Virally distributable trusted messaging

Patent metadata

Field	Value
Publication number	US-9467296-B2
Application number	US-201414473308-A
Country	US
Kind code	B2
Filing date	Aug 29, 2014
Priority date	Aug 29, 2014
Publication date	Oct 11, 2016
Grant date	Oct 11, 2016

Abstract

Technologies for utilizing trusted messaging include a local computing device including a message client and a local trusted message module established in a trusted execution environment. The local trusted message module performs attestation of a remote computing device based on communication with a corresponding remote trusted message module established in a trusted execution environment of the remote computing device. The local trusted message module further exchanges, with the remote trusted message module, cryptographic keys in response to successful attestation of the remote computing device. The message client forwards outgoing messages to the local trusted message module and receives incoming messages from the local trusted message module. To securely transmit an outgoing message to the remote computing device, the local trusted message module receives the outgoing message from the message client, encrypts the outgoing message, and cryptographically signs the outgoing message, prior to transmittal to the remote trusted message module of the remote computing device. To securely receive an incoming message from the remote computing device, the local trusted message module receives the incoming message from the remote trusted message module of the remote computing device, decrypts the incoming message, and verifies a cryptographic signature of the incoming message, based on the exchanged cryptographic keys and prior to transmittal of the incoming message to the message client.

First claim

The invention claimed is:

1. A local computing device for trusted messaging, the local computing device comprising:
a processor;
a local trusted message module, established in a trusted execution environment, to (i) perform attestation of a remote computing device based on communication with a corresponding remote trusted message module established in a trusted execution environment of the remote computing device and (ii) exchange, with the remote trusted message module, cryptographic keys in response to successful attestation of the remote computing device; and
a message client to (i) forward outgoing messages to the local trusted message module and (ii) receive incoming messages from the local trusted message module,
wherein, to securely transmit an outgoing message to the remote computing device, the local trusted message module is to (i) receive the outgoing message from the message client, (ii) encrypt the outgoing message, and (iii) cryptographically sign the outgoing message, prior to transmittal to the remote trusted message module of the remote computing device; and
wherein, to securely receive an incoming message from the remote computing device, the local trusted message module is to (i) receive the incoming message from the remote trusted message module of the remote computing device, (ii) decrypt the incoming message, and (iii) verify a cryptographic signature of the incoming message, based on the exchanged cryptographic keys and prior to transmittal of the incoming message to the message client.

2. The local computing device of claim 1 , wherein to perform the attestation of the remote computing device comprises to:
receive, from the remote trusted message module, a remote attestation quote of the corresponding trusted execution environment; and
verify the remote attestation quote received from the remote trusted message module.

3. The local computing device of claim 2 , wherein the local trusted message module is further to:
generate a local attestation quote of the trusted execution environment of the local computing device; and
transmit the generated local attestation quote for attestation of the local computing device to the remote trusted message module.

4. The local computing device of claim 3 , wherein to exchange the cryptographic keys comprises to:
receive, from the remote trusted message module, a first symmetric cryptographic key for authenticated encryption of messages transmitted to the remote computing device;
generate a second symmetric cryptographic key for communication with the remote computing device; and
transmit, to the remote trusted message module, the second symmetric cryptographic key for authenticated encryption of messages transmitted to the local computing device from the remote computing device.

5. The local computing device of claim 3 , wherein to exchange the cryptographic keys comprises to:
receive, from the remote trusted message module, a first public cryptographic key for encryption of messages transmitted to the remote computing device and verification of a signature of signed messages received from the remote computing device;
generate a cryptographic key pair for communication with the remote computing device, the cryptographic key pair including a private cryptographic key and a second public cryptographic key;
transmit, to the remote trusted message module, the second public cryptographic key for encryption of messages transmitted to the local computing device and verification of a signature of signed messages received from the local computing device.

6. The local computing device of claim 5 , wherein to securely transmit the outgoing message to the remote computing device comprises to:
receive, by the local trusted message module, a generated message from the message client;
sign, by the local trusted message module, the message with the generated private cryptographic key;
encrypt, by the local trusted message module, the message with the first public cryptographic key received from the remote trusted message module; and
transmit, by the local trusted message module, the encrypted and signed message to the remote trusted message module.

7. The local computing device of claim 5 , wherein to securely receive the incoming message from the remote computing device comprises to:
receive, by the local trusted message module, an encrypted and signed message from the remote trusted message module;
decrypt, by the local trusted message module, the encrypted and signed message with the generated private cryptographic key;
verify, by the local trusted message module, a signature of the encrypted and signed message with the first public cryptographic key received from the remote trusted message module; and
forward, by the local trusted message module, the decrypted and verified message to the message client.

8. The local computing device of claim 1 , wherein the local trusted message module is further to:
determine whether the remote computing device has enabled the remote trusted message module; and
request the remote computing device to enable the remote trusted message module in response to a determination that the remote trusted message module is not enabled.

9. The local computing device of claim 8 , wherein to request the remote computing device to enable the remote trusted message module comprises to provide instructions to a user of the remote computing device to install a trusted message module.

10. The local computing device of claim 1 , wherein the local trusted message module is further to:
select a contact person from a contacts database of the local computing device;
construct a message to the selected contact person to request enablement of a trusted message module on a computing device of the contact person; and
transmit the message to a corresponding message address of the selected contact person.

11. The local computing device of claim 10 , wherein to request enablement of the trusted message module comprises to provide instructions to the selected contact person to install the trusted message module on the computing device of the contact person.

12. The local computing device of claim 1 , wherein the local trusted message module is further to:
generate a private message receiving address at which to receive messages; and
notify the remote trusted message module to transmit messages for the local computing device to the private message receiving address.

13. The local computing device of claim 12 , wherein the local trusted message module is further to:
receive a message directed to the private message receiving address; and
forward the received message to the message client.

14. The local computing device of claim 13 , wherein the local trusted message module is further to determine whether a sender of the message directed to the private message receiving address is authorized to use the private message receiving address,
wherein to forward the received message to the message client comprises to forward the received message to the message client in response to a determination that the sender is authorized to use the private message receiving address.

15. The local computing device of any of claims 1 - 14 , wherein the message client comprises one of an email client, an instant messaging client, a text messaging client, an image messaging client, a video messaging client, or an audio messaging client.

16. One or more non-transitory machine-readable storage media comprising a plurality of instructions stored thereon that, in response to execution by a local computing device, cause the local

Assignees

• Intel Corp

Inventors

• Smith Ned M
• Deleeuw William C
• Willis Thomas G
• Goss Nathaniel J

Classifications

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title