SECURE COMMUNICATION BETWEEN A VIRTUAL SMARTCARD ENCLAVE AND A TRUSTED I/O ENCLAVE

• US 20170091434A1
• Filed: 09/25/2015
• Published: 03/30/2017
• Est. Priority Date: 09/25/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Proulx, Francois, Rene, Mathieu
• Granted Patent: US 10,248,772 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A system for accessing a trusted execution environment includes instructions to transmit, from a first trusted execution environment, a request for a biometric match claim, receive, in response to the request for a biometric match claim, biometric data from a biometric capture device, perform a match of the biometric data against biometric templates stored in the first trusted execution environment, and unseal a second trusted execution environment based on the match data.

Claims

1. A machine readable medium on which instructions are stored, comprising instructions that when executed cause a machine to:

transmit, from a first trusted execution environment, a request for a biometric match claim;

receive, in response to the request for a biometric match claim, biometric data from a biometric capture device;

perform a match of the biometric data against biometric templates stored in the first trusted execution environment; and

unseal a second trusted execution environment based on the match of the biometric data.

2. The machine readable medium of claim 1, wherein the instructions that cause a machine to perform a match of the biometric data against biometric templates stored in the first trusted execution environment comprise instructions that when executed further cause the machine to:

identify a signature in the biometric data indicating that the biometric data was generated by a secure biometric capture device.

3. The machine readable medium of claim 2, wherein the first trusted execution environment and the second trusted execution environment are secure enclaves, and wherein the second trusted execution environment verifies the first trusted execution environment based on a report prior to the second trusted execution environment being unsealed.

4. The machine readable medium of claim 1, wherein the biometric capture device comprises a camera, and wherein the biometric data comprises video frames of a face.

5. The machine readable medium of claim 4, wherein the first trusted execution environment comprises face templates, and

wherein the instructions that cause a machine to perform a match of the biometric data against biometric templates stored in the first trusted execution environment comprise instructions to compare the biometric data received from the biometric capture device with the face templates.

6. The machine readable medium of claim 1, wherein an intermediary application executing in an untrusted execution environment provides communication between the first trusted execution environment and the second trusted execution environment.

7. The machine readable medium of claim 1, wherein the second trusted execution environment is a virtual smartcard, and wherein the second trusted execution environment comprises cryptographic data.

8. A system for secure communications, comprising:

one or more processors; and

a memory, coupled to the one or more processors, on which are instructions are stored which, when executed by the one or more processors cause at least some of the one or more processors to;

transmit, from a first trusted execution environment, a request for a biometric match claim;

receive, in response to the request for a biometric match claim, biometric data from a biometric capture device;

perform a match of the biometric data against biometric templates stored in the first trusted execution environment; and

unseal a second trusted execution environment based on the match of the biometric data.

9. The system of claim 8, wherein the instructions that cause at least some of the one or more processors to perform a match of the biometric data against biometric templates stored in the first trusted execution environment further comprises instructions that when executed further cause at least some of the one or more processors to:

identify a signature in the biometric data indicating that the biometric data was generated by a secure biometric capture device.

10. The system of claim 9, wherein the first trusted execution environment and the second trusted execution environment are secure enclaves, and wherein the second trusted execution environment verifies the first trusted execution environment based on a report prior to the second trusted execution environment being unsealed.

11. The system of claim 8, wherein the biometric capture device comprises a camera, and wherein the biometric data comprises video frames of a face.

12. The system of claim 11, wherein the first trusted execution environment comprises face templates, and

wherein the instructions that cause at least some of the one or more processors to perform a match of the biometric data against biometric templates stored in the first trusted execution environment further comprise instructions that when executed cause at least some of the one or more processors to compare the biometric data received from the biometric capture device with the face templates.

13. The system of claim 8, wherein an intermediary application executing in an untrusted execution environment provides communication between the first trusted execution environment and the second trusted execution environment.

14. The system of claim 8, wherein the second trusted execution environment is a virtual smartcard, and wherein the second trusted execution environment comprises cryptographic data.

15. A method for secure communications, comprising:

transmitting, from a first trusted execution environment, a request for a biometric match claim;

receiving, in response to the request for a biometric match claim, biometric data from a biometric capture device;

performing a match of the biometric data against biometric templates stored in the first trusted execution environment; and

unsealing a second trusted execution environment based on the match of the biometric data.

16. The method of claim 15, wherein performing a match of the biometric data against biometric templates stored in the first trusted execution environment further comprises:

identifying a signature in the biometric data indicating that the biometric data was generated by a secure biometric capture device.

17. The method of claim 16, wherein the first trusted execution environment and the second trusted execution environment are secure enclaves, and wherein the second trusted execution environment verifies the first trusted execution environment based on a report prior to the second trusted execution environment being unsealed.

18. The method of claim 15, wherein the biometric capture device comprises a camera, and wherein the biometric data comprises video frames of a face.

19. The method of claim 15, wherein the first trusted execution environment comprises face templates, and

wherein performing a match of the biometric data against biometric templates stored in the first trusted execution environment further comprises comparing the biometric data received from the biometric capture device with a face template.

20. The method of claim 15, wherein an intermediary application executing in an untrusted execution environment provides communication between the first trusted execution environment and the second trusted execution environment.

21. The method of claim 15, wherein the second trusted execution environment is a virtual smartcard, and wherein the second trusted execution environment comprises cryptographic data.