US 11,238,136 B2Granted

Detecting unauthorized access to secure devices

OwnerStanton Kee Netheryinventor

Life of this patent

Estimating the term…

Loading patent…

Abstract

This Application describes devices, and techniques for using them, capable of allowing valid access to targeted device data without the owner's consent, while still informing the owner whenever any invalid access has occurred. In one embodiment, each targeted device's data is protected by several techniques: (A) maintaining protected data on the targeted device encrypted, thus preventing hardware or software access without authorization; (B) maintaining encryption keys for protected data in a “secure enclave”, not software accessible without authorization, and not hardware accessible without substantial effort; (C) maintaining the secure enclave within a tamper-evident enclosure, the tamper-evident enclosure having a unique identifier that is not easily duplicable; and (D) providing relatively easy retrieval of the unique identifier and checking that the unique identifier has not been altered.

Claims20

Dependent claims

An electronic device, comprising:

a network node;
and
an interface circuit, coupled to the network node, configured to communicate with a second electronic device;
memory configured to store program instructions and secure data;
a processor, coupled to the memory, configured to execute the program instructions, wherein, when executed by the processor, the program instructions cause the electronic device to perform operations comprising:
creating a current unique identifier associated with the electronic device whenever a condition occurs, wherein the condition comprises one of:
when the electronic device is turned on, or when there is unauthorized access to the secure data;
generating a fingerprint associated with the electronic device, wherein the fingerprint comprises a secure combination of the current unique identifier associated with the electronic device and additional information;
providing, from the network node, one or more packets or frames intended for the second electronic device, wherein the one or more packets or frames convey the fingerprint;
receiving a security request or determining a predefined time interval has elapsed;
providing, from the network node, a request for the fingerprint intended for the second electronic device in response to the security request or the determination;
receiving, at the network node, one or more second packets or frames associated with the second electronic device, wherein the one or more second packets or frames convey the fingerprint;
generating a second fingerprint associated with the electronic device, wherein the second fingerprint comprises a secure combination of the current unique identifier associated with the electronic device and additional information;
comparing the fingerprint and the second fingerprint;
and
when the fingerprint and the second fingerprint are different, performing a remedial action.

13 more elements

A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions that, when executed by a processor in the electronic device, causes the electronic device to perform operations comprising:

creating a current unique identifier associated with the electronic device whenever a condition occurs, wherein the condition comprises one of:
when the electronic device is turned on, or when there is unauthorized access to secure data stored in memory in the electronic device;
generating a fingerprint associated with the electronic device, wherein the fingerprint comprises a secure combination of the current unique identifier associated with the electronic device and additional information;
providing one or more packets or frames intended for a second electronic device, wherein the one or more packets or frames convey the fingerprint;
receiving a security request or determining a predefined time interval has elapsed;
providing a request for the fingerprint intended for the second electronic device in response to the security request or the determination;
receiving one or more second packets or frames associated with the second electronic device, wherein the one or more second packets or frames convey the fingerprint;
generating a second fingerprint associated with the electronic device, wherein the second fingerprint comprises a secure combination of the current unique identifier associated with the electronic device and additional information;
comparing the fingerprint and the second fingerprint;
and
when the fingerprint and the second fingerprint are different, performing a remedial action.

8 more elements

A method for performing a comparison, comprising:

by a processor in an electronic device:
creating a current unique identifier associated with the electronic device whenever a condition occurs, wherein the condition comprises one of:
when the electronic device is turned on, or when there is unauthorized access to secure data stored in memory in the electronic device;
generating a fingerprint associated with the electronic device, wherein the fingerprint comprises a secure combination of the current unique identifier associated with the electronic device and additional information;
providing one or more packets or frames intended for a second electronic device, wherein the one or more packets or frames convey the fingerprint;
receiving a security request or determining a predefined time interval has elapsed;
providing a request for the fingerprint intended for the second electronic device in response to the security request or the determination;
receiving one or more second packets or frames associated with the second electronic device, wherein the one or more second packets or frames convey the fingerprint;
generating a second fingerprint associated with the electronic device, wherein the second fingerprint comprises a secure combination of the current unique identifier associated with the electronic device and additional information;
comparing the fingerprint and the second fingerprint;
and
when the fingerprint and the second fingerprint are different, performing a remedial action.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/856,025Filed 23 Apr 2020 · us provisional application
Priority: 25 Apr 2019
Published: US 2020/0342074 A129 Oct 2020
Granted: 1 Feb 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification19 codes

G06F 21/12
Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]: protecting…
G06F 21/6209
Protecting access to data via a platform, e.g. using keys or access control rules: to a single file or object, e.g. in a secure envelope,…
G06F 7/582
Random or pseudo-random number generators: pseudo-random number generators
G06F 21/16
Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]: program or…