Method and system for executing a secure application on an untrusted user equipment

Patent metadata

Field	Value
Publication number	US-9609000-B2
Application number	US-201314404662-A
Country	US
Kind code	B2
Filing date	May 10, 2013
Priority date	Jun 6, 2012
Publication date	Mar 28, 2017
Grant date	Mar 28, 2017

Abstract

A method for executing a secure application on an untrusted user equipment having storage means with at least one protected region includes establishing a secure or authenticated communication channel between a trusted device and the user equipment. Secure application information of the secure application is provided via the communication channel to be executed on the user equipment. Correctness of the secure application information is checked. Execution of the secure application is initiated on the user equipment via the communication channel such that the secure application is stored in the protected region of the storage means.

First claim

The invention claimed is:

1. A method for executing a secure application on an untrusted user equipment comprising a storage device with at least one protected region, the method comprising:
a) establishing, between a trusted device and the user equipment, a communication channel being at least one of: a secure communication channel, and an authenticated communication channel, wherein the communication channel is established by performing a secret key-challenge between the user equipment and the trusted device;
b) providing secure application information of the secure application via the communication channel to be executed on the user equipment;
c) checking correctness of the secure application information; and
d) initiating execution of the secure application on the user equipment via the communication channel such that the secure application is stored in the at least one protected region of the storage device,
wherein the performing the secret key-challenge between the user equipment and the trusted device comprises issuing a challenge including a nonce and issuing a response to the challenge that also includes the nonce,
wherein the issuing the challenge including the nonce comprises issuing, by the user equipment, the challenge including a semantically secure encryption function of the nonce and a unique identifier corresponding to the user equipment or a component of the user equipment, and
wherein the issuing a response to the challenge that includes the nonce comprises issuing, by an interface application of the trusted device, a semantically secure encryption function of a START command, the nonce, and a unique identifier of the interface application.

2. The method according to claim 1 , further comprising using a mobile network access device of the user equipment to store at least one of security and authentication information for the communication channel.

3. The method according to claim 1 , further comprising using a mobile network access device of the user equipment to store at least one of a measuring and a checking application.

4. The method according to claim 1 , wherein the communication channel is provided by a trusted physical connection between the trusted device and the user equipment.

5. The method according to claim 4 , wherein a session key is transferred from the trusted device to the user equipment and the session key is used for establishing the communication channel.

6. The method according to claim 1 , wherein step d) is performed by instructing a secure bootloader on the user equipment to load the secure application for execution.

7. The method according to claim 6 , wherein the secure bootloader launches a new environment for executing the secure application.

8. The method according to claim 1 , wherein the trusted device provides the secure application via the communication channel.

9. The method of claim 6 , wherein a shared secret is used to initiate secure loading of the secure bootloader.

10. The method of claim 1 wherein the performing the secret key-challenge between the user equipment and the trusted device comprises, prior to the issuing the challenge including the nonce, issuing, by the interface application of the trusted device, the START command.

11. The method of claim 4 , wherein the trusted physical connection between the trusted device and the user equipment is a USB cable.

12. The method of claim 1 , further comprising loading, by the interface application of the trusted device, a temporary session key onto the storage device with the at least one protected region by using a trusted physical connection between the trusted device and the user equipment, wherein the temporary session key is used in establishing the communication channel by performing the secret key-challenge between the user equipment and the trusted device.

13. A system for executing a secure application on an untrusted user equipment comprising a storage device with at least one protected region, the system comprising:
a trusted device, wherein the user equipment and the trusted device are operable to:
establish, a communication channel being at least one of: a secure communication channel, and an authenticated communication channel, wherein the communication channel is established by performing a secret key-challenge between the user equipment and the trusted device;
exchange secure application information of the secure application via the communication channel,
check correctness of the secure application information, and
initiate, via the communication channel, execution of the secure application on the user equipment such that the secure application is stored in the at least one protected region of the storage device on the user equipment,

wherein the performing the secret key-challenge between the user equipment and the trusted device comprises issuing a challenge including a nonce and issuing a response to the challenge that also includes the nonce,
wherein the issuing the challenge including the nonce comprises issuing, by the user equipment, the challenge including a semantically secure encryption function of the nonce and a unique identifier corresponding to the user equipment or a component of the user equipment, and
wherein the issuing a response to the challenge that includes the nonce comprises issuing, by an interface application of the trusted device, a semantically secure encryption function of a START command, the nonce, and a unique identifier of the interface application.

14. A method for executing a secure application on an untrusted user equipment comprising a storage device with at least one protected region, the method comprising:
a) establishing, between a trusted device and the user equipment, a communication channel being at least one of: a secure communication channel, and an authenticated communication channel, wherein the communication channel is established by performing a secret key-challenge between the user equipment and the trusted device;
b) providing secure application information of the secure application via the communication channel to be executed on the user equipment;
c) checking correctness of the secure application information; and
d) initiating execution of the secure application on the user equipment via the communication channel such that the secure application is stored in the at least one protected region of the storage device by instructing a secure bootloader on the user equipment to load the secure application, wherein the secure bootloader launches a new environment for executing the secure application,
wherein the performing the secret key-challenge between the user equipment and the trusted device comprises issuing a challenge including a nonce and issuing a response to the challenge that also includes the nonce,
wherein the issuing the challenge including the nonce comprises issuing, by the user equipment, the challenge including a semantically secure encryption function of the nonce and a unique identifier corresponding to the user equipment or a component of the user equipment, and
wherein the issuing a response to the challenge that includes the nonce comprises issuing, by an interface application of the trusted device, a semantically secure encryption function of a START command, the nonce, and a unique identifier of the interface application.

15. The method of claim 14 , wherein the new environment for executing the secure application is a virtual machine, and
wherein the virtual machine has at least one of: resources, a cache, and a disk allocation.

16. The method of claim 15 , further comprising disab

Assignees

• Nec Europe Ltd
• Nec Corp

Inventors

• Karame Ghassan
• Girao Joao

Classifications

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• H04L63/123 Primary

  received data contents, e.g. message integrity · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title