Systems and methods for single device authentication

1. A method for authenticating user device interactions with an external application or device, the method comprising:

establishing a secure communication session between trusted code executing within a trusted execution environment in a user authentication device and the external application or device, the external application or device external to the trusted execution environment, the user authentication device configured to receive input from a plurality of types of assurance actions;

receiving, in response to establishing the secure communication session, an authentication request from the external application or device at the trusted execution environment over the secure communication session, the authentication request requesting a specified type of required user assurance action from the plurality of types of assurance actions to authenticate a user;

establishing, in response to receiving the authentication request, a secure communication channel between the trusted execution environment and an input/output interface of the user authentication device;

receiving, in response to establishing the secure communication channel, input from a user assurance action related to the authentication request over the secure communication channel, the user assurance action being the specified type of required user assurance action;

encrypting, in response to receiving input from the user assurance action, at a secure element of the user authentication device based on the authentication request; and

transmitting a response to the authentication request that includes the encrypted data and an indicator of the user assurance action to the external application or device from the trusted execution environment over the secure communication session to enable the user authentication device to interact with the external application or device.

2. The method of claim 1 , further comprising:

generating asymmetric key-pairs for the external application or device and the user authentication device;

storing the key-pairs as paired credentials in the secure element of the user authentication device; and

wherein the secure communication session between the user authentication device and the external application or device is established based on the generated key-pairs.

3. The method of claim 1 , further comprising:

searching secure memory of the user authentication device for stored key-pairs for the external application or device; and

wherein the secure communication session between the user authentication device and the external application or device is established based on locating the key-pairs.

4. The method of claim 1 , wherein a user providing the assurance action over the secure communication channel is first presented with the display of an image previously stored by the user in secure memory in the trusted execution environment as an indication of the secure communication channel being secure.

5. The method of claim 1 , wherein the secure element of the user authentication device is a smart card.

6. The method of claim 1 , wherein the secure element of the user authentication device is a SIM card on a user's smartphone.

7. The method of claim 1 , wherein the input/output interface of the user authentication device is a touch-screen interface of the user authentication device or a camera of the user authentication device.

8. The method of claim 1 , wherein the user authentication device includes a system-on-chip (SoC) providing the trusted execution environment and the trusted code.

9. The method of claim 1 , wherein the plurality of types of assurance actions includes one of presence, intent, and identification.

10. A system for authenticating user device interactions with an external application or device, the system comprising:

a user authentication device including:

a processor configured to interact with a trusted execution environment of the user authentication device;

an input/output interface; and

a secure element,

wherein the user authentication device is configured to establish a secure communication session between trusted code executing within the trusted execution environment of the user authentication device and the external application or device, the external application or device external to the trusted execution environment, the user authentication device configured to receive input from a plurality of types of assurance actions,

wherein the trusted execution environment is configured to:

receive an authentication request from the external application or device over the secure communication session, the authentication request requesting a specified type of required user assurance action from the plurality of types of assurance actions to authenticate a user,

establish, in response to receiving the authentication request, a secure communication channel between the trusted execution environment and the input/output interface of the user authentication device, and

receive, in response to establishing the secure communication channel, input from a user assurance action related to the authentication request over the secure communication channel, the user assurance action being the specified type of required user assurance action, and

wherein the secure element is configured to encrypt data based on the authentication request, and

the trusted execution environment is further configured to transmit a response to the authentication request that includes the encrypted data and an indicator of the user assurance action to the external application or device over the secure communication session to enable the user authentication device to interact with the external application or device.

11. The system of claim 10 , wherein the trusted execution environment is further configured to:

generate asymmetric key-pairs for the external application or device and the user authentication device;

store the key-pairs as paired credentials in the secure element of the user device; and

wherein the secure communication session is established between the user device and the external application or device based on the generated key-pairs.

12. The system of claim 10 , wherein the trusted execution environment is further configured to:

search secure memory of the user authentication device for stored key-pairs for the external application or device; and

wherein the secure communication session is established between the user authentication device and the external application or device based on locating the key-pairs.

13. The system of claim 10 , wherein a user providing the assurance action over the secure communication channel is first presented with the display of an image previously stored by the user in secure memory in the trusted execution environment as an indication of the secure communication channel being secure.

14. The system of claim 10 , wherein the secure element of the user authentication device is a smart card.

15. The system of claim 10 , wherein the secure element of the user authentication device is a SIM card on a user's smartphone.

16. The system of claim 10 , wherein the input/output interface of the user authentication device is a touch-screen interface of the user authentication device or a camera of the user device.

17. The system of claim 10 , wherein the user authentication device includes a system-on-chip (SoC) providing the trusted execution environment and the trusted code.

18. The system of claim 10 , wherein the plurality of types of assurance actions includes one of presence, intent, and identification.

19. A non-transitory computer readable medium storing instructions executable by a processor for authenticating user device interactions with an external application or device, the instructions when executed causing a user authentication device to:

establish a secure communication session between trusted code executing within a trusted execution environment in a user authentication device and the external application or device, the external application or device external to the trusted execution environment, the user authentication device configured to receive input from a plurality of types of assurance actions;

receive, in response to establishing the secure communication session, an authentication request from the external application or device at the trusted execution environment over the secure communication session, the authentication request requesting a specified type of required user assurance action from the plurality of types of assurance actions to authenticate a user;

establish, in response to receiving the authentication request, a secure communication channel between the trusted execution environment and an input/output interface of the user authentication device;

receive, in response to establishing the secure communication channel, input from a user assurance action related to the authentication request over the secure communication channel, the user assurance action being the specified type of required user assurance action;

encrypt, in response to receiving input from the user assurance action, at a secure element of the user authentication device based on the authentication request; and

transmit a response to the authentication request that includes the encrypted data and an indicator of the user assurance action to the external application or device from the trusted execution environment over the secure communication session to enable the user authentication device to interact with the external application or device.

20. The non-transitory computer readable medium of claim 19 , wherein the instructions when executed further cause the user authentication device to:

generate asymmetric key-pairs for the external application or device and the user authentication device;

store the key-pairs as paired credentials in the secure element of the user authentication device; and

wherein the secure communication session is established between the user authentication device and the external application or device based on the generated key-pairs.

21. The non-transitory computer readable medium of claim 19 , wherein the instructions when executed further cause the user authentication device to:

search secure memory of the user authentication device for stored key-pairs for the external application or device; and

wherein the secure communication session is established between the user authentication device and the external application or device based on locating the key-pairs.

22. The non-transitory computer readable medium of claim 19 , wherein a user providing the assurance action over the secure communication channel is first presented with the display of an image previously stored by the user in secure memory in the trusted execution environment as an indication of the secure communication channel being secure.

23. The non-transitory computer readable medium of claim 19 , wherein the plurality of types of assurance actions includes one of presence, intent, and identification.