Allowing varied device access based on different levels of unlocking mechanisms

Patent metadata

Field	Value
Publication number	US-9578037-B2
Application number	US-201514951654-A
Country	US
Kind code	B2
Filing date	Nov 25, 2015
Priority date	Sep 28, 2012
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

Systems and methods may provide for receiving runtime input from one or more unlock interfaces of a device and selecting a level of access with regard to the device from a plurality of levels of access based on the runtime input. The selected level of access may have an associated security policy, wherein an authentication of the runtime input may be conducted based on the associated security policy. In one example, one or more cryptographic keys are used to place the device in an unlocked state with regard to the selected level of access if the authentication is successful. If the authentication is unsuccessful, on the other hand, the device may be maintained in a locked state with regard to the selected level of access.

First claim

We claim:

1. A computing device comprising:
a hardware processor of the computing device;
a plurality of unlock interfaces coupled to the hardware processor, wherein the plurality of unlock interfaces enable use of runtime input related to authentication of a user and re-lock one or more of the computing device or data stored on the computing device based on one or more of subsequent monitoring of a presence of the user, one or more gestures to signal a desire to re-lock, or a change in continuous authentication that falls below an acceptable tolerance level; and
a policy module comprising:
level determination logic to select a level of access of a plurality of levels of access to the computing device based on the runtime input, wherein different levels of access have associated security policies that specify different combinations of the plurality of unlock interfaces; and
user authentication logic to conduct an authentication of the runtime input based on an associated security policy of the selected level of access; and

a secure processor coupled to the hardware processor, the secure processor including a cryptographic hardware module to perform cryptographic operations using one or more cryptographic keys.

2. The computing device of claim 1 , wherein the policy module further comprises:
unlocking logic to use the one or more cryptographic keys and the cryptographic hardware module to place the device in an unlocked state with regard to the selected level of access if the authentication is successful; and
lock logic to maintain the device in a locked state with regard to the selected level of access if the authentication is unsuccessful.

3. The computing device of claim 2 , wherein the lock logic is to place the computing device in the locked state with regard to the selected level of access if a timeout condition is satisfied.

4. The computing device of claim 2 , wherein the lock logic is to place the computing device in the locked state with regard to the selected level of access if a change in an authentication status of the user changes.

5. The computing device of claim 2 , wherein the lock logic is to remove the one or more cryptographic keys from the cryptographic hardware module to enter the locked state.

6. The computing device of claim 1 , wherein two or more of the plurality of levels of access are associated with different timeout conditions.

7. The computing device of claim 1 , wherein the policy module is to execute in a trusted execution environment.

8. The computing device of claim 1 , wherein the policy module is to enforce a first order Boolean logic.

9. The computing device of claim 1 , wherein the level determination logic is to compare the runtime input to metadata associated with data stored on the computing device to select the level of access.

10. The computing device of claim 9 , wherein the metadata is to include a plurality of policy expressions corresponding to the plurality of levels of access, and wherein the level determination logic is to determine whether the runtime input satisfies one or more of the plurality of policy expressions.

11. The computing device of claim 9 , wherein the metadata and the data stored on the computing device are cryptographically bound with a digital signature, and wherein the user authentication logic is to verify the digital signature.

12. The computing device of claim 1 , wherein the plurality of unlock interfaces include two or more of a touch screen, a keypad, a keyboard, a microphone, a motion sensor and a location sensor.

13. A method comprising:
receiving, in a policy module of a processor, runtime input from one or more of a plurality of unlock interfaces of a device including the processor, wherein the plurality of unlock interfaces enable use of runtime input related to authentication of a user;
identifying metadata associated with data stored on the device;
comparing the runtime input to the metadata to select a level of access to the device from a plurality of levels of access, wherein different levels of access have associated security policies that specify different combinations of the plurality of unlock interfaces;
conducting an authentication of the runtime input based on an associated security policy of the selected level of access;
providing one or more cryptographic keys to a cryptographic hardware module of a security processor coupled to the processor to place the device in an unlocked state with regard to the selected level of access if the authentication is successful; and
causing the one or more cryptographic keys to be removed from the cryptographic hardware module responsive to a duration of device inactivity, the duration of device inactivity dependent on the associated security policy.

14. The method of claim 13 , further comprising using the plurality of unlock interfaces to re-lock one or more of the device or the data stored on the device based on one or more of subsequent monitoring of a presence of the user, one or more gestures signaling a desire to re-lock, or a change in continuous authentication that falls below an acceptable tolerance level.

15. The method of claim 13 , wherein two or more of the plurality of levels of access are to be associated with different timeout conditions.

16. The method of claim 13 , further comprising:
maintaining the device in a locked state with regard to the selected level of access if the authentication is unsuccessful; and
placing the device in the locked state with regard to the selected level of access if a timeout condition is satisfied.

17. At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to:
receive, in a policy module of a processor, runtime input from one or more of a plurality of unlock interfaces of the system, wherein the plurality of unlock interfaces enable use of runtime input related to authentication of a user;
identify metadata associated with data stored on the system;
compare the runtime input to the metadata to select a level of access to the system from a plurality of levels of access, wherein different levels of access have associated security policies that specify different combinations of the plurality of unlock interfaces;
conduct an authentication of the runtime input based on an associated security policy of the selected level of access;
provide one or more cryptographic keys to a cryptographic hardware module of a security processor coupled to the processor to unlock the system with regard to the selected level of access if the authentication is successful; and
lock the system responsive to a duration of inactivity, the duration of inactivity dependent on the associated security policy.

18. The at least one non-transitory computer readable medium of claim 17 , further comprising instructions that when executed enable the system to use the plurality of unlock interfaces to lock one or more of the system or the data stored on the system based on one or more of subsequent monitoring of a presence of the user, one or more gestures signaling a desire to lock, or a change in continuous authentication that falls below an acceptable tolerance level.

19. The at least one non-transitory computer readable medium of claim 17 , further comprising instructions that when executed enable the system to maintain the system in a locked state with regard to the selected level of access if the authentication is unsuccessful or if a timeout condition is satisfied.

20. The at least one non-tr

Assignees

• Intel Corp

Inventors

• Shippy Keith
• Kohlenberg Tobias
• Mian Mubashir
• Smith Ned
• Ben-Shalom Omer
• Viswanathan Tarun
• Morgan Dennis
• Verrall Timothy
• Dave Manish
• Birk Eran

Classifications

• H04W88/02

  Terminal devices · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title

• G06F2221/2105

  Dual mode as a secondary aspect · CPC title

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title