# US 10,872,153 B2 · Trusted cyber physical system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,153 B2 - Document ID: US10872153B2 - Status: Granted - Kind: B2 - Application number: 15/958,993 - Filed: 2018-04-20 - Published: 2019-08-29 - Granted: 2020-12-22 - Earliest claimed: 2018-02-23 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: David Garfield Thaler, III; Brian Clifford Telfer; Stefan Thom; Torsten Stein; Robert Solomon; Christopher Glenn Kaler - Web page: https://patentgrep.com/patent/US10872153B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/554: {involving event detection and direct action} - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3247: {involving digital signatures} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/102: {Entity profiles} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A secure terminal configured to support a trusted execution environment that utilizes policy enforcement to filter and authorize transmissions received from a host device and destined for a remote device. Upon receiving a transmission from the host device, the secure terminal verifies that the instruction, message, or request contained within the transmission satisfy parameters set by a policy. If the transmission satisfies the parameters, then the secure terminal signs the transmission with a key unique to the trusted platform module associated with the secure terminal and forwards the signed transmission to the remote device. If the transmission fails one or more parameters within the policy, a message that details the instruction or operation contained within the transmission is exposed to a user at an output device, in which the user can authorize or reject the transmission using an input device. ## Claims ### Claim 1 A method performed by a secure terminal operating on a network and configured to filter transmissions received from a host device, the method comprising: implementing a trusted execution environment (TEE) on the secure terminal using at least a trusted portion of one or more processor cores of a central processing unit (CPU) of the secure terminal that is separate from public portions of the one or more processor cores; receiving a transmission from the host device destined for a remote device; decrypting the received transmission inside the TEE such that the decrypted received transmission is not exposed to the public portions of the one or more processor cores; applying a policy to the decrypted transmission; determining whether the decrypted transmission is authorized based on satisfaction or failure of the policy; and in response to the transmission being authorized, encrypting and forwarding the transmission over the network to the remote device. ### Claim 2 (depends on 1) The method of claim 1, in which the remote device verifies that the forwarded transmission is signed by the secure terminal. ### Claim 3 (depends on 1) The method of claim 1, further comprising, when the transmission is not authorized, sending the transmission from the secure terminal to a trusted peripheral device for consumption by an end user. ### Claim 4 (depends on 3) The method of claim 3, in which the trusted peripheral device is an output device, and further comprising: receiving overriding authorization at an input device from the end user responsive to the transmission being received at the output device from the secure terminal; and responsive to the overriding authorization, permitting the transmission to be forwarded to the remote device from the secure terminal. ### Claim 5 (depends on 1) The method of claim 1, further comprising signing the transmission with a local key unique to a trusted platform module (TPM) that is maintained by the secure terminal prior to forwarding the transmission to the remote device. ### Claim 6 (depends on 1) The method of claim 1, in which the transmission is protected at all times by one or more of cryptographic security, a respective device's TEE, or physical security. ### Claim 7 (depends on 1) The method of claim 1, in which the secure terminal is configured with the following parameters: automatically permit messages that include routine operations or requests for the remote device; and redirect messages to an output device when the messages include operations or requests that are not routine. ### Claim 8 (depends on 7) The method of claim 7, further comprising a learning component maintained by the secure terminal or a device in communication with the secure terminal, in which the learning component is configured to develop a blueprint of routine operations for the remote device based on previous operations performed by the remote device or previously transmitted messages from the host device to the remote device. ### Claim 9 A computing device configured as a secure terminal operating on a network, comprising: a central processing unit (CPU); and one or more processing cores in the CPU, in which the computing device is configured for filtering transmissions received from a host device comprising implementing a trusted execution environment (TEE) on the secure terminal using at least a trusted portion of the one or more processor cores of the central processing unit (CPU) of the secure terminal that is separate from public portions of the one or more processor cores, receiving a transmission from the host device destined for a remote device, decrypting the received transmission inside the TEE such that the decrypted received transmission is not exposed to the public portions of the one or more processor cores, applying a policy to the decrypted transmission, determining whether the decrypted transmission is authorized based on satisfaction or failure of the policy, and in response to the transmission being authorized, encrypting and forwarding the transmission over the network to the remote device. ### Claim 10 (depends on 9) The computing device of claim 9, in which the remote device verifies that the forwarded transmission is signed by the secure terminal. ### Claim 11 (depends on 9) The computing device of claim 9, further comprising, when the transmission is not authorized, sending the transmission from the secure terminal to a trusted peripheral device for consumption by an end user. ### Claim 12 (depends on 11) The computing device of claim 11, in which the trusted peripheral device is an output device, and further comprising: receiving overriding authorization at an input device from the end user responsive to the transmission being received at the output device from the secure terminal; and responsive to the overriding authorization, permitting the transmission to be forwarded to the remote device from the secure terminal. ### Claim 13 (depends on 9) The computing device of claim 9, further comprising signing the transmission with a local key unique to a trusted platform module (TPM) that is maintained by the secure terminal prior to forwarding the transmission to the remote device. ### Claim 14 (depends on 9) The computing device of claim 9, in which the transmission is protected at all times by one or more of cryptographic security, a respective device's TEE, or physical security. ### Claim 15 (depends on 9) The computing device of claim 9, in which the secure terminal is configured with the following parameters: automatically permit messages that include routine operations or requests for the remote device; and redirect messages to an output device when the messages include operations or requests that are not routine. ### Claim 16 (depends on 15) The computing device of claim 15, further comprising a learning component maintained by the secure terminal or a device in communication with the secure terminal, in which the learning component is configured to develop a blueprint of routine operations for the remote device based on previous operations performed by the remote device or previously transmitted messages from the host device to the remote device. ### Claim 17 One or more hardware-based computer-readable memory devices storing instructions which, when executed by a central processing unit (CPU) disposed in a computing device configured as a secure terminal operating on a network, cause the computing device to filter transmissions received from a host device comprising: implementing a trusted execution environment (TEE) on the secure terminal using at least a trusted portion of one or more processor cores of the CPU of the secure terminal that is separate from public portions of the one or more processor cores; receiving a transmission from the host device destined for a remote device; decrypting the received transmission inside the TEE such that the decrypted received transmission is not exposed to the public portions of the one or more processor cores; applying a policy to the decrypted transmission; determining whether the decrypted transmission is authorized based on satisfaction or failure of the policy; and in response to the transmission being authorized, encrypting and forwarding the transmission over the network to the remote device. ### Claim 18 (depends on 17) The one or more hardware-based computer-readable memory devices of claim 17, in which the remote device verifies that the forwarded transmission is signed by the secure terminal. ### Claim 19 (depends on 17) The one or more hardware-based computer-readable memory devices of claim 17, further comprising, when the transmission is not authorized, sending the transmission from the secure terminal to a trusted peripheral device for consumption by an end user. ### Claim 20 (depends on 19) The one or more hardware-based computer-readable memory devices of claim 19, in which the trusted peripheral device is an output device, and further comprising: receiving overriding authorization at an input device from the end user responsive to the transmission being received at the output device from the secure terminal; and responsive to the overriding authorization, permitting the transmission to be forwarded to the remote device from the secure terminal.