System and method for smart card based hardware root of trust on mobile platforms using near field communications

1. A method, comprising:

storing, by a mobile platform, a plurality of digital signatures, each digital signature including information corresponding to a user, the information comprising operating system information to be used when booting the mobile platform for the user;

receiving, by the mobile platform, a digital certificate from an integrated circuit card (“ICC”) via close-proximity radio communication prior to booting the mobile platform;

verifying the digital certificate with one of the digital signatures stored on the mobile platform prior to booting of the mobile platform;

booting the mobile platform upon verification of the digital certificate of the ICC using a public key provided by the digital certificate corresponding to the operating system information of the one of the digital signatures; and

establishing a secure communication channel between the mobile platform and a network based on the digital certificate;

obtaining measured boot values of the mobile platform;

providing the measured boot values to a mobile device management (“MDM”) server; and

receiving a verification of a validity of the measured boot values from the MDM server.

2. The method of claim 1 , further including:

disabling the mobile platform when the digital signature fails to verify the digital certificate.

3. The method of claim 1 , further including:

receiving a device-based user security credential via a user interface (“UI”) on the mobile platform; and

verifying the device-based user security credential.

4. The method of claim 3 , wherein the device-based user security credential includes at least one of a personal identification number (“PIN”), a password, a swipe pattern, a motion pattern, voice recognition and facial recognition.

5. The method of claim 1 , wherein establishing the secure communication channel is based on utilizing a credential and wherein the digital certificate is a credential.

6. A non-transitory computer readable storage medium including a set of instructions executable by a processor, the set of instructions, when executed, resulting in a performance of the following:

store a plurality of digital signatures, each digital signature including information corresponding to a user, the information comprising operating system information to be used when booting a mobile platform for the user;

receive a digital certificate from an integrated circuit card (“ICC”) via close-proximity radio communication prior to booting the mobile platform;

verify the digital certificate with one of the digital signatures stored on the mobile platform prior to booting of the mobile platform;

boot the mobile platform upon verification of the digital certificate of the ICC using a public key provided by the digital certificate corresponding to the operating system information of the one of the digital signatures; and

establish a secure communication channel between the mobile platform and a network based on the digital certificate;

obtain measured boot values of the mobile platform;

provide the measured boot values to a mobile device management (“MDM”) server; and

receiving a verification of a validity of the measured boot values from the MDM server.

7. The non-transitory computer readable storage medium of claim 6 , wherein the execution of the set of instructions further results in the performance of the following:

disable the mobile platform when the digital signature fails to verify the digital certificate.

8. The non-transitory computer readable storage medium of claim 6 , wherein the execution of the set of instructions further results in the performance of the following:

receive a device-based user security credential via a user interface (“UI”) on the mobile platform; and

verify the device-based user security credential.

9. The non-transitory computer readable storage medium of claim 8 , wherein the device-based user security credential includes at least one of a personal identification number (“PIN”), a password, a swipe pattern, a motion pattern, voice recognition and facial recognition.

10. A mobile platform, comprising:

a non-transitory computer readable storage medium storing a plurality of digital signatures, each digital signature including information corresponding to a user, the information comprising operating system information to be used when booting a mobile platform for the user; and

a processor receiving a digital certificate from an integrated circuit card (“ICC”) via close-proximity radio communication between the ICC and the mobile platform prior to booting the mobile platform, verifying the digital certificate with one of the digital signatures prior to booting of the mobile platform, booting the mobile platform upon verification of the digital certificate of the ICC using a public key provided by the digital certificate corresponding to the operating system information of the one of the digital signatures and establishing a secure communication channel between the mobile platform and a network based on the digital certificate, obtaining measured boot values of the mobile platform, providing the measured boot values to a mobile device management (“MDM”) server and receiving a verification of a validity of the measured boot values from the MDM server.

11. The system of claim 10 , wherein the processor disables the mobile platform when the digital signature fails to verify the digital certificate.

12. The system of claim 10 , wherein the processor receives a device-based user security credential via a user interface (“UI”) on the mobile platform and verifies the device-based user security credential.

13. The system of claim 12 , wherein the device-based user security credential includes at least one of a personal identification number (“PIN”), a password, a swipe pattern, a motion pattern, voice recognition and facial recognition.