and that corresponds to the graphical representation selected, the authentication claim sufficient for authenticating the identity with the service provider system; and

providing the authentication claim to the service provider system so that the service provider system can authenticate the identity using the authentication claim.

2. The computer-implemented method of claim 1, wherein:

obtaining the attestation of the client computing device includes receiving an attestation from a trusted platform module of the client computing device; and

the attestation is cryptographically verified as a result of comprising a digital signature generated by the trusted platform module.

3. The computer-implemented method of claim 2, wherein the attestation is based at least in part on output of a cryptographic hash function applied to at least a portion of executable instructions of at least one of firmware of the client computing device, an operating system of the client computing device, or an application of the client computing device.

4. The computer-implemented method of claim 1, wherein:

the graphical user interface is of an application that manages the graphical representations; and

the attestation includes at least an attestation as to a state of the application.

5. The computer-implemented method of claim 1, wherein:

the authentication claim is based at least in part on at least one long-term credential necessary for authentication with the service provider system; and

providing the authentication claim is performed without requiring input of the at least one long-term credential between selection of the graphical representation and providing the authentication claim to the service provider system.

6. The computer-implemented method of claim 1, wherein at least a portion of the authentication claim is encrypted using a public cryptographic key corresponding to a private cryptographic key accessible to the service provider system.

7. The computer-implemented method of claim 1, wherein the attestation is a cryptographic attestation.

8. The computer-implemented method of claim 1, wherein the attestation is cryptographically verifiable using a cryptographic key.

9. A computer system, comprising:

one or more processors; and

memory including executable instructions that, as a result of execution by the one or more processors, cause the computer system to;

provide a set of representations for selection via an interface on a client computing device, a representation of the set of representations associated with a set of actions for authenticating an identity with a service provider system;

receive a selection of the representation from the set of representations, wherein the selection of the representation is a result of a drag and drop operation using a graphical user interface;

as a result of the selection of the representation, obtain an authentication claim that is sufficient, as a result of an attestation at least including an attestation to a component of the client computing device having a particular version, for authenticating the identity; and

provide the authentication claim for authentication.

10. The computer system of claim 9, wherein the executable instructions that cause the computer system to obtain the authentication claim cause the computer system to generate the authentication claim in response to receipt of the selection of the representation.

11. The computer system of claim 9, wherein the attestation is cryptographically verifiable using a cryptographic key.

12. The computer system of claim 9, wherein the attestation-comprises output of a cryptographic hash function applied to at least a portion of executable instructions of an application of a computing device that generated the attestation.

13. The computer system of claim 9, wherein the attestation includes information indicating that a task configured to distinguish human operators from automated agents was performed.

14. The computer system of claim 13, wherein:

the information indicating that the task configured to distinguish human operators from automated agents includes information including purported proof of successful performance of the task; and

the attestation being valid requires verification of the purported proof.

15. The computer system of claim 9, wherein the authentication claim is generated prior to receipt of the input indicating the selection of the representation.

16. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:

receive input indicating a selection, via an interface on a client computing device and from a set of representations, of a representation of a set of actions for authenticating an identity, wherein the selection of the representation is a result of a drag and drop operation using a graphical user interface;

as a result of the selection of the representation, obtain an authentication claim, the authentication claim sufficient for authentication as a result of including an attestation to a component of the client computing device having a particular version; and

provide the authentication claim for authentication of the identity.

17. The non-transitory computer-readable storage medium of claim 16, wherein the authentication claim is generated prior to receipt of the input indicating the selection of the representation.

18. The non-transitory computer-readable storage medium of claim 16, wherein the executable instructions further include instructions that cause the computer system to generate the authentication claim using a private cryptographic key corresponding to a public cryptographic key usable to verify authenticity of the authentication claim.

19. The non-transitory computer-readable storage medium of claim 16, wherein the executable instructions that cause the computer system to obtain the attestation cause the computer system to communicate with a cryptographic module of the computer system to receive the attestation.

20. The non-transitory computer-readable storage medium of claim 16, wherein the authentication claim is based at least in part on at least one long-term credential associated with a user.

21. The non-transitory computer-readable storage medium of claim 16, wherein the attestation encodes information based at least in part on one or more sensors of the computer system.

22. The non-transitory computer-readable storage medium of claim 16, wherein:

the executable instructions further cause the computer system to receive a policy and verify compliance of the client computing device with the policy received; and

the attestation indicates compliance with the policy received.

23. The non-transitory computer-readable storage medium of claim 16, wherein the attestation is cryptographically verifiable.