Technologies for secure server access using a trusted license agent

• US 10,135,828 B2
• Filed: 08/21/2017
• Issued: 11/20/2018
• Est. Priority Date: 03/27/2015
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Lenz, Oron, Milshten, Noam, Berdichevsky, Ilya
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Teng, Louis C
• Application Number:
  US15/681,955
• Publication Number:
  US 20180041513A1
• Time in Patent Office: 456 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 2463/103 applying security measure for protecting copy right protecting software against unauthorised usage in a vending or licensing environment, e.g. protection the software providers copyright G06F21/10; data processing systems or methods, specially adapted for payment schemes, architectures or protocols G06Q20/00; secrecy systems or subscription systems H04N7/16
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Technologies for secure server access include a client computing device that loads a license agent into a secure enclave established by a processor of the client computing device. The license agent receives a request from an application to access a remote server device. The license agent opens a secure connection with the server device and performs remote attestation of the secure enclave. The license agent authenticates the user and transmits a machine identifier and a user identifier to the server device. The machine identifier may be based on an enclave sealing key of the client computing device. The server device verifies that the machine identifier and the user identifier are bound to a valid application license. If the machine identifier and the user identifier are successfully verified, the application communicates with the server device using the secure connection. Other embodiments are described and claimed.

Claims

1. A method for secure server access, the method comprising:

loading, by a computing device, a license agent into a secure enclave established by a processor of the computing device;

binding, by the license agent, a machine identifier and a user identifier to an application license, wherein binding the machine identifier and the user identifier to the application license comprises transmitting the machine identifier and the user identifier to a remote server;

receiving, by the license agent, a request to access the remote server from an application of the computing device in response to binding the machine identifier and the user identifier to application license;

performing, by the license agent, remote attestation of the secure enclave with the remote server via secure connection between the license agent and the remote server;

authenticating, by the license agent, a user of the computing device;

transmitting, by the license agent, the machine identifier and the user identifier to the remote server via the secure connection in response to authenticating the user, wherein the machine identifier identifies the computing device and the user identifier identifies the user of the computing device; and

allowing, by the license agent, the application to access the secure connection with the remote server in response to authenticating the machine identifier and the user identifier.

2. The method of claim 1, further comprising generating, by the license agent, the machine identifier as a function of a unique key, wherein the unique key is unique to a combination of the secure enclave and the computing device.

3. The method of claim 2, wherein the unique key comprises an enclave sealing key.

4. The method of claim 2, wherein generating the machine identifier further comprises generating the machine identifier as a function of a server challenge data item received from the remote server.

5. The method of claim 1, wherein performing remote attestation of the secure enclave comprises:

generating, by the license agent, a measurement of the secure enclave; and

transmitting, by the license agent, the measurement of the secure enclave to the remote server.

6. The method of claim 5, wherein generating the measurement of the secure enclave comprises generating a measurement indicative of a security log associated with the secure enclave, wherein the security log is indicative of contents of the secure enclave and an order of creation of the secure enclave.

7. The method of claim 1, wherein authenticating the user of the computing device comprises receiving user credentials from the user using a trusted I/O path of the computing device.

8. The method of claim 1, further comprising opening, by the license agent, the secure connection with the remote server in response to receiving the request to access the remote sever.

9. The method of claim 1, further comprising:

receiving, by the license agent, a successful response from the remote server in response to transmitting the machine identifier and the user identifier;

wherein allowing the application to access the secure connection in response to authenticating the machine identifier and the user identifier comprises allowing the application to access the secure connection in response to receiving the successful response.

10. A method for secure server access, the method comprising:

binding, by a computing device, a first machine identifier and a first user identifier to an application license, wherein the first machine identifier identifies a particular combination of a client computing device and a secure enclave established by a processor of the client computing device and the first user identifier identifies a particular user of the client computing device;

opening, by the computing device, a secure connection with the client computing device;

performing, by the computing device, remote attestation of the secure enclave of the client computing device via the secure connection;

receiving, by the computing device, a second machine identifier and a second user identifier from the client computing device via the secure connection;

determining, by the computing device, whether the second machine identifier matches the first machine identifier and whether the second user identifier matches the first user identifier; and

allowing, by the computing device, the client computing device to access data of the computing device via the secure connection in response to (i) performing the remote attestation of the secure enclave and (ii) determining that the second machine identifier matches the first machine identifier and that the second user identifier matches the first user identifier.

11. The method of claim 10, wherein the first machine identifier is generated as a function of a unique key, wherein the unique key is unique to the combination of the client computing device and the secure enclave of the client computing device.

12. The method of claim 11, wherein the unique key comprises an enclave sealing key.

13. The method of claim 10, wherein binding the first machine identifier and the first user identifier to the application license comprises transmitting a server challenge data item to the client computing device, wherein the machine identifier is further indicative of the server challenge data item.

14. The method of claim 10, wherein performing remote attestation of the secure enclave of the client computing device comprises:

receiving, via the secure connection, a measurement of the secure enclave; and

verifying that the secure enclave is intact based on the measurement of the secure enclave.

15. The method of claim 14, wherein the measurement of the secure enclave is indicative of a security log associated with the secure enclave, wherein the security log is indicative of contents of the secure enclave and an order of creation of the secure enclave.

16. The method of claim 10, wherein allowing the client computing device to access the data comprises transmitting a successful response to the client computing device.

17. The method of claim 10, wherein binding the first machine identifier and the first user identifier to the application license comprises receiving the first machine identifier and the first user identifier from the client computing device.