Trusted execution of an executable object on a local device
View Patent ↗In one example embodiment, an electronic device is provided and configured to: acquire authentication data for an authorized user; store the authentication data in an enclave; acquire identification data for a potential user; and compare, in the enclave, the identification data to the authentication data for recognizing if the potential user is the authorized user. In another embodiment, a server is provided and includes at least one processor; at least one memory; at least one driver, where the server is configured to: receive assertion data from an electronic device, where the assertion includes an authentication signing key and results from a comparison of acquired data and reference data; and determine if the assertion data is valid by: comparing the results to a threshold; and comparing the authentication signing key to an authentication signing key assigned to the electronic device.
1. An electronic client device, comprising:
an enclave;
at least one processor;
at least one memory;
at least one driver, wherein the electronic client device is configured to:
obtain an authentication signing key from an attestation server;
store the authentication signing key in the enclave, wherein the authentication signing key verifies the identity of the enclave;
acquire, after storing the authentication signing key, authentication data for an authorized user;
store the authentication data in the enclave;
acquire identification data for a potential user;
compare, by locally executing, with the processor, a biometric algorithm in the enclave, the identification data to the authentication data to determine if the potential user is the authorized user; and
send results of the comparison and the authentication signing key to an authentication server.
2. The electronic client device of claim 1 , wherein the electronic client device is further configured to:
generate an assertion claim for the potential user using a claim building algorithm.
3. The electronic client device of claim 1 , wherein the results of the comparison are encrypted.
4. The electronic client device of claim 1 , wherein the results of the comparison are encrypted and stored in an untrusted memory that is separate from the enclave.
5. The electronic client device of claim 1 , wherein the identification data is biometric data.
6. The electronic client device of claim 1 , wherein the identification data is acquired outside of the enclave and a trusted services application program interface is used to bring the identification data into the enclave.
7. The electronic client device of claim 1 , wherein the electronic client device is further configured to:
access a secure application based on the results of the comparison.
8. The electronic client device of claim 1 , wherein the enclave operates in a trusted execution environment.
9. The electronic client device of claim 1 , wherein the enclave is a protected region of memory that is accessible through a trusted services application program interface.
10. The electronic client device of claim 1 , wherein the identification data is acquired by a hardware sensor.
11. One or more non-transitory computer readable medium having instructions stored thereon, the instructions, when executed by a processor, cause the processor to:
obtain an authentication signing key from an attestation server;
store the authentication signing key in the enclave, wherein the authentication signing key verifies the identity of the enclave;
acquire, after storing the authentication signing key, authentication data for an authorized user;
store the authentication data in an enclave on an electronic client device;
acquire identification data for a potential user; and
compare, by locally executing a biometric algorithm in the enclave, the identification data to the authentication data to determine if the potential user is the authorized user; and
send results of the comparison and the authentication signing key to an authentication server.
12. The medium of claim 11 , further including instructions that, when executed by the processor, cause the processor to:
generate an assertion claim for the potential user using a claim building algorithm.
13. The medium of claim 11 , wherein results of the comparison are encrypted and stored in an untrusted memory that is separate from the enclave.
14. The medium of claim 11 , wherein the identification data is biometric data.
15. The medium of claim 11 , wherein the identification data is acquired outside of the enclave and a trusted services application program interface is used to bring the identification data into the enclave.
16. The medium of claim 11 , further including instructions that, when executed by the processor, cause the processor to:
access a secure application based on results of the comparison.
17. The medium of claim 11 , wherein the enclave is a trusted execution environment.