Trusted computing

Patent metadata

Field	Value
Publication number	US-2016188909-A1
Application number	US-201414587551-A
Country	US
Kind code	A1
Filing date	Dec 31, 2014
Priority date	Dec 31, 2014
Publication date	Jun 30, 2016
Grant date	—

Abstract

A trusted computing device (TCD) includes an isolated environment, host interface, secure interface, and program instructions. The environment includes an isolated environment processor (IEP), memory (secure and non-secure partition), and an auxiliary processor (AP). Memory and AP are connected for data communication with the IEP, and communicate with a host only through the IEP. The host interface and each secure interface are connected for data communication with the IEP. The instructions provision TCD for cryptographic operations via a secure interface; present a first file system partition comprising a write file and a read file with file creation/deletion privileges allocated only to the IEP at the host interface via the IEP; present a non-secured file system partition with access to the non-secure partition via the host interface via the IEP; receive, via the write file, requests to perform trusted computing; perform requested computing using the IEP, secure memory, and AP; and write results to the read file.

First claim

What is claimed is:

1 . A trusted computing device, comprising:
an isolated environment comprising:
an isolated environment processor;
memory comprising a secure partition and a non-secure partition, the memory connected for data communication with the isolated environment processor; and
an auxiliary processor connected for data communication with the isolated environment processor and the memory;
wherein the memory and the auxiliary processor communicate with a host only through the isolated environment processor;
a host interface connected for data communication with the isolated environment processor; at least one secure interface connected for data communication with the isolated environment processor; and a computer program product comprising a non-transitory computer-readable media having computer-executable program instructions embodied thereon that, when executed by the trusted computing device, cause the trusted computing device to perform trusted computing, the computer-executable program instructions comprising:
computer-executable program instructions to provision the trusted computing device for cryptographic operations via the at least one secure interface;
computer-executable program instructions to present a first file system partition at the host interface via the isolated environment processor, the first file system partition comprising a host write file and a host read file, wherein file creation and file deletion privileges are allocated only to the isolated environment processor;
computer-executable program instructions to present an non-secured second file system partition with access to the memory non-secure partition via the host interface via the isolated environment processor;
computer-executable program instructions to receive, via the host write file, requests to perform trusted computing in the isolated environment, the trusted computing comprising one or more of: random number generation, append-only logging, monotonic counting, streaming encryption and decryption, bulk encryption and decryption, and isolated storage;
computer-executable program instructions to perform the requested trusted computing using at least one of the isolated environment processor, the memory secure partition and the auxiliary processor; and
computer-executable program instructions to write the trusted computing results to the host read-only file.

2 . A trusted computing system, comprising:
a trusted computing device comprising:
an isolated environment comprising:
an isolated environment processor; and
memory comprising a secure partition and connected for data communication with the isolated environment processor; and
wherein the memory communicates with the host only through the isolated environment processor;

a host interface connected for data communication with the isolated environment processor; and
a computer program product comprising a non-transitory computer-readable media having computer-executable program instructions embodied thereon that when executed by a computer cause the computer to perform trusted computing, the computer-executable program instructions comprising:
computer-executable program instructions to present a first file system partition via the host interface from the isolated environment processor, the first file system partition comprising a host write file and a host read-only file;
computer-executable program instructions to receive, via the host write file, requests to perform trusted computing in the isolated environment;
computer-executable program instructions to perform the requested trusted computing operations using the isolated environment processor and the memory secure partition; and
computer-executable program instructions to write the secure operation results to the host read-only file.

3 . The trusted computing system of claim 2 , wherein:
the memory further comprises a non-secure partition; and the computer-executable program instructions further comprise computer-executable program instructions to present an unsecured second file system partition with access to the memory non-secure partition via the host interface from the isolated environment processor.

4 . The trusted computing system of claim 2 , wherein:
the isolated environment further comprises an auxiliary processor connected for data communication with the isolated environment processor and the memory; and the computer executable program instructions further comprise computer-executable program instructions to perform the requested secure operations using at least one of the isolated environment processor, the memory secure partition, and the auxiliary processor.

5 . The trusted computing system of claim 4 , wherein:
wherein the computer-executable program instructions to receive, via the host write file, requests to perform trusted computing in the isolated environment further comprise computer executable program instructions to receive, via the host write file, requests to perform streaming encryption; wherein the computer-executable program instructions further comprise computer-executable program instructions to perform streaming encryption using the auxiliary processor upon receipt of a request to perform streaming encryption.

6 . The trusted computing system of claim 2 , wherein:
the trusted computing device further comprises at least one secure interface connected for data communication with the isolated environment processor; and the computer executable program instructions further comprise computer-executable program instructions to provision the trusted computing device for cryptographic operations via the at least one secure interface.

7 . The trusted computing system of claim 6 , wherein the at least one secure interface associated with computer executable program instructions to provision the computing device for cryptographic operations is a Joint Test Action Group (JTAG) interface.

8 . The trusted computing system of claim 2 , wherein:
the trusted computing device further comprises at least one secure interface connected for data communication with the isolated environment processor; and the computer executable program instructions further comprise computer-executable program instructions to execute a challenge-response authentication protocol via the at least one secure interface as a condition precedent to performing at least one trusted computing activity in the isolated environment.

9 . The trusted computing system of claim 8 , wherein the secure interface is responsive to a user touch, and the required response of the challenge response protocol is a user touch.

10 . The trusted computing system of claim 8 , further comprising a user interface device in data communication with the isolated environment via the at least one secure interface, the user interface device being responsive to a user touch, and the required response of the challenge response protocol being a user touch to the remote user interface.

11 . The trusted computing system of claim 10 , wherein the data communication link between the remote user input device and the at least one secure interface comprises a near field communication (NFC) link.

12 . The trusted computing system of claim 2 , wherein the memory comprises flash memory.

13 . The trusted computing system of claim 12 , wherein the trusted computing device is form-compatible and function-compatible with the micro Secure Digital (microSD) nonvolatile memory card standard.

14 . The trusted computing system of claim 2 , wherein first file system partition is compatible with a File Allocation Table (FAT) compu

Assignees

• Google Inc

Inventors

• Zatko Peiter Charles
• Rizzo Dominic

Classifications

• G06F21/35 Primary

  communicating wirelessly · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F21/71 Primary

  to assure secure computing or processing of information · CPC title

• G06F21/31

  User authentication · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title