# US 2015/0150084 A1 · System and methods for remote software authentication of a computing device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2015/0150084 A1
- Document ID: US20150150084A1
- Status: Published application
- Kind: A1
- Application number: 14/088,406
- Filed: 2013-11-24
- Published: 2015-05-28
- Earliest claimed: 2013-11-24
- Assignees: Truly Protect Oy
- Applicants: University of JyväSkylä
- Inventors: MICHAEL KIPERBERG; AMIT RESH; NEZER ZAIDENBERG
- Web page: https://patentgrep.com/patent/US20150150084A1

## CPC

- G06F 21/44: Program or device authentication
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 2221/2103: Challenge-response
- G06F 2221/2135: Metering
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The current disclosure relates to techniques for system and methods for software-based management of remote software authentication of at least one entity machine, addressing various vulnerabilities of software authentication based upon the genuinity based scheme. The disclosure is using challenge execution on at least one suspect machine, providing a technique for CPU event monitoring of a combined count of at least two events monitored on the entity machine during execution of the authentication challenge. The authentication challenge allows further detection functionality of virtual machine or a hypervisor installed. The techniques measures execution time of authentication challenge, comparing the received challenge result with the expected challenge result and accordingly rejects or allows the entity machine through the authentication process.

## Claims

### Claim 1

A method for authenticating at least one entity machine, the method comprising:
generating at least one authentication challenge;
obtaining an expected challenge result comprising a calculated result for said at least one authentication challenge, at least one hardware count value and an execution time threshold value;
sending said authentication challenge to said at least one entity machine;
starting a timer;
receiving a challenge result from said entity machine;
stopping said timer thereby recording an execution time for said entity machine;
rejecting said entity machine if said execution time is longer than said execution time threshold value;
comparing said received challenge result with said expected challenge result; and
rejecting said entity machine if said received challenge result does not match said expected challenge result;
wherein said at least one hardware count value comprises a combined count of at least two events monitored on said entity machine during execution of said authentication challenge.

### Claim 2 (depends on 1)

The method of claim 1, wherein said a combined count of at least two events, further comprises the steps of:
initializing a set of hardware components to a known state;
assigning a hardware-counter to count a first event during execution of said at least one authentication challenge;
monitoring said first event against an event condition; and
switching said hardware-counter to monitor at least a second event, when said hardware-counter meets said event condition.

### Claim 3 (depends on 2)

The method of claim 2, wherein said a combined count of at least two events, further comprises the steps of:
updating said event condition to match switched said hardware-counter; and
incorporating final hardware-counter readings into said challenge result.

### Claim 4 (depends on 2)

The method of claim 2, further comprising:
monitoring an nth event against an nth event condition; and
switching said hardware-counter to monitor at least an (n+1)th event, when said hardware-counter meets said nth event condition,

### Claim 5 (depends on 4)

The method of claim 4, wherein said a combined count of at least two events, further comprises the step of updating said event condition to match switched said hardware-counter.

### Claim 6 (depends on 2)

The method of claim 2, wherein said event condition is configured to be a threshold value associated with a specific event.

### Claim 7 (depends on 2)

The method of claim 2, wherein said event condition is configured to be a pre-determined condition associated with a specific event.

### Claim 8 (depends on 5)

The method of claim 5, wherein said event condition is configured to be a threshold value associated with a specific event.

### Claim 9 (depends on 5)

The method of claim 5, wherein said event condition is configured to be a pre-determined condition associated with a specific event.

### Claim 10 (depends on 1)

The method of claim 1, wherein at least one of said events monitored on said entity machine is an event affected by the presence of a hypervisor such that if a hypervisor is present, said received challenge result will not match said expected challenge result and said entity machine is rejected.

### Claim 11 (depends on 1)

The method of claim 1, wherein at least one of said events monitored on said entity machine comprises a machine specific register.

### Claim 12 (depends on 1)

The method of claim 1, wherein said expected challenge result is generated by executing said authentication challenge on a machine identical to said entity machine.

### Claim 13

A method for authenticating a suspect machine, the method comprising:
setting a challenge function to be executed on a suspect machine within a time limit;
computing an expected challenge result;
transmitting said challenge function to said suspect machine;
measuring an execution time of said challenge function;
receiving a challenge result from said suspect machine;
comparing received challenge result with the expected challenge result; and
accepting said suspect machine if said challenge result matches said expected challenge result and said execution time is less then said time limit;
wherein said challenge function includes monitoring at least two hardware counting events.

### Claim 14 (depends on 10)

The method of claim 10, wherein said challenge function, comprises the steps of:
initializing a set of hardware components to a known state;
using a hardware-counter to count a first event during execution of said challenge function;
monitoring said hardware counter against an event condition;
switching said hardware-counter to monitor at least a second event, when said hardware-counter meets said event condition; and
updating said event condition to match switched said hardware-counter.

### Claim 15 (depends on 11)

The method of claim 11, wherein said event condition is a threshold value associated with a specific event.

### Claim 16 (depends on 11)

The method of claim 11, wherein said event condition is a pre-determined condition associated with a specific event.