System and methods for remote software authentication of a computing device
The current disclosure relates to techniques for system and methods for software-based management of remote software authentication of at least one entity machine, addressing various vulnerabilities of software authentication based upon the genuinity based scheme. The disclosure is using challenge execution on at least one suspect machine, providing a technique for CPU event monitoring of a combined count of at least two events monitored on the entity machine during execution of the authentication challenge. The authentication challenge allows further detection functionality of virtual machine or a hypervisor installed. The techniques measures execution time of authentication challenge, comparing the received challenge result with the expected challenge result and accordingly rejects or allows the entity machine through the authentication process.
1. A method for use in a system comprising an authentication server authenticating at least one entity machine, the method comprising:
generating at least one authentication challenge;
obtaining an expected challenge result comprising a calculated result for said at least one authentication challenge, at least one hardware count value and an execution time threshold value;
sending said authentication challenge to said at least one entity machine;
starting a timer;
receiving a challenge result from said entity machine;
stopping said timer thereby recording an execution time for said entity machine;
rejecting said entity machine if said execution time is longer than said execution time threshold value;
comparing said received challenge result with said expected challenge result; and
rejecting said entity machine if said received challenge result does not match said expected challenge result;
wherein said at least one hardware count value comprises a combined count value of at least two events monitored by performance hardware counters on said entity machine during execution of said authentication challenge.
2. The method of claim 1 , wherein said a combined count of at least two events, further comprises the steps of:
initializing a set of hardware components to a known state;
assigning a hardware-counter to count a first event during execution of said at least one authentication challenge;
monitoring said first event against an event condition; and
switching said hardware-counter to monitor at least a second event, when said hardware-counter meets said event condition.
3. The method of claim 2 , wherein said a combined count of at least two events, further comprises the steps of:
updating said event condition to match switched said hardware-counter; and
incorporating final hardware-counter readings into said challenge result.
4. The method of claim 2 , further comprising:
monitoring an n th event against an n th event condition; and
switching said hardware-counter to monitor at least an (n+1) th event, when said hardware-counter meets said n th event condition.
5. The method of claim 4 , wherein said a combined count of at least two events, further comprises the step of updating said event condition to match switched said hardware-counter.
6. The method of claim 2 , wherein said event condition is configured to be a threshold value associated with a specific event.
7. The method of claim 2 , wherein said event condition is configured to be a pre-determined condition associated with a specific event.
8. The method of claim 5 , wherein said event condition is configured to be a threshold value associated with a specific event.
9. The method of claim 5 , wherein said event condition is configured to be a pre-determined condition associated with a specific event.
10. The method of claim 1 , wherein at least one of said events monitored on said entity machine is an event affected by the presence of a hypervisor such that if a hypervisor is present, said received challenge result will not match said expected challenge result and said entity machine is rejected.
11. The method of claim 1 , wherein at least one of said events monitored on said entity machine comprises a machine specific register.
12. The method of claim 1 , wherein said expected challenge result is generated by executing said authentication challenge on a machine identical to said entity machine.
13. A method for use in a system comprising an authentication server for authenticating a suspect machine, the method comprising:
setting a challenge function to be executed on a suspect machine within a time limit;
computing an expected challenge result;
transmitting said challenge function to said suspect machine;
measuring an execution time of said challenge function;
receiving a challenge result from said suspect machine;
comparing received challenge result with the expected challenge result; and
accepting said suspect machine if said challenge result matches said expected challenge result and said execution time is less then said time limit;
wherein said challenge function includes monitoring at least two hardware counting events, monitored by at least one performance hardware counter of a similar machine.
14. The method of claim 10 , wherein said challenge function, comprises the steps of:
initializing a set of hardware components to a known state;
using a hardware-counter to count a first event during execution of said challenge function;
monitoring said hardware counter against an event condition;
switching said hardware-counter to monitor at least a second event, when said hardware-counter meets said event condition; and
updating said event condition to match switched said hardware-counter.
15. The method of claim 11 , wherein said event condition is a threshold value associated with a specific event.
16. The method of claim 11 , wherein said event condition is a pre-determined condition associated with a specific event.