# US 2019/0318133 A1 · Methods and system for responding to detected tampering of a remotely deployed computer

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0318133 A1
- Document ID: US20190318133A1
- Status: Published application
- Kind: A1
- Application number: 15/954,865
- Filed: 2018-04-17
- Published: 2019-10-17
- Earliest claimed: 2018-04-17
- Assignees: Akamai Technologies, Inc.
- Applicants: Akamai Technologies, Inc.
- Inventors: Marin S. Lulic; Timothy Y. Dunn
- Web page: https://patentgrep.com/patent/US20190318133A1

## CPC

- G06F 21/76: in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- G06F 21/81: by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
- G06F 21/86: Secure or tamper-resistant housings
- H04L 9/004: {for fault attacks}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- G06F 2221/2143: Clearing memory, e.g. to prevent the data from being stolen
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 2209/12: Details relating to cryptographic hardware or logic circuitry
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Among other things, this document describes systems, devices, and methods for responding to the detection of tampering with a remotely deployed computer, such as a server in a network data center. In one embodiment, the computer can be equipped with various tamper detection mechanisms, such as proximity sensors or circuitry triggered when the server's case is opened and/or internal components are moved or altered. Tamper detection can invoke an automated trust revocation mechanism. When tampering is detected, the computer hardware can automatically prevents access to, and/or use of, a previously stored authentication key. Consequently, the computer cannot authenticate to a remote entity, such as a network operations center and/or another computer in a distributing computing system. In some embodiments, the computer remains operable so that administrators can communicate with the server and/or extract information therefrom, although the computer will be treated as entrusted.

## Claims

### Claim 1

method performed by a computer upon detection of tampering with the computer, the method comprising:
with a computer comprising a cover and computer hardware including circuitry providing one or more processors and one or more memory devices;
storing an encryption key and an authentication key in the one or more memory devices, the authentication key being encrypted using the encryption key;
receiving a signal from tamper detection circuitry in the computer, the signal indicating detection of tampering with the computer;
in response to the tampering signal, removing the encryption key from the one or more memory devices;
after the removal of the encryption key, executing an authentication routine in an attempt to authenticate the computer to a remote computer;
failing to read the authentication key due to the lack of the encryption key;
communicating with the remote computer in an un-authenticated mode.

### Claim 2 (depends on 1)

The method of claim 1, further comprising, in response to failing to read the authentication key due to the lack of the encryption key, loading an alternate set of data for use in communicating with the remote computer in the un-authenticated mode.

### Claim 3 (depends on 1)

The method of claim 1, wherein the tamper detection circuitry detects any of: removal of the cover of the computer, removal of a circuit board in the computer, and a temperature change within the computer.

### Claim 4 (depends on 1)

The method of claim 1, wherein the detection of tampering comprises detection of tampering with any of the cover and the computer hardware of the computer.

### Claim 5 (depends on 1)

The method of claim 1, wherein removing the encryption key comprises removing electrical power from a particular volatile memory device in the one or more memory devices that stores the encryption key.

### Claim 6 (depends on 1)

The method of claim 1, wherein the computer comprises a field programmable gate array (FPGA) device storing the encryption key.

### Claim 7

method performed by a computer upon detection of tampering with the computer, the method comprising:
with a computer comprising a cover and computer hardware comprising circuitry providing one or more processors and one or more memory devices;
storing an encryption key, a first set of data, and a second set of data, in the one or more memory devices, the first set of data being encrypted using the encryption key;
receiving a signal from tamper detection circuitry in the computer, the signal indicating detection of tampering with the computer;
in response to the tampering signal, removing the encryption key from the one or more memory devices;
after the removal of the encryption key, executing an authentication routine to attempt to authenticate the computer to a remote computer;
failing to read the first set of data due to the lack of the encryption key;
reading the second set of data and operating the computer in accord therewith, wherein operation of the computer with the second set of data differs from operation with the first set of data such that a remote network operations center can detect the difference.

### Claim 8 (depends on 7)

The method of claim 7, further comprising: communicating with the remote computer based on the second set of data.

### Claim 9 (depends on 7)

The method of claim 7, wherein the first and second sets of data comprise any of: software, firmware.

### Claim 10 (depends on 7)

The method of claim 7, wherein the first set of data differs from the second set of data at least in that the first set of data includes any of: an authenticator and an authentication routine for authenticating to the remote computer,

### Claim 11 (depends on 7)

The method of claim 7, wherein the first set of data differs from the second set of data at least in that the first set of data includes an authentication key.

### Claim 12 (depends on 7)

The method of claim 7, wherein the first set of data comprises a first set of computer program instructions and the second set of data comprises a second set of computer program instructions.

### Claim 13

A computer with components to detect and respond to physical tampering, comprising:
a cover;
computer hardware comprising:
a first memory device storing an encryption key and a second memory device storing an authentication key, the authentication key being encrypted using the encryption key;
a switch circuit that receives a signal from tamper detection circuitry in the computer, the signal indicating detection of tampering with the computer, and that, in response to the tampering signal, removes the encryption key from the first memory device;
one or more hardware processors that, after the removal of the encryption key, execute an authentication routine in an attempt to authenticate the computer to a remote computer, the one or more hardware processors failing to read the authentication key due to the lack of the encryption key, and thereafter communicating with the remote computer in an un-authenticated mode.

### Claim 14 (depends on 13)

The computer of claim 13, wherein the first memory device comprises a volatile memory device.

### Claim 15 (depends on 13)

The computer of claim 13, wherein the tamper detection circuitry detects any of: removal of the cover of the computer, removal of a circuit board in the computer, and a temperature change within the computer.

### Claim 16 (depends on 13)

The computer of claim 13, wherein the detection of tampering comprises detection of tampering with any of the cover and the computer hardware of the computer.

### Claim 17 (depends on 13)

The computer of claim 13, wherein removing the encryption key comprises removing electrical power from the first memory devices that stores the encryption key.

### Claim 18 (depends on 13)

The computer of claim 13, wherein the computer comprises a field programmable gate array (FPGA) device storing the encryption key.

### Claim 19

computer with components to detect and respond to physical tampering, comprising:
a cover;
computer hardware comprising:
a first memory device storing an encryption key and a second memory device storing a first and second sets of data, the first set of data being encrypted using the encryption key;
a switch circuit that receives a signal from tamper detection circuitry in the computer, the signal indicating detection of tampering with the computer, and that, in response to the tampering signal, removes the encryption key from the first memory device;
one or more hardware processors that, after the removal of the encryption key, execute an authentication routine in an attempt to authenticate the computer to a remote computer, the one or more hardware processors failing to read the first set of data due to the lack of the encryption key, and thereafter reading the second set of data and operating the computer in accord therewith, wherein operation of the computer with the second set of data differs from operation with the first set of data such that a remote network operations center can detect the difference.

### Claim 20 (depends on 19)

The computer of claim 19, wherein the first memory device comprises a volatile memory device.

### Claim at position 21

-40. (canceled)