Hardware-assisted client authentication for security enhancement of virtual device
A device can include a remote protocol communication (RPC) slot configured to receive a message package generated from an entity during an RPC process, a processing unit configured to process the message package and return a result via the RPC slot to the entity, a blocker configured to be enabled to block or disabled to allow communication between the RPC slot and the processing unit, a key slot corresponding to the RPC slot and configured to receive a key from the entity, a key pool configured to store key slot and key pairs, and a verifier configured to disable the blocker when the key matches a key contained in one of the key slot and key pairs that contains the key slot and enable the blocker when the key does not match the key contained in any one of the key slot and key pairs that contains the key slot.
1 . A method of a processing device comprising multiple clients, the method comprising:
receiving a second key from a first client within the multiple clients;
generating a first key based on the second key, wherein the first key is shorter than the second key;
storing a key slot and key pair that contains the first key and the key slot into a key pool storing one or more key slot and key pairs when the key slot is not contained in any one of the key slot and key pairs;
sending the first key to the first client;
receiving, in a remote protocol communication (RPC) slot, a first message package generated from the first client during an RPC process;
receiving the first key from the first client, and inserting the first key into a key slot of the RPC slot;
determining whether the first key inserted into the key slot matches a key contained in one of the one or more key slot and key pairs stored in the key pool that contains the key slot, wherein the first key matches a key contained in one of the one or more key slot and key pairs;
processing the first message package and returning a corresponding result via the RPC slot to the first client, since the first key matches a key contained in one of the one or more key slot and key pairs stored in the key pool that contains the key slot;
receiving, in the remote protocol communication (RPC) slot, a second message package generated from a second client within the multiple clients during an RPC process;
receiving a third key from the second client, and inserting the third key into the key slot of the RPC slot;
determining whether the third key inserted into the key slot matches a key contained in one of the one or more key slot and key pairs stored in the key pool that contains the key slot, wherein the third key does not match any key contained in the one or more key slot and key pairs; and
blocking processing of the second message package, since the third key does not match any key contained in one of the one or more key slot and key pairs stored in the key pool that contains the key slot.
2 . The method of claim 1 , further comprising:
generating the first key that corresponds to the second key by using an extended root of trust (eROT) circuit.
3 . The method of claim 1 , further comprising:
counting a number of times that the first key is received in the key slot; and
un-registering the first key, deleting the key slot and key pair stored in the key pool that contains the first key and sending a notification signal to the first client when the number of times exceeds a threshold of times.