# US 11,907,362 B2 · Trusted execution of an executable object on a local device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,362 B2 - Document ID: US11907362B2 - Status: Granted - Kind: B2 - Application number: 16/865,133 - Filed: 2020-05-01 - Published: 2020-08-13 - Granted: 2024-02-20 - Earliest claimed: 2013-09-27 - Assignees: MAfee, LLC - Applicants: McAfee, LLC - Inventors: Steve Grobman; Carl Woodward; James D. Beaney, Jr.; Jimmy Scott Raynor - Web page: https://patentgrep.com/patent/US11907362B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/31: User authentication - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04W 12/06: Authentication - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - G06F 2221/2105: Dual mode as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In one example embodiment, an electronic device is provided and configured to: acquire authentication data for an authorized user; store the authentication data in an enclave; acquire identification data for a potential user, and compare, in the enclave, the identification data to the authentication data for recognizing if the potential user is the authorized user. In another embodiment, a server is provided and includes at least one processor; at least one memory; at least one driver, where the server is configured to: receive assertion data from an electronic device, where the assertion includes an authentication signing key and results from a comparison of acquired data and reference data; and determine it the assertion data is valid by: comparing the results to a threshold; and comparing the authentication signing key to an authentication signing key assigned to the electronic device. ## Claims ### Claim 1 A system, comprising: at least one processor; at least one memory; an attestation server configured to: confirm that an un-trusted electronic device has an enclave or a trusted execution environment; assign an authentication signing key to the electronic device; receive authentication data that identifies an authorized user; share the authentication data that identifies the authorized user and the assigned authentication signing key with the electronic device; and share the authentication signing key with an authentication server; and the authentication server, configured to: receive a signing key and assertion data from the electronic device, wherein the assertion data includes results of a comparison of acquired user identification data to the authentication data; and determine if the assertion data is valid by: comparing the received results of the comparison of the acquired user identification data to the authentication data from the electronic device to a confidence level threshold; and comparing the received signing key to the authentication signing key assigned to the electronic device. ### Claim 2 (depends on 1) The system of claim 1, wherein the assertion data determines if a corresponding user trying to access the electronic device is authorized. ### Claim 3 (depends on 1) The system of claim 1, wherein the authentication server is further configured to: allow access for the electronic device if the assertion data is valid. ### Claim 4 (depends on 1) The system of claim 1, wherein the assertion data is encrypted. ### Claim 5 (depends on 1) The system of claim 1, wherein the acquired user identification data and the authentication data are biometric data. ### Claim 6 (depends on 1) The system of claim 1, wherein the authentication data that identifies an authorized user and the authentication signing key is shared with the electronic device using a public-key infrastructure. ### Claim 7 A system including an attestation server and an authentication server, wherein the attestation server includes non-transitory computer readable medium having instructions stored thereon, the instructions, when executed by a processor, cause the processor to: confirm that an un-trusted electronic device has an enclave or a trusted execution environment; assign an authentication signing key to the electronic device; receive authentication data that identifies an authorized user; share the authentication data that identifies the authorized user and the assigned authentication signing key with the electronic device; and share the authentication signing key with the authentication server; and wherein the authentication server is configured to receive a signing key and assertion data from the electronic device, wherein the assertion data includes results of a comparison of acquired user identification data to the authentication data; and determine if the assertion data is valid by: comparing the received assertion data to a confidence level threshold; and comparing the received signing key to the authentication signing key assigned to the electronic device. ### Claim 8 (depends on 7) The medium of claim 7, wherein the assertion data determines if a corresponding user trying to access the electronic device is authorized. ### Claim 9 (depends on 7) The medium of claim 7, wherein the authentication server is further configured to: allow access for the electronic device if the assertion data is valid. ### Claim 10 (depends on 7) The medium of claim 7, wherein the assertion data is encrypted. ### Claim 11 (depends on 7) The medium of claim 7, wherein the acquired user identification data and the authentication data are biometric data. ### Claim 12 A user authentication system, comprising: an attestation server, the attestation server including: a processor; and a memory storing executable instructions that when executed by the processor cause the processor to: confirm that an un-trusted electronic device has an enclave or a trusted execution environment; assign an authentication signing key to the electronic device; receive authentication data that identifies an authorized user; share the authentication data that identifies the authorized user and the assigned authentication signing key with the electronic device using a public-key infrastructure; and share the authentication signing key with an authentication server; and the authentication server, the authentication server including: a processor; and a memory storing executable instructions that when executed by the processor cause the processor to: receive a signing key and assertion data from the electronic device, wherein the assertion data includes results of a comparison of acquired user identification data to the authentication data; and determine if the assertion data is valid by: comparing the received assertion data to a confidence level threshold; and comparing the received signing key to the authentication signing key assigned to the electronic device. ### Claim 13 (depends on 12) An user authentication system of claim 12, wherein the assertion data determines if a corresponding user trying to access the electronic device is authorized. ### Claim 14 (depends on 12) An user authentication system of claim 12, wherein the authentication server is further configured to: allow access for the electronic device if the assertion data is valid. ### Claim 15 (depends on 12) An user authentication system of claim 12, wherein the assertion data is encrypted. ### Claim 16 (depends on 12) An user authentication system of claim 12, wherein the acquired user identification data and the authentication data are biometric data.