Trusted container
AssigneeMcAfee, Inc.
InventorsVincent Edward Von Bokern, Purushottam Goel, Sven Schrecker, Ned McArthur Smith
Life of this patent
Estimating the term…
Abstract
A secure identifier is derived, using a secured microcontroller of a computing device, that is unique to a pairing of the computing device and a particular domain. Secure posture data corresponding to attributes of the computing device is identified in secured memory of the computing device. The secure identifier and security posture is sent in a secured container to a management device of the particular domain. The particular domain can utilize the information in the secured container to authenticate the computing device and determine a security task to be performed relating to interactions of the computing device with the particular domain.
Claims11
At least one storage device or storage disk comprising instructions that, when executed on at least one processor, cause the at least one processor to, at least:
- establish a secure connection between a domain and a client computing device;
- receive, from the client computing device, a secure identifier corresponding to the client computing device, the secure identifier including a one-time password unique to a pairing of the client computing device and the domain, the secure identifier derived based at least in part on seed data received from the domain, the seed data separate from a domain identifier corresponding to the domain and unique to the pairing of the client computing device and the domain;
- receive, from the client computing device, a container including security posture data corresponding to the client computing device bound to the secure identifier, the security posture data to identify attributes of the client computing device;
- and
- perform a security task relating to an interaction of the client computing device with the domain.
A system comprising:
- at least one processor;
- memory in circuit with the at least one processor;
- and
- a controller manager isolated from the at least one processor and to interact with a client computing device, the controller manager to:
- negotiate a secure session with a client computing device;
- provision seed data to the client computing device in response to the negotiation of the secure session, the seed data (a) separate from a domain identifier of a domain, (b) unique to a pairing of the client computing device and the domain, and (c) to be stored in a secure memory of the client computing device;
- receive, from the client computing device, a secure identifier including a one-time password unique to the pairing of the client computing device and the domain, the secure identifier derived based at least in part on the seed data;
- authenticate the client computing device using the one-time password;
- and
- receive a secured container including the secure identifier and the security posture data from the client computing device.
A method comprising:
- establishing, by executing an instruction with at least one processor, a secure connection between a domain and a client computing device;
- receiving from the client computing device, by executing an instruction with the at least one processor, a secure identifier corresponding to the client computing device, the secure identifier including a one-time password unique to a pairing of the client computing device and the domain, the secure identifier derived based at least in part on seed data received from the domain, the seed data separate from a domain identifier corresponding to the domain and unique to the pairing of the client computing device and the domain;
- receiving from the client computing device, by executing an instruction with the at least one processor, a container including security posture data corresponding to the client computing device bound to the secure identifier, the security posture data to identify attributes of the client computing device;
- and
- performing a security task relating to an interaction of the client computing device with the domain.
Dependencies are inferred from the claim text.