Granted Patent B2

US 12,423,431 · App. 17/885,236 · Granted Sep 23, 2025

Inventor: Kyle Patrick Nahrgang (Phoenixville, PA)

Assignee: The ADT Security Corporation

G06F21/575G06F21/44G06F21/602G06F21/64G06F2221/033

Abstract

Claims (80)

1. A premises device of a premises security system, the premises device comprising:

a memory including a first operating system and a second operating system;

processing circuitry in communication with the memory, the processing circuitry configured to:

establish a chain of trust at least between the first operating system and at least one software application associated with the second operating system;

perform at least one action based at least in part on the established chain of trust; and

the establishing of the chain of trust includes at least one of:

storing a secret key in the first operating system, the secret key being a signing key inaccessible from outside the first operating system;

receiving a request for a driver of the second operating system to perform a software application authentication, the request including at least one of:

a checksum of a binary being authenticated excluding a number (N) of bytes of the binary; and

the number (N) of bytes of the binary, the number (N) of bytes being the last number (N) of bytes of the binary; and

determining that the number (N) of bytes of the binary are identical to a value of a checksum of the binary being authenticated after being encrypted with the signing key, the determination being performed at least in part to establish the chain of trust; and

authenticating the at least one software application based at least on the determination.

2. The premises device of claim 1 , wherein the establishing of the chain of trust further includes the driver of the second operating system being configured to at least one of:

calculate the checksum of the binary being authenticated excluding the number (N) of bytes of the binary;

include the checksum in the request;

include the number (N) of bytes of the binary being authenticated in the request; and

when the at least one software application associated with the second operating system interacts with the first operating system:

calculate a checksum of a compiled binary;

encrypt a value of the checksum of the compiled binary with the secret key; and

append data to an end of the compiled binary.

3. The premises device of claim 1 , wherein the first operating system includes a secured storage, and the processing circuitry is further configured to:

preload the secured storage of the first operating system with at least one file usable by the at least one software application associated with the second operating system when the at least one software application is authenticated.

4. The premises device of claim 3 , wherein the preloading of the secured storage of the first operating system includes at least one of:

initiating a pseudo trusted application, the pseudo trusted application being a storage trusted application and being built directly into the first operating system, the first operating system including a data key for encrypting and decrypting data;

preloading a file system of the second operating system with encrypted files that are to be loaded into storage, the encrypted files being encrypted using the data key; and

initiating a file application to interact with the storage trusted application, the file application being signed, trusted, and run at boot, the file application searching for files that have been encrypted and placed into a predetermined area of an unsecured filesystem and sending the files that have been encrypted to the storage trusted application to be decrypted and placed in storage.

5. The premises device of claim 1 , wherein the establishing of the chain of trust further includes establishing the chain of trust between a software application and another software application of the at least one software application associated with the second operating system, the establishing of the chain of trust between the software application and the other software application including:

initiating a secured communication trusted application to manage session tokens;

when the software application initiates a communication with the other software application:

generating, by the secured communication trusted application, a public-private key pair that is referenced by one session token of the session tokens, the public-private key pair having at least a private key; and

requesting, by the software application, the one session token of the session tokens from the secured communication trusted application.

6. The premises device of claim 5 , wherein the communication with the other software application includes a message that is encrypted using the private key, and when the message is received by any one of the software application and the other software application, the message is sent to the secure communication trusted application for decryption.

7. The premises device of claim 6 , wherein the communication with the other software application includes a socket of a socket protocol, the socket being configured to use Secure Sockets Layer (SSL), the SSL being configured to use at least a key within a secured storage of the first operating system.

8. The premises device of claim 1 , wherein the first operating system is an Open Portable Trusted Execution Environment (OP-TEE), and the second operating system is a Linux operating system.

9. A method implemented in a premises device of a premises security system, the premises device including a first operating system and a second operating system, the method comprising:

establishing a chain of trust at least between the first operating system and at least one software application associated with the second operating system;

performing at least one action based at least in part on the established chain of trust; and

the establishing of the chain of trust includes at least one of:

storing a secret key in the first operating system, the secret key being a signing key inaccessible from outside the first operating system;

receiving a request for a driver of the second operating system to perform a software application authentication, the request including any one of:

a checksum of a binary being authenticated excluding a number (N) of bytes of the binary; and

the number (N) of bytes of the binary, the number (N) of bytes being the last number (N) of bytes of the binary; and

determining that the number (N) of bytes of the binary are identical to a value of a checksum of the binary being authenticated after being encrypted with the signing key, the determination being performed at least in part to establish the chain of trust; and

authenticating the at least one software application based at least on the determination.

10. The method of claim 9 , wherein the establishing of the chain of trust further includes the driver of the second operating system being configured to at least one of:

calculate the checksum of the binary being authenticated excluding the number (N) of bytes of the binary;

include the checksum in the request;

include the number (N) of bytes of the binary being authenticated in the request; and

when the at least one software application associated with the second operating system interacts with the first operating system:

calculate a checksum of a compiled binary;

encrypt a value of the checksum of the compiled binary with the secret key; and

append data to an end of the compiled binary.

11. The method of claim 9 , wherein the first operating system includes a secured storage, and the method further includes:

preloading the secured storage of the first operating system with at least one file usable by the at least one software application associated with the second operating system when the at least one software application is authenticated.

12. The method of claim 11 , wherein the preloading of the secured storage of the first operating system includes at least one of:

initiating a pseudo trusted application, the pseudo trusted application being a storage trusteed application and being built directly into the first operating system, the first operating system including a data key for encrypting and decrypting data;

preloading a file system of the second operating system with encrypted files that are to be loaded into storage, the encrypted files being encrypted using the data key; and

initiating a file application to interact with the storage trusted application, the file application being signed, trusted, and run at boot, the file application searching for files that have been encrypted and placed into a predetermined area of an unsecured filesystem and sending the files that have been encrypted to the storage trusted application to be decrypted and placed in storage.

13. The method of claim 9 , wherein the establishing of the chain of trust further includes establishing the chain of trust between a software application and another software application of the at least one software application associated with the second operating system, the establishing of the chain of trust between the software application and the other software application including:

initiating a secured communication trusted application to manage session tokens;

when the software application initiates a communication with the other software application:

generating, by the secured communication trusted application, a public-private key pair that is referenced by one session token of the session tokens, the public-private key pair having at least a private key; and

requesting, by the software application, the one session token of the session tokens from the secured communication trusted application.

14. The method of claim 13 , wherein the communication with the other software application includes a message that is encrypted using the private key, and when the message is received by any one of the software application and the other software application, the message is sent to the secure communication trusted application for decryption.

15. The method of claim 14 , wherein the communication with the other software application includes a socket of a socket protocol, the socket being configured to use Secure Sockets Layer (SSL), the SSL being configured to use at least a key within a secured storage of the first operating system.

16. The method of claim 9 , wherein the first operating system is an Open Portable Trusted Execution Environment (OP-TEE), and the second operating system is a Linux operating system.

17. A premises device of a premises security system, the premises device comprising:

a memory including a first operating system and a second operating system;

processing circuitry in communication with the memory, the processing circuitry configured to:

store a secret key in the first operating system, the secret key being a signing key inaccessible from outside the first operating system;

receive a request for a driver of the second operating system to authenticate at least one software application associated with the second operating system, the request including at least one of:

a checksum of a binary being authenticated excluding a number (N) of bytes of the binary; and

the number (N) of bytes of the binary, the number (N) of bytes being the last number (N) of bytes of the binary;

determine that the number (N) of bytes of the binary are identical to a value of a checksum of the binary being authenticated after being encrypted with the signing key; and

establish a chain of trust at least between the first operating system and the at least one software application associated with the second operating system based at least in part on the received request and the determination; and

perform at least one action based at least in part on the established chain of trust.

18. The premises device of claim 17 , wherein the establishing the chain of trust includes authenticating the at least one software application; and

the processing circuitry is further configured to:

preload a secured storage of the first operating system with at least one file usable by the authenticated at least one software application; and

cause the authenticated at least one software application to use the at least one file to perform at least one action based at least in part on the established chain of trust.

Assignments (2)

Continuity (2)

References Cited (10)