Symmetric keying and chain of trust

Patent metadata

Field	Value
Publication number	US-9509502-B2
Application number	US-201414209129-A
Country	US
Kind code	B2
Filing date	Mar 13, 2014
Priority date	Mar 13, 2014
Publication date	Nov 29, 2016
Grant date	Nov 29, 2016

Abstract

The present application is directed to symmetric keying and chain of trust. In one embodiment a prover may communicate with a verifier to perform device or data authentication. The verifier may issue a challenge to authenticate the prover, to which the prover may respond with key data and ticket data that may be forwarded to a certifier. If the ticket data is recognized, the certifier may transmit an authorization token to the verifier, which may then set a symmetric attestation key. The prover may utilize the symmetric attestation key to establish a chain of trust for use in responding to challenges to application or data authenticity. The symmetric attestation key may be used to generate a first level key that may be utilized to generate program keys. A challenge response may include at least program key data that may be authenticated by the verifier using the symmetric attestation key.

First claim

What is claimed:

1. A device to act as a verifier, comprising:
communication circuitry; and
a trusted execution environment including at least attestation circuitry to:
detect an attestation trigger;
determine, based on the attestation trigger, whether to initiate symmetric key distribution operations with a prover device to cause a symmetric key from which a chain of trust is derived to be set in the prover device, or remote attestation operations with the prover device during which at least one of applications or application data in the prover device are authenticated by the device acting as a verifier utilizing the derived chain of trust; and
initiate at least one of symmetric key distribution operations or remote attestation operations with the prover device based on the determination, the symmetric key distribution operations being initiated in response to a determination, by said attestation circuitry, that an existing symmetric key is invalid.

2. The device of claim 1 , wherein attestation is triggered periodically or due to a request to access resources received from the prover device via the communication circuitry.

3. The device of claim 1 , wherein the communication circuitry is to interact with the prover device via at least one of a short-range wireless connection or a direct wired connection.

4. The device of claim 1 , wherein when it is determined that the existing symmetric key is invalid, the attestation circuitry initiates the symmetric key distribution operations with the prover device, the symmetric key distribution operations comprising:
causing the communication circuitry to transmit a device challenge to the prover device; and
receiving a response to the device challenge from the prover device via the communication circuitry, the response to the device challenge comprising at least key data and ticket data.

5. The device of claim 4 , wherein the attestation circuitry is further configured to:
cause the communication circuitry to transmit at least the ticket data to at least one certifier device;
receive a response from the at least one certifier device via the communication circuitry; and
determine whether the response received from the at least one certifier device comprises an authorization token.

6. The device of claim 5 , further comprising a firewall through which the communication circuitry interacts with the at least one certifier device, the firewall being to at least prevent unintended interaction between the device and the at least one certifier device.

7. The device of claim 5 , wherein the attestation circuitry is further configured to:
set the symmetric key based at least on the key data when the authorization token is determined to have been received; and
cause the communication circuitry to transmit a confirmation that the symmetric key has been set to the prover device.

8. The device of claim 7 , wherein the attestation circuitry is further configured to:
cause the communication circuitry to transmit an application challenge to the prover device;
receive a response to the application challenge from the prover device via the communication circuitry, the response to the application challenge being generated based at least on counter data, code measurement data and program key data;
authenticate the response to the application challenge; and
cause the communication circuitry to transmit at least a result of the authentication to the prover device.

9. The device of claim 8 , wherein the attestation circuitry being to authenticate the response to the application challenge comprises the attestation circuitry being to authenticate that the response to the application challenge was generated based on the symmetric key using a message authentication code.

10. A method for remote attestation using symmetric keys with a device to act as a verifier, comprising:
detecting an attestation trigger;
determining, based on the attestation trigger, whether to initiate symmetric key distribution operations with a prover device to cause a symmetric key from which a chain of trust is derived to be set in the prover device, or remote attestation operations with the prover device during which at least one of applications or application data in the prover device are authenticated by the device acting as a verifier utilizing the derived chain of trust; and
initiating at least one of symmetric key distribution operations or remote attestation operations with the prover device based on the determination, the symmetric key distribution operations being initiated in response to a determination that an existing symmetric key is invalid.

11. The method of claim 10 , wherein attestation is triggered periodically or due to a request to access resources received from the prover device.

12. The method of claim 10 , further comprising:
interacting with the prover device via at least one of a short-range wireless connection or a direct wired connection.

13. The method of claim 10 , wherein initiating symmetric key distribution operations with the prover device comprises:
causing a device challenge to be transmitted to the prover device; and
receiving a response to the device challenge from the prover device, the response to the device challenge comprising at least key data and ticket data.

14. The method of claim 13 , further comprising:
causing at least the ticket data to be transmitted to at least one certifier device;
receiving a response from the at least one certifier device; and
determining whether the response received from the at least one certifier device comprises an authorization token.

15. The method of claim 14 , further comprising:
setting the symmetric key based at least on the key data when the authorization token is determined to have been received; and
causing a confirmation that the symmetric key has been set to be transmitted to the prover device.

16. The method of claim 15 , wherein initiating remote attestation operations with the prover comprises:
causing an application challenge to be transmitted to the prover device;
receiving a response to the application challenge from the prover device, the response to the application challenge being generated based at least on counter data, code measurement data and program key data;
authenticating the response to the application challenge; and
causing at least a result of the authentication to be transmitted to the prover device.

17. The method of claim 16 , wherein authenticating the response to the application challenge comprises authenticating that the response to the application challenge was generated based on the symmetric key using a message authentication code.

18. At least one non-transitory machine-readable storage medium having stored thereon, individually or in combination, instructions that when executed by one or more processors of a device to act as a verifier result in the following operations for remote attestation using symmetric keys, comprising:
detecting an attestation trigger;
determining, based on the attestation trigger, whether to initiate symmetric key distribution operations with a prover device to cause a symmetric key from which a chain of trust is derived to be set in the prover device, or remote attestation operations with the prover device during which at least one of applications or application data in the prover device are authenticated by the device acting as a verifier utilizing the derived chain of trust; and
initiating at least one of symmetric key distribution operations or remote attestation operations with

Assignees

• Intel Corp

Inventors

• Schulz Steffen

Classifications

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L9/0827 Primary

  involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title