Secure streamlined provisioning of remote access terminals

Patent metadata

Field	Value
Publication number	US-10187362-B1
Application number	US-201514745610-A
Country	US
Kind code	B1
Filing date	Jun 22, 2015
Priority date	Jun 22, 2015
Publication date	Jan 22, 2019
Grant date	Jan 22, 2019

Abstract

A method and system are provided that create a limited use secure environment (LSE) image such as a limited use operating system installation that can be booted from a removable medium (e.g. CD or flash drive). The limited use secure environment is a limited purpose OS, web browser, etc. that prevents undesired activities. When the limited use secure environment boots, it initiates a pairing operation in which a pairing code and user credentials are conveyed to an authorization server. Once the pairing code and credentials are confirmed, a provisioning service provides configuration credentials to the limited use secure environment to enable the limited use secure environment to establish a secure connection through a gateway to resources of interest.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to:
receive a code request associated with a limited use operating system loaded onto a computing device, the limited use operating system configured to prevent unauthorized actions at the computing device while accessing a resource of interest via a gateway service over a secure network connection;
generate a pairing code in response to the code request;
receive an authentication request at an authorization server, the authentication request including the pairing code and a user credential, the pairing code associated with the limited use operating system, the user credential associated with a user of the computing device;
validate the paring code and user credential from the authentication request at the authorization server;
receive a polling request from the limited use operating system at the authentication server; and
when the authentication request is validated, return configuration credentials from the authentication server in order for the computing device to establish a secure network connection through a gateway service with the resource of interest.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the validate operation performed by the authentication server confirms that the pairing code has been generated by the limited use operating system when the limited use operating system is activated on the computing device and that the pairing code has been presented to the user through the computing device.

3. The non-transitory computer readable storage medium of claim 1 , wherein the generate operation includes generating a quick response code to be displayed on the computing device as the pairing code, wherein the authentication request includes the quick response code combined with the user credentials.

4. A computer implemented method for authenticating a remote access session, comprising:
performing a pairing operation based on an authentication request that includes an environment credential and a user credential, the environment credential associated with a limited use secure environment that, when loaded onto a computing device, takes at least partial control of the computing device, and limits features available to the computing device while accessing a resource of interest, the user credential associated with a user of the computing device; and
presenting configuration credentials to the limited use secure environment that enable the computing device to establish a secure network connection through a gateway service with the resource of interest.

5. The method of claim 4 , further comprising causing the limited use secure environment to be provided on a portable data store to be removably coupled to the computing device while utilizing the limited use secure environment to establish the secure network connection.

6. The method of claim 4 , wherein the pairing operation comprises:
receiving, at an authorization service, the authentication request from a trusted client device, the authentication request including the user credential and the environment credential, the environment credential including a pairing code; and
determining, at the authorization service, whether the pairing code and user credential match an approved pairing code and approved user certificate.

7. The method of claim 4 , further comprising causing the limited use secure environment to randomly generate a pairing code as the environment credential when the limited use secure environment is activated on the computing device.

8. The method of claim 4 , further comprising:
receiving a code request, at a provisioning service, from the limited use secure environment on the computing device; and
returning a pairing code from the provisioning service in response to the code request, the pairing code representing at least a portion of the environment credential.

9. The method of claim 4 , further comprising:
providing a quick response code to be presented at the computing device as at least a portion of the environment credential; and
receiving the authorization request from a trusted client device, wherein the environment credential associated with the quick response code as scanned by the trusted client device.

10. The method of claim 4 , further comprising receiving the authentication request as at least one of a text message, email, cellular data content, or telephone message.

11. The method of claim 4 , further comprising causing the limited use secure environment to become disabled after at least one of a predetermined period of time and a predetermined number of uses.

12. The method of claim 4 , wherein the limited use secure environment disables functions of the computing device including at least one of i) a print function, ii) a print screen function, iii) an email function, iv) an administrative function and v) access to select websites.

13. The method of claim 4 , further comprising maintaining first and second limited use secure environments on a portable data store, wherein, while the first limited use secure environment is operating on the computing device, providing a new version of a select limited use secure environment to replace or update the second limited use secure environment.

14. A system, comprising:
at least one processor; and
a memory coupled to the at least one processor, wherein the memory stores program instructions, wherein the program instructions are executable by the at least one processor to:
receive an authentication request that includes a pairing code and a user credential, the pairing code associated with a limited use secure environment that, when loaded onto a computing device, takes at least partial control of the computing device, and limits features available to the computing device while accessing a resource of interest, the user credential associated with a user of the computing device;
perform a pairing operation based on the authentication request; and
present configuration credentials to the limited use secure environment that enable the computing device to establish a secure network connection through a gateway service with the resource of interest.

15. The system of claim 14 , further comprising a portable data store that stores the limited use secure environment, the portable data store having a communications interface to be communicatively coupled to the computing device when loading the limited use secure environment onto the computing device.

16. The system of claim 15 , wherein the portable data store include first and second storage partitions that store corresponding first and second limited use secure environments, wherein, while the first limited use secure environment is operating on the computing device, the first limited use secure environment is in a read only mode, while the second limited use secure environment is in a right mode to be overwritten with a new version of a select limited use secure environment.

17. The system of claim 14 , further comprising an authentication server including an authorization service and a provisioning service, the authorization service performing the pairing operation, the provisioning service presenting the configuration credentials to the limited use secure environment over a network.

18. The system of claim 14 , further comprising an authorization service that receives the authentication request from a trusted clien

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Duksta John Clark Coonley
• Harrison Katharine Nicole
• Jezorek Matthew Ryan
• Lee Brian Young
• Van Horenbeeck Maarten

Classifications

• H04L63/0457 Primary

  wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption (cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065) · CPC title

• G06F21/30

  Authentication, i.e. establishing the identity or authorisation of security principals · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title

• G06F21/44

  Program or device authentication · CPC title