Protecting remote asset against data exploits utilizing an embedded key generator
View Patent ↗Some embodiments include a method of using different keys from an embedded key generator for each update of a trusted storage to mitigate common user-based exploits (clone, restore, tamper) of the trusted storage. The method includes: retrieving a key generator certificate from the key generator; requesting the key generator to generate a key associated with a key authenticator and to return a key handle associated with the key; generating a request to the key generator, the request including the key handle, the key authenticator, and a record to be maintained in the trusted storage; and in response to receiving an encrypted record from the key generator, storing the encrypted record associated with the first key handle and an authenticator generation formula in the trusted storage in a computing device, wherein the encrypted record is encrypted via the above key.
1. A computer-implemented method of maintaining a trusted storage via a licensed application in a computing device on behalf of a global license server, comprising:
retrieving a key generator certificate from an embedded key generator, wherein the embedded key generator is a hardware component embedded in the computing device separate from a processor of the computing device that executes the licensed application;
requesting the embedded key generator to generate a first encryption key associated with a first key authenticator and to return a first key handle associated with the first encryption key;
generating an encryption request to send to the embedded key generator, the encryption request including the first key handle, the first key authenticator, and a fulfillment record to be maintained in the trusted storage of the computing device; and
in response to receiving an encrypted fulfillment record from the embedded key generator, storing the encrypted fulfillment record in the trusted storage, wherein the encrypted fulfillment record is encrypted via the first encryption key.
2. The computer-implemented method of claim 1 , further comprising:
receiving the fulfillment record and an authenticator generation formula associated with the fulfillment record from the global license server.
3. The computer-implemented method of claim 2 , further comprising:
calculating the first key authenticator using the authenticator generation formula provided by the global license server based on the key generator certificate.
4. The computer-implemented method of claim 2 , further comprising:
sending an activation request to the global license server, wherein the activation request includes the key generator certificate;
wherein the fulfillment record and the authenticator generation formula are received as a response to the record activation request.
5. The computer-implemented method of claim 4 , wherein the activation request is a request to activate one or more licenses, the activation request including an entitlement identifier from a software or service vendor; and wherein the fulfillment record is a fulfillment record of the licenses.
6. The computer-implemented method of claim 2 , wherein receiving the fulfillment record and the authenticator generation formula is part of receiving a payload message including the fulfillment record, the authenticator generator formula, and the key generator certificate from the global license server.
7. The computer-implemented method of claim 6 , wherein the payload message is digitally signed by the global license server.
8. The computer-implemented method of claim 1 , wherein retrieving the key generator certificate is by sending an authentication request based an owner authentication code that is established when the computing device first initiated the embedded key generator.
9. A computer-implemented method of securely modifying a trusted storage via an agent application in a computing device, comprising:
maintaining the trusted storage in the computing device, wherein the trusted storage stores an encrypted agent record associated with a first key handle and an authenticator generation formula, and wherein the encrypted agent record is maintained by the agent application in the computing device on behalf of a verification server external to the computing device;
requesting an embedded key generator to decrypt the encrypted agent record by referencing the first key handle and authenticating with a first key authenticator calculated based on the authenticator generation formula, wherein the embedded key generator is a hardware component embedded in the computing device separate from a processor of the computing device that executes the agent application;
requesting the embedded key generator to generate a second encryption key associated with a second key authenticator and to return a second key handle associated with the second encryption key;
generating an encryption request to send to the embedded key generator to encrypt a payload message including a record update of the decrypted agent record and the decrypted agent record; and
commanding the embedded key generator to delete a first encryption key that was used to encrypt the encrypted agent record by referencing the first key handle and authenticating with the first key authenticator.
10. The computer-implemented method of claim 9 , wherein the decrypted agent record represents a digital policy governing computing activities of an end-user of the computing device or device usage data associated with a computing activity monitored by the agent application for the verification server.
11. The computer-implemented method of claim 9 , wherein the encryption request includes the second key handle, the second key authenticator, and the payload message.
12. The computer-implemented method of claim 9 , wherein the decrypted agent record is digitally signed by the verification server.
13. The computer-implemented method of claim 9 , further comprising:
receiving an encrypted response from the embedded key generator, wherein the encrypted response is responsive to the encryption request; and
storing the encrypted response in the trusted storage.
14. The computer-implemented method of claim 9 , further comprising:
retrieving a key generator certificate from the embedded key generator based on an owner authentication code available to the agent application; and
calculating the first authenticator key based on the authenticator generation formula with the key generator certificate as a parameter.
15. The computer-implemented method of claim 14 , further comprising:
calculating a hash value based on the record update; and
calculating the second authenticator key based on the authenticator generation formula with the key generator certificate and the hash value as parameters.
16. The computer-implemented method of claim 9 , wherein the verification server is a global license server; wherein the decrypted agent record includes a fulfillment record; and wherein the record update includes a licensing state update that accounts for consumption of one or more licenses within the fulfillment record.
17. A computing device comprising:
a processor;
an embedded key generator that is a hardware component separate from the processor;
a memory storing executable instructions implementing an agent application module, wherein the memory includes a trusted storage space;
wherein the agent application module, when executed by the processor, is operable to maintain the trusted storage space for a verification computer server by:
retrieving a key generator certificate from the embedded key generator;
requesting the embedded key generator to generate a first encryption key associated with a first key authenticator and to return a first key handle associated with the first encryption key;
generating a first encryption request to send to the embedded key generator, the first encryption request including the first key handle, the first key authenticator, and an agent record to be maintained in the trusted storage space; and
in response to receiving an encrypted agent record from the embedded key generator, storing the encrypted agent record associated with the first key handle and an authenticator generation formula in the trusted storage space, wherein the encrypted agent record is encrypted via the first encryption key.
18. The computing device of claim 17 , wherein the agent record represents a digital policy governing an end-user of the computing device or device usage data associated with a computing activity monitored by the agent application module for the verification computer server.
19. The computing device of claim 17 , wherein the verification computer server is a global license server; wherein the agent record includes a fulfillment record of one or more licenses.
20. The computing device of claim 17 , wherein the agent application module, when executed by the processor, is further operable to:
request the embedded key generator to decrypt the encrypted agent record by referencing the first key handle and authenticating with the first key authenticator calculated based on the authenticator generation formula;
request an embedded key generator to generate a second encryption key associated with a second key authenticator and to return a second key handle associated with the second encryption key, wherein the second key authenticator is calculated based on the authenticator generation formula;
generate a second encryption request to send to the embedded key generator to encrypt a payload message including a record update of the decrypted agent record and the decrypted agent record; and
command the embedded key generator to delete the first encryption key by referencing the first key handle and authenticating with the first key authenticator.