Peripheral device-based user space process credential management

Abstract

The invention relates to peripheral device-based user space process credential management. A technique includes communicating with an operating system-based kernel of a host; and receiving an integrity metric for a user space process of the host from the operating system-based kernel. The technique includes verifying whether a first state of the user space process corresponds to an expected state of the user space process based on the integrity metric. The technique includes, in response to verifying that the first state corresponds to the expected state, communicating with the kernel to preconfigure authentication credentials for the user space process, thereby allowing the user space process to use a service provided by a peripheral device.

Description

BACKGROUND ART

[0001] Computer platforms can be subject to security attacks, where malicious actors attempt to access information stored on the computer platform or damage components of the computer platform. To prevent security attacks or at least mitigate the extent of damage caused by security attacks, computer platforms can have various defensive measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Figure 1 is a schematic diagram of a computer platform according to an example embodiment, the computer platform having a peripheral device and an infrastructure for managing credentials used by user space processes to access the peripheral device.

[0003] Figure 2 and Figure 3 is a sequence flow diagram depicting a technique for provisioning credentials for user space processes according to an example embodiment.

[0004] Figure 4 is a sequence flow diagram depicting a technique for monitoring the trustworthiness of user space processes and revoking the credentials of a user space process in response to a determination that the user space process is no longer trustworthy according to an example embodiment.

[0005] Figure 5 and Figure 6 is a sequence flow diagram depicting a technique for monitoring the integrity of the infrastructure for managing credentials of user space processes according to an example embodiment.

[0006] Figure 7 is a sequence flow diagram depicting a technique for establishing a communication channel between a user space process and a peripheral device according to an example embodiment.

[0007] Figure 8 is an illustration of a non-transitory storage medium storing machine-readable instructions that, when executed by a peripheral device, cause the peripheral device to provision user space process authentication credentials according to an example embodiment.

[0008] Figure 9 is a schematic diagram of a computer platform having a peripheral device according to an example embodiment, the peripheral device for authenticating user space processes based on credentials and managing the credentials.

[0009] Figure 10 is a flowchart depicting a technique used by a peripheral device to manage user space process credentials according to an example embodiment. DETAILED DESCRIPTION

[0010] A computer platform (e.g., a blade server or a rack server) can include an operating system - attached host and peripheral devices that support the host. Applications or services on the host can use one or more services provided by the peripheral devices. A baseboard management controller is an example of such a peripheral device. For example, host services can interact with one or more management services provided by the baseboard management controller for purposes such as reporting operating system event information to the baseboard management controller or receiving logs (e.g., event logs, status logs, or other logs) maintained by the baseboard management controller. In another example, a host - based Smart Update Manager (SUM) can interact with one or more management services provided by the baseboard management controller for purposes such as installing and updating drivers, firmware, and system software of the computer platform. Host - based applications or services have corresponding execution instances, which are referred to as "user - space processes" herein.

[0011] Peripheral devices can be configured to operate in one of potentially multiple security operation modes. The security operation modes can correspond to different security levels of the peripheral devices. Depending on the specific security mode, the peripheral device may or may not enforce host authentication. In this context, a peripheral device enforcing "host authentication" generally means that access by the host entity to the peripheral device depends on the peripheral device verifying the identity of the host entity and trusting the verified identity. In an example, a peripheral device can be configured to operate in a relatively low - security operation mode (e.g., a production operation mode), in which the peripheral device trusts all user - space processes and correspondingly does not enforce host authentication. In another example, a peripheral device can be configured to operate in a relatively high - security operation mode, in which the peripheral device enforces host authentication.

[0012] Host authentication can be implemented in a variety of different ways. In one method, host authentication can involve a user - space process prompting a human user to provide credentials, and then the user - space process providing the credentials to the peripheral device. For example, host authentication can involve a user - space process prompting a human user to provide a username (or "user name") and a password. In this way, user accounts can be pre - authorized for a specific peripheral device, and as part of host authentication, the peripheral device can verify whether the username and password provided by the user - space process correspond to the authorized account. Using this method, for each session between the user - space process and the peripheral device, the user may be prompted to enter credentials. Some potential challenges of this method are that for some computing environments (remote computing environments, large - scale computing environments, data - center - based computing environments, and other computing environments), human participation in host authentication may be impractical.

[0013] In another method of host authentication, a peripheral device can automatically allocate credentials to a user space process without human intervention. However, with this method, the peripheral device may potentially allocate credentials to user space processes that have not been approved for use on the computer platform or have not been approved for use with the peripheral device. Additionally, even if the allocation of credentials is restricted to pre-approved user space processes, there may be no appropriate mechanism to revoke credentials that have been issued for a tampered user space process. The lack of such a mechanism can pose security problems for the computer platform, especially if the peripheral device is a component that provides security services for the computer platform (e.g., a baseboard management controller).

[0014] According to an example embodiment, a computer platform includes a host credential management infrastructure for managing credentials that permit host-based user space processes to access resources of a peripheral device. The host credential management infrastructure includes a verification agent for the peripheral device and an operating system kernel-based auxiliary agent for the host.

[0015] According to an example embodiment, a user space process can submit a request to the auxiliary agent to receive credentials for accessing a peripheral device. As further described herein, the auxiliary agent notifies the verification agent in response to the request, and the verification agent applies a specific trust model to determine whether the requesting user space process is trustworthy. As further described herein, according to an example embodiment, the verification agent can determine trustworthiness based on integrity metrics collected by the auxiliary agent in response to the request. If the verification agent determines that the requesting user space process is trustworthy, the verification agent provisions credentials for the user space process. Additionally, according to an example embodiment, the verification agent can continuously re-evaluate the trustworthiness of the user space process. In this way, as a result of the re-evaluation of the user space process, the verification agent can revoke the credentials of the user space process in response to determining that the user space process is no longer trustworthy. In an example, the verification agent can revoke the credentials allocated to a user space process in response to determining that the integrity of the user space process has been compromised.

[0016] Depending on the specific manner of implementing host authentication, one or more credentials can be allocated to a user space process. In other words, depending on the type of host authentication, a user space process can access a peripheral device using a single credential or using multiple credentials.

[0017] In an example of single-credential based host authentication, the verification agent can assign a token to a user space process. The user space process can provide the token as a credential to a peripheral device, thereby allowing the peripheral device to authenticate the user space process. In another example, the verification agent can assign a randomly generated or pseudo-randomly generated number to the user space process. The user space process can provide the number as a credential to the peripheral device, thereby allowing the peripheral device to authenticate the user space process. In another example, the verification agent can assign a secret key to a peripheral device. The secret key can be shared with the peripheral device, and as part of host authentication, the user space process can prove possession of the shared secret key to the peripheral device.

[0018] Host authentication based on multiple credentials can be implemented in a number of different ways. In an example, the verification agent can assign an asymmetric encryption key pair to a user space process, and host authentication can include the user space process proving possession of the private key of the asymmetric key pair to a peripheral device. In another example, the verification agent can assign a username and password to a user space process, and host authentication can include the user space process providing the username and password to a peripheral device.

[0019] Regardless of how host authentication is implemented, the credential(s) assigned to the user space process allow the user space process to access one or more resources of the peripheral device (e.g., application programming interfaces (APIs), services, registers, and memory, and other resources). The access level can depend on a set of access privileges or permissions assigned to the credential(s).

[0020] According to an example implementation, the user space process can request the credential(s) by submitting a registration request to an auxiliary agent. In an example, the user space process can make an API call to the registration API of the auxiliary agent, a registration request. The registration request initiates a registration phase. The registration phase corresponds to a sequence of actions taken by the host credential management infrastructure to determine whether the user space process is trustworthy, and if the user space process is determined to be trustworthy, the registration phase ends with provisioning of the credential(s) for the user space process. Otherwise, if the host credential management infrastructure determines that the user space process is not trustworthy, the registration phase ends with the registration request being rejected.

[0021] According to an example embodiment, in conjunction with the registration phase, the assisting agent measures the user space process for the requested credentials to determine one of a plurality of initial runtime integrity measures for the user space process. In an example of an initial runtime integrity measure, the assisting agent may determine a hash or digest of the content in memory that corresponds to the user space process and is expected not to change during runtime (referred to herein as the "runtime digest"), as further described herein. In another example, the initial runtime integrity measure may be a runtime property of the user space process that is not a digest or hash. The assisting agent sends data representing the initial runtime integrity measure to the verifying agent. More specifically, according to an example embodiment, as part of the registration phase, the assisting agent sends a report (referred to herein as the "initial report") to the verifying agent, the report including data representing the initial runtime digest and further including metadata describing the properties of the user space process.

[0022] The verifying agent may apply one of a plurality of possible trust models for determining whether the user space process for the requested credentials is trustworthy. In an example, the verifying agent may apply what is referred to herein as the "expected state trust model". More specifically, according to some embodiments, the verifying agent determines whether the user space process has an expected state (and thus determines whether the user space process can be trusted) based on the initial runtime integrity measure provided by the initial report sent by the assisting agent. This assessment may include the verifying agent comparing the initial runtime integrity measure digest to the expected integrity measure for the user space process to determine whether the initial runtime integrity measure is as expected. In an example, a signed manifest file may be provisioned for the peripheral device prior to runtime. The manifest file contains a list of expected runtime digests corresponding to the respective user space processes that have been approved for use with the peripheral device. Additionally, the manifest file may associate each expected runtime digest with a set of additional non-digest expected runtime integrity measures. If the initial runtime digest does not correspond to any of the expected digests in the manifest file, then according to an example embodiment, the verifying agent rejects the registration request and does not provision any (multiple) credentials for the user space process.

[0023] In addition to whether the initial runtime summary matches the expected summary, the verification agent's assessment of whether a user-space process is trustworthy can also consider one or more criteria. For example, the verification agent can also consider whether any attributes represented by the metadata of the initial report are unexpected. In an example, the attribute can be the process path of the user-space process. In another example, the attribute can be a command-related characteristic of the user-space process, such as the name of the executable file corresponding to the user-space process and one or more parameters passed to the user-space process. In another example, the attribute can be the range of the memory segment corresponding to the user-space process. In another example, the attribute can be an environmental variable. According to a particular implementation, some, none, or all of the expected attributes of the user-space process can be included in a manifest file, or in another data set or file pre-provisioned for a peripheral device prior to runtime.

[0024] In another example, to evaluate whether a user-space process is trustworthy, the verification agent can rely on a trust model other than the expected state trust model described above. For example, the verification agent can apply a trust-on-first-use (TOFU) trust model, where the verification agent assumes that a particular user-space process registered for the first time (e.g., the first time after a computer platform boot or reset) is trustworthy. According to an example implementation, the TOFU trust model assumes that there are appropriate conditions to trust a user-space process on first use. In an example, it can be assumed that these conditions exist in the initial runtime environment of the computer platform after the computer platform boots. As a more specific example, the computer platform can undergo a secure and measured boot such that at the end of the boot, all user-space processes can initially be assumed to be trustworthy (e.g., initially assumed to be trustworthy on first use).

[0025] The verification agent can uniquely identify a particular user-space process based on the metadata included in the corresponding initial report provided by the secondary agent. In an example, the verification agent can uniquely identify the user-space process by one or more of the name of the corresponding executable file, command parameters, process ID, process path, or other identifying characteristics associated with the user-space process.

[0026] Regardless of how a particular trust model and attestation agent evaluate the trustworthiness of a user space process, if the attestation agent determines that the user space process is trustworthy, the attestation agent provisions one or more credentials for the user space process. Provisioning one or more credentials may include the attestation agent generating the one or more credentials and the attestation agent assigning the one or more credentials to the user space process. Additionally, provisioning one or more credentials may further include the attestation agent sending the one or more credentials to an auxiliary agent, and the auxiliary agent providing the one or more credentials to the user space process to conclude the registration phase. A user space process that has been provisioned one or more credentials is referred to herein as a "registered" user space process.

[0027] According to an example embodiment, the attestation agent continuously re-evaluates the trustworthiness of each registered user space process. If a registered user space process is determined to be untrustworthy, the attestation agent combines these re-evaluations with the authority to remove or revoke the one or more credentials of the user space process. More specifically, according to some embodiments, for a particular registered user space process, the attestation agent may periodically (e.g., at a time according to a schedule such as a periodic schedule) send a re-attestation request to the auxiliary agent.

[0028] The re-attestation request prompts the auxiliary agent to re-measure the registered user space process to obtain a corresponding set of current integrity measures of the user space process. This set includes a current runtime digest and additional current non-digest integrity measures (also referred to herein as "attributes"). The auxiliary agent sends a report to the attestation agent, the report containing data representing the current runtime digest and also containing metadata describing the current attributes. The attestation agent has a set of expected integrity measures for the registered user space process, either from a manifest file or, for a TOFU trust model, from the initial report sent by the auxiliary agent. The attestation agent determines whether the registered user space process is still considered trustworthy based on a comparison of the current runtime integrity measures with the expected integrity measures. According to an example embodiment, in response to the attestation agent determining that as a result of re-attestation, the user space process is no longer considered trustworthy, the attestation agent revokes the one or more credentials of the registered user space process.

[0029] According to an example embodiment, the attestation agent continuously monitors the host credential management infrastructure to determine whether the integrity of the host credential management infrastructure has been compromised. If the attestation agent determines that the integrity of the host credential management infrastructure has been compromised, then according to an example embodiment, the attestation agent may initiate one or more response actions. In an example, in response to determining that the integrity of the host credential management infrastructure has been compromised, the attestation agent may revoke all registered user space process credentials and perform other possible response actions.

[0030] The verification agent can monitor the integrity of the host credential management infrastructure in any of a variety of different ways. In an example, the verification agent can use a re-verification request as a mechanism for monitoring the integrity of the host credential management infrastructure. For example, if a response to a particular re-verification request is not received within an expected time period, the verification agent can determine that the integrity of the host credential management infrastructure has been compromised.

[0031] In another example of a way to monitor the integrity of the host credential management infrastructure, the verification agent can send an aliveness nonce to a secondary agent according to a schedule (e.g., send the aliveness nonce at a time according to a periodic schedule). In an example, the aliveness nonce can be a randomly generated number or a pseudo-randomly generated number. The verification agent expects to observe a particular response to the sent aliveness nonce. In an example, the verification agent can expect the secondary agent to apply a function (e.g., add a predetermined number) to the aliveness nonce to generate a response nonce, and the secondary agent sends the response nonce back to the verification agent. In an example, in response to the verification agent not receiving a response to the aliveness nonce within an expected time period, the verification agent can determine that the integrity of the host credential management infrastructure has been compromised. In another example, in response to the verification agent receiving an unexpected response nonce, the verification agent can determine that the integrity of the host credential management infrastructure has been compromised.

[0032] Reference Figure 1 , as a more specific example, according to some embodiments, the computer platform 100 includes a host 101 and one or more peripheral devices, such as the example peripheral device 159. In the context used herein, a "host" refers to a collection of resources of the computer platform 100 that are associated with the primary functions of supporting an operating system kernel and the processes managed by the operating system kernel. For Figure 1 the depicted example embodiment, the host 101 includes one or more hardware processors 110 and a system memory 114 that support an operating system kernel 104, user space processes 108, and kernel space processes.

[0033] In an example, the hardware processor 110 can include one or more processing cores, such as central processing unit (CPU) processing cores included in one or more CPU packages (or "sockets"). The system memory 114 and other memories discussed herein are non-transitory storage media that can be formed by semiconductor storage devices, memristor-based storage devices, magnetic storage devices, phase change memory devices, a combination of devices of one or more of these storage technologies, and the like. According to an example embodiment, the system memory 114 can represent a collection of volatile memory devices and non-volatile memory devices.

[0034] According to an example embodiment, the memory locations of the system memory 114 include locations corresponding to the user space 115 and locations corresponding to the kernel space 117. In the context used herein, "kernel space" refers to the memory space of the computer platform 100 in which instructions corresponding to an operating system kernel (such as the operating system kernel 104) are stored and executed. The LINUX kernel and the WINDOWS NT kernel are examples of operating system kernels. In the context used herein, "user space" refers to the memory space of the computer platform 100 that is used by non-operating system kernel processes (referred to herein as "user space processes 108"). In an example, the user space process 108 may correspond to an application 103. Generally, an "application" typically refers to a program associated with a user environment (e.g., a graphical user interface (GUI) or other environment facilitating user interaction). In another example, the user space process 108 may correspond to a service. Generally, a "service" refers to a program mainly directed to tasks not involving user interaction (e.g., background tasks, service application tasks, and other tasks). In another example, a given user space process 108 may correspond to a program that is a combination of an application and a service.

[0035] System calls made through the system call interface allow the user space process 108 to enter the kernel space 117 to perform certain operations (e.g., access a file, send or receive packets over a network, or transfer data to a user). When the user space process 108 enters the kernel space 117 via a system call, the user space process 108 may be suspended and the corresponding thread is given to another process. The user space portion of a program (e.g., the application 103 or the service) may vary from program to program.

[0036] In the context used herein, a "process" such as the user space process 108 refers to an instance of a program being executed. A given user space process 108 may be single-threaded (i.e., corresponding to a single thread) or multi-threaded (i.e., corresponding to multiple threads), where a "thread" refers to a unit of executable program instructions. For example, multiple threads may be executed in parallel by multiple processing cores of the computer platform 100 to perform a specific task or a set of tasks of the computer platform 100.

[0037] According to many possible embodiments, Figure 1The depicted architecture is just one example of many different potential architectures for computer platform 100. Generally, regardless of its specific architecture, a "computer platform" refers to a processor-based electronic device, the operating system of which has an associated kernel space and user space. By way of example, computer platform 100 can be a stand-alone server; a rack-mounted server module; an edge processing system; a rack-mounted module; a blade server; a chassis management controller; a client; a thin client; a desktop computer; a portable computer; a laptop computer; a notebook computer; a tablet computer; a smart phone; a network switch; a gateway device; a wearable computer; or another processor-based electronic device.

[0038] In the context used herein, a "peripheral device" refers to a component of a computer platform other than the platform's host, which provides one or more auxiliary functions to support the host. For Figure 1 the depicted example embodiment, the peripheral device 159 is the baseboard management controller 170. The baseboard management controller 170 provides one or more management services 174 used by one or more user space processes 108. For this purpose, the baseboard management controller 170 includes one or more APIs 173. In an example, the user space process 108 can correspond to a host-based service that uses one or more services 174 of the baseboard management controller 170 for purposes such as reporting operating system event information to the baseboard management controller 170 or obtaining logs (e.g., fault detection logs, device health logs, intrusion detection logs, or other management-related logs) from the baseboard management controller 170. In another example, the user space process 108 can correspond to a Smart Update Manager (SUM) that uses one or more services 174 of the baseboard management controller 170 for purposes such as installing and updating drivers, firmware, and system software on the computer platform 100.

[0039] In the context used herein, an application programming interface or "API" refers to a collection of software components that together provide one or more functions, operations, or actions. As described herein, an API call involves enabling one or more functions, operations, or actions of a particular API. An API can provide a response to an API call ("API response").

[0040] The baseboard management controller 170 is an example of a peripheral device 159 having a secure operating mode (e.g., one of many secure modes or the only secure mode), which restricts access to the services provided by the peripheral device 159 by enforcing host authentication. For Figure 1In the example embodiment depicted, the baseboard management controller 170 includes a host interface 175 (or "host communication interface 175"), which, for a particular secure operating mode, is locked by the baseboard management controller 170 such that the user space process 108 cannot access any services 174 without the baseboard management controller 170 first successfully authenticating the user space process 108. According to an example embodiment, authentication includes the baseboard management controller 170 verifying the identity of the user space process 108 and the baseboard management controller 170 determining the scope of access (if any) permitted by the verified identity. The baseboard management controller 170 may restrict the access of the user space process 108 according to a set of permissions or privileges assigned to a particular verified identity. In an example, the user space process 108 may have a set of (multiple) credentials associated with a set of permissions that permit access to one or more services 174.

[0041] In the context used herein, a "host interface" refers to an infrastructure through which one or more resources of a peripheral device can be accessed. In an example, the host interface 175 may include registers and / or buffers (e.g., input / output (I / O) space or memory-mapped registers and / or buffers) that are written with data corresponding to an API request and provide data representative of an API response. In another example, the host interface 175 may be associated with communication through a shared memory segment of the system memory 114.

[0042] In the context used herein, a peripheral device 159 such as the baseboard management controller 170 "authenticating" the user space process 108 refers to the peripheral device 159 verifying the identity of the user space process 108 based on one or more credentials provided directly or indirectly to the peripheral device 159 by the user space process. The credentials correspond to a trusted user space process 108. Thus, authenticating the user space process 108 based on the (multiple) credentials both verifies the identity of the user space process 108 and confirms that the user space process 108 is trusted.

[0043] In an example, the credentials of the user space process 108 may be a password and a user name (or "user identifier"). In another example, the credentials of the user space process 108 may include an asymmetric key pair. The public key of the asymmetric key pair may be represented by, for example, a digital certificate (e.g., an X.509 certificate). For example, the peripheral device 159 may authenticate the user space process by: verifying a digital certificate provided by the user space process; sending a challenge encrypted based on the public key to the user space process; and determining whether the user space process possesses the private key based on the response of the user space process to the challenge.

[0044] In another example, the credentials of the user space process 108 can be tokens such as JavaScript Object Notation (JSON) Web Tokens (or "JWT") or Open Authentication Tokens (or "OAuth tokens"). The user space process can obtain access to the peripheral device 159 by transmitting the token to the peripheral device 159. In another example, the credentials of the user space process 108 can be randomly or pseudo-randomly generated numbers. In another example, the credentials of the user space process 108 can be a secret key shared with the peripheral device 159.

[0045] According to an example implementation, the computer platform 100 includes a host credential management infrastructure that manages credentials that allow a user space process 108 to access resources of a peripheral device such as the peripheral device 159. In this context, "managing" the credentials includes controlling or managing one or more aspects of the credentials. In an example, managing the credentials can include provisioning the credentials. In another example, managing the credentials can include controlling or adjusting the validity of the credentials, e.g., adjusting whether a potential set of credentials is valid or revoked. In another example, managing the credentials can include assigning permissions to the credentials. In an example, a set of permissions assigned to a particular set of credentials can control the particular service(s) that the user space process 108 can access. In another example, a set of permissions can control whether the user space process 108 can modify or write to the memory of the peripheral device 159. In another example, a set of permissions can control whether the user space process 108 can read from a particular memory of the peripheral device 159.

[0046] According to an example implementation, the host credential management infrastructure includes an authentication agent 172 for the peripheral device 159 and an auxiliary agent 106 for the kernel 104. As further described herein, according to a particular implementation, the authentication agent 172 can provision credentials for the user space process 108 based on the authentication agent's determination of the trustworthiness of the process. In an example, the authentication agent 172 can evaluate the trustworthiness of a particular user space process 108 based on the TOFU trust model. In another example, the authentication agent 172 can evaluate the trustworthiness of a particular user space process 108 based on the expected state trust model.

[0047] As further described herein, according to an example embodiment, the auxiliary agent 106 includes a registration API 107. The user space process 108 may request a set of one or more credentials that permit the process 108 to access one or more resources (e.g., services) of the peripheral device 159 by calling the registration API 107. The API call to the registration API 107 initiates a registration phase. According to an example embodiment, the registration phase is a sequence of operations in which the host credential management infrastructure evaluates the trustworthiness of the calling user space process 108 and, if the host credential management infrastructure determines that the user space process 108 is trustworthy, the infrastructure provisions credentials for the user space process 108.

[0048] More specifically, according to an example embodiment, in response to the API call to the registration API 107, the auxiliary agent 106 provides a report 105 (referred to herein as the "initial report 105") to the verification agent 172. As further described herein, the report 105 may contain data and metadata representing an initial runtime integrity measure of the user space process 108. In an example of a runtime integrity measure, the report 105 may contain data representing a runtime digest 111 of the user space process 108. The initial report 105 may also contain metadata 112 representing other non-digest runtime integrity measures (referred to as "attributes") of the user space process 108. In an example, an attribute may be a binary file name, a process path, passed command arguments, environment variables, a range of a text segment associated with the user space process 108, a permission associated with a segment of the user space process, or other attributes. The verification agent 172 of the peripheral device 159 processes the information contained in the initial report 105 to determine whether the user space process 108 is trustworthy. If the verification agent 172 determines that the user space process 108 is trustworthy, the verification agent 172 provisions (multiple) credentials for the user space process 108, and then the user space process 108 may use the credentials to access one or more resources (e.g., one or more services) of the peripheral device 159. If the verification agent 172 determines that the user space process 108 is not trustworthy, the integrity verification agent 172 rejects the registration request and thus does not provision any credentials for the user space process 108. A user space process 108 that has received (multiple) credentials and for which the (multiple) credentials are valid is referred to herein as a "registered" user space process 108.

[0049] In addition to sending the initial report 105 to the verification agent 172, according to an example embodiment, the auxiliary agent 106 may also send subsequent reports 105 (referred to herein as "runtime reports 105") to the verification agent 172 for a specific registered user space process 108 in combination with a re-verification request. The verification agent 172 may use these subsequent reports 105 to monitor the trustworthiness of the registered user space process 108. In this way, if the verification agent 172 determines that the information contained in a specific runtime report 105 indicates that the user space process 108 is no longer trustworthy, the verification agent 172 may revoke the credentials of the user space process 108.

[0050] In the context used herein, "provisioning" (multiple) credentials for a specific user space process 108 refers to the creation of (multiple) credentials and the configuration or setting of the computer platform 100 that uses the (multiple) credentials. In an example of provisioning (multiple) credentials for the user space process 108, the verification agent 172 may generate an asymmetric encryption key pair and a corresponding digital certificate. Then, the verification agent 172 may transfer the private key and the digital certificate to the auxiliary agent 106, and the auxiliary agent 106 may provide the private key and the digital certificate to the user space process 108. In another example of provisioning (multiple) credentials for the user space process 108, the verification agent 172 may generate a token for the user space process and send the token to the auxiliary agent 106. Then, the auxiliary agent 106 may provide the token to the user space process 108.

[0051] In another example, the credentials of the user space process 108 may be a number. In this way, provisioning the credentials includes the verification agent 172 generating a number (e.g., generating a number using a random number generator or a pseudo-random number generator), and the verification agent 172 sending the number to the auxiliary agent 106. Then, the auxiliary agent 106 may provide the number to the user space process 108.

[0052] According to an example embodiment, provisioning (multiple) credentials for the user space process 108 includes the verification agent 172 associating a set of one or more permissions with the (multiple) credentials to control the access scope of the user space process 108. In an example, the permissions may control whether the user space process 108 can use a specific service or service group of the peripheral device 159. In another example, the permissions may control whether the user space process 108 can access a specific resource of the peripheral device 159 (e.g., a register, a memory, or an API). In another example, the permissions may control whether the user space process 108 can perform a specific operation (e.g., read, write, or modify) associated with a specific resource of the peripheral device 159.

[0053] Report 105 represents the state of a specific user space process 108. In the context used herein, the "state" of user space process 108 refers to a collection of one or more characteristics of the user space process. In an example, the state of user space process 108 can include one or more integrity metrics corresponding to user space process 108.

[0054] According to an example embodiment, the helper agent 106 measures the run-time invariant memory content (also referred to herein as "invariant memory content") corresponding to user space process 108 to obtain a run-time summary of user space process 108. More specifically, when running in the kernel context, the helper agent 106 can access the memory mapping of user space process 108. These mappings in turn allow the helper agent 106 to identify one or more run-time invariant portions of the memory space occupied by user space process 108. In this context, the "invariant portion" (or "run-time invariant portion") of the memory space occupied by user space process 108 refers to the portion of the content in the memory that corresponds to user space process 108 and is expected not to change while process 108 is running or executing.

[0055] In an example, the run-time invariant portion of user space process 108 can be the memory text segment associated with process 108. In this context, a "text segment" refers to the portion of the memory that contains machine-executable instructions that are run-time invariant and / or run-time invariant variable initializations. In an example, the text segment corresponds to a read-only memory portion.

[0056] The helper agent 106 measures the identified run-time invariant portion(s) of the content of the memory space occupied by user space process 108 to obtain a run-time summary of user space process 108 (referred to herein as "run-time summary D RUNTIME ”). In an example, run-time summary D RUNTIME can be a hash of the content of the text segment associated with user space process 108, as described in the following equation (Eq.) 1:

[0057] D RUNTIME = Hash(text segment content), Eq. 1

[0058] where "Hash()" represents the application of a cryptographic hash algorithm, and for this specific example, the cryptographic hash algorithm has the content from one or more memory text segments corresponding to user space process 108 as its input.

[0059] In another example, run-time summary D RUNTIME can be obtained from integrity metrics of the content M1 to M5 from five corresponding memory text segments. For this example, the resulting run-time summary DRUNTIME is a cumulative hash, as described below:

[0060] D RUNTIME = H((H(H(H(H(M1) || M2) || M3) || M4)) || M5), Eq. 2

[0061] where "H()" represents the application of a cryptographic hash algorithm and "||" represents the concatenation operator. According to a further embodiment, the auxiliary agent 106 may obtain the runtime digest D from the (multiple) hashes of the content from fewer than five memory paragraphs or more than five memory paragraphs of this section RUNTIME .

[0062] According to some embodiments, the auxiliary agent 106 may use a secure processor of the computer platform 100 (such as the Trusted Platform Module (TPM) 188) to obtain the runtime digest D RUNTIME . In an example, the auxiliary agent 106 may pass the text paragraph content to the secure processor through an API call to the secure processor and enable the hashing operation through the hashing engine of the secure processor. Then, the secure processor may return the corresponding hash or digest generated by the hashing operation. To determine the runtime digest D formed by multiple hashing operations (e.g., the cumulative hash described in Eq. 2 above RUNTIME , the auxiliary agent 106 may enable several hashing operations through the hashing engine of the secure processor. In another example, the auxiliary agent 106 may determine the runtime digest D by executing machine-readable instructions that generate hashes RUNTIME .

[0063] In another example, the auxiliary agent 106 may use the secure processor of the baseboard management controller 170 to generate the runtime digest D RUNTIME . In another example, the auxiliary agent 106 may use a cryptographic processor other than the secure processor to generate the digest D RUNTIME . In another example, the auxiliary agent 106 may use a hashing engine that is not part of a secure processor, cryptographic process, or baseboard management controller

[0064] In the context used herein, a "hash" (which may also be referred to by terms such as "digest", "hash value", or "hash digest") is produced by applying a cryptographic hash algorithm to an input value. The cryptographic hash algorithm receives the input value, and the cryptographic hash algorithm generates a hexadecimal string (digest or hash) to match the input value. In an example, the input value may include a data string (e.g., a data structure in memory represented by a starting memory address and an ending memory address). In such an example, based on the data string, the cryptographic hash algorithm outputs a hexadecimal string (digest or hash). Any minor change to the input value will change the output hexadecimal string. In an example, the cryptographic hash function may be a Secure Hash Algorithm (SHA), a Federal Information Processing Standard (FIPS) approved hash algorithm, a National Institute of Standards and Technology (NIST) approved hash algorithm, or any other cryptographic hash algorithm. In some examples, instead of the hexadecimal format, the string may use another format.

[0065] According to a further embodiment, the auxiliary agent 106 may determine a runtime digest D of the user space process based on content other than the content of the text segment associated with the process 108. RUNTIME For example, according to some embodiments, the runtime digest D RUNTIME may be formed by the concatenation of the content of the text segment associated with the user space process 108 and one or more non - text segment runtime invariants, as described below:

[0066] D RUNTIME = Hash(text segment content || non - text segment invariant). Eq.3

[0067] In an example, the non - text segment runtime invariant may be the process path of the user space process 108. In another example, the non - text segment runtime invariant may be the name of the executable file corresponding to the user space process 108, including the passed arguments. In another example, the runtime non - text segment invariant may be the executable version number. Regardless of what the (multiple) specific non - text segment runtime invariants used as input to the hash function to obtain the runtime digest D RUNTIME are, it is expected that the runtime invariants are static during the runtime of the user space process 108. One or more runtime invariants may also be represented by the metadata 112 of the report 105.

[0068] In another example, the auxiliary agent 106 may obtain the runtime digest D from the content of the text segment associated with the user space process 108 and the content of the text segments from libraries dynamically linked to the user space process 108 by the operating system. RUNTIME For example, according to some embodiments, the auxiliary agent 106 may determine the runtime digest D based on the text content from N libraries. RUNTIME, as described below:

[0069] D RUNTIME = Hash(content of text segment || text of library 1 ||... || text of library N),

[0070] Eq.4

[0071] wherein, library text (e.g., "text of library 1" or library N") refers to the runtime invariant content of a specific library. According to some embodiments, the executable file and libraries associated with the user space process 108 can be respectively compiled into position-independent executables (PIEs) and position-independent code (PICs) that are loaded at arbitrary memory addresses. This has the benefit of increasing the difficulty for an attacker to correctly exploit the execution.

[0072] In response to a call to the registration API 107, the auxiliary agent 106 can determine the current state of the user space process 108 and send an initial report 105 representing the current state of the user space process 108 to the verification agent 172. As represented by the report 105, the use of the current state by the verification agent depends on the specific trust model used by the verification agent 172. By applying the specific trust model, the verification agent 172 evaluates the user space process 108 to determine whether the verification agent 172 trusts the user space process 108. In response to the verification agent 172 trusting the user space process 108, the verification agent 172 provisions (one or more) credentials for the user space process 108. If the verification agent 172 determines that the user space process 108 is not trustworthy, the verification agent 172 rejects the registration request and does not provision any credentials for the user space process 108.

[0073] In an example, the verification agent 172 can comply with the expected state trust model, in which the user space process 108 is not trustworthy unless the current state represented by the initial report 105 corresponds to the expected state of the user space process 108, as further described herein in connection with Figure 2 In another example, the verification agent 172 can comply with the TOFU trust model for evaluating the trustworthiness of the user space process 108, as further described herein in connection with Figure 3 further described.

[0074] According to an example embodiment, the attestation agent 172 may use a re - attestation request to monitor the integrity of the user - space process 108 such that if the user - space process 108 becomes untrusted, the attestation agent 172 may revoke the corresponding credential(s). More specifically, the attestation agent 172 may send a re - attestation request to the secondary agent 106 to request the secondary agent 106 to determine the current state of the registered user - space process 108. In an example, for each registered user - space process 108, the attestation agent 172 may send a re - attestation request to the secondary agent 106 according to a specific schedule (e.g., at a time corresponding to a periodic schedule). As described herein in connection with Figure 4 Further described, for a particular user - space process 108, the attestation agent 172 evaluates the corresponding report 105 to determine whether to continue to trust the user - space process 108 or whether to determine that the user - space process 108 is untrusted and revoke the credential(s) assigned to the process 108.

[0075] As described herein in connection with Figure 5 Further described, according to an example embodiment, the attestation agent 172 may use the re - attestation request and the corresponding response as a mechanism for detecting potential tampering with the host credential management infrastructure. In addition, the attestation agent 172 may take one or more other measures to monitor for tampering of the host credential management infrastructure, such as the measure of the attestation agent 172 sending an active nonce to the secondary agent, as described herein in connection with Figure 6 Further described.

[0076] Still referring to Figure 1 , the secondary agent 106 and the attestation agent 172 may exchange messages via a secure communication channel. In the context used herein, a "communication channel" refers to the logical and / or physical infrastructure for transmitting messages between entities. In an example, the communication channel may be associated with shared - memory message transmission. In this way, the secondary agent 106 and the attestation agent 172 may use a memory segment shared between the secondary agent 106 and the attestation agent 172 (e.g., a memory segment of the system memory 114) to exchange messages (e.g., report 105, confirmation, active message, registration request, credential information message, registration rejection, registration authorization, and / or other communications). For example, the secondary agent 106 may write data representing the report 105 to the shared memory segment, and the attestation agent 172 may read the data representing the report 105 from the shared memory segment. In another example, the attestation agent 172 may write data representing the credentials of a particular user - space process 108 to the shared memory segment, and the secondary agent 106 may read the data from the shared memory segment.

[0077] In another example, the communication channel between the auxiliary agent 106 and the verification agent 172 can be associated with a network protocol. For example, the auxiliary agent 106 and the verification agent 172 can communicate via a socket of the kernel 104 using a network protocol. For example, the socket can be a stream socket, and the auxiliary agent 106 and the verification agent 172 can form a network connection. In another example, the socket can be a datagram socket, and the communication between the auxiliary agent 106 and the verification agent 172 can be connectionless. In another example, the communication channel can include a management protocol socket interface of the kernel 104. For example, the auxiliary agent 106 can communicate with the verification agent 172 via a Management Component Transport Protocol (MCTP) socket of the kernel 104.

[0078] According to some embodiments, the communication channel between the auxiliary agent 106 and the verification agent 172 can be protected by authenticated encryption. Authenticated encryption has the advantage of ensuring message confidentiality and authenticity. In an example, the verification agent 172 can provide a session key (e.g., a randomly generated encryption key or a pseudorandomly generated encryption key) to the auxiliary agent 106 in response to the boot of the computer platform 100, and the communication between the verification agent 172 and the auxiliary agent 106 can be encrypted using the session key. In an example, authenticated encryption can use the Advanced Encryption Standard - Galois / Counter Mode (AES-GCM) algorithm. In another example, authenticated encryption can use the AES-GCM-SIV algorithm, which is the AES-GCM algorithm used with a Synthetic Initialization Vector (SIV).

[0079] In response to registration via the API 107 and successfully obtaining the credential(s), the user space process 108 can initiate a communication channel with the host interface 175 of the peripheral device 159. According to an example embodiment, the user space process 108 can send a request for a connection to the peripheral device 159. The request in turn prompts the host interface 175 to authenticate the user space process 108. In an example, the request can include the credential(s), allowing the host interface 175 to authenticate the user space process 108 based on the provided credential(s). In another example, the request can initiate a message exchange between the host interface 175 and the user space process 108 for the user space process 108 to provide proof that the user space process 108 possesses the credential(s). In response to the host interface successfully authenticating the user space process 108, the host interface 175 can then operate to establish a communication channel with the user space process. Otherwise, for an unsuccessful authentication, the host interface 175 rejects the request.

[0080] According to an example embodiment, the communication channel between the host interface 175 and the user space process 108 can be any of the communication channels described above for the communication between the auxiliary agent 106 and the authentication agent 172. Additionally, according to an example embodiment, the communication channel between the host interface 175 and the user space process 108 can be protected by authenticated encryption (such as encryption based on the AES-GCM algorithm or the AES-GCM-SIV algorithm). In an example, the session key for the communication channel can be generated by the host interface 175.

[0081] According to an example embodiment, the user space process 108 can use any one of a variety of communication channels to communicate with the auxiliary agent 106. In an example, the auxiliary agent 106 and the user space process 108 can communicate using the Netlink socket of the kernel 104. In another example, the auxiliary agent 106 and the user space process 108 can communicate using a system call. In another example, the auxiliary agent 106 and the user space process 108 can communicate using an I / O control (or "IOCTL") call. In another example, the auxiliary agent 106 and the user space process 108 can communicate using a direct I / O call.

[0082] According to an example embodiment, the auxiliary agent 106 can be an extension of the operating system kernel 104. In an example, the auxiliary agent code 134 can be stored in the storage device 130 and can correspond to the auxiliary agent 106. In an example, for the LINUX operating system, the auxiliary agent code 134 can correspond to a loadable kernel module (LKM), which is loaded on demand each time the kernel 104 boots, and after loading the LKM, the LKM becomes part of the operating system kernel 104. In another example, the auxiliary agent 106 can be a kernel driver. In another example, for the LINUX operating system, the auxiliary agent 106 can be added to the operating system kernel 104 as an eBPF module. The eBPF module is a program that runs in a sandbox in a privileged context inside the LINUX kernel and outside the compiled LINUX core. Although initially, the acronym "eBPF" referred to "extended Berkeley Packet Filter", the term "eBPF" is a stand-alone term that encompasses privileged contexts as well as sandbox programs other than those that perform packet filtering. In another example, the auxiliary agent 106 can be part of the operating system kernel 104 and is thus integrated into the operating system kernel.

[0083] In an example, the auxiliary agent 106 can be loaded as part of the secure and measured boot of the computer platform 100. In this way, it can be assumed that a trust chain with the root in the secure root of trust is created to boot the computer platform 100 into a trusted state, such that there is sufficient confidence that the kernel 104 or the auxiliary agent 106 has not been tampered with prior to the current boot. In an example, the baseboard management controller 170 can store reference measurements (e.g., platform configuration register (PCR) measurements) such that the baseboard management controller 170 can verify that the computer platform 100 has been booted as expected. In another example, in remote attestation, the baseboard management controller 170 can attest the reference measurements to a remote attestation service for the purpose of evaluating the trustworthiness of the computer platform 100 by the remote attestation service. According to an example implementation, the baseboard management controller 170 can initiate one or more response actions (e.g., power off the computer platform 100, isolate the computer platform 100 from external connections, or other actions) in response to the computer platform 100 not being booted into a known good state.

[0084] According to an example implementation, the auxiliary agent 106 can be configured to start early in the kernel initialization process, well before the user space 115 is initialized, to reduce the opportunity for malicious actors to compromise the host credential management infrastructure. In an example, for a LINUX operating system, the auxiliary agent code 134 can be loaded from an initial RAM disk (or "ramdisk"). In an example, the initial ramdisk can be loaded according to the initrd (initial ramdisk) scheme. In another example, the auxiliary agent code 134 can be loaded according to the initial RAM file system (or "initramfs") scheme. After the auxiliary agent 106 connects to the attestation agent 172, the peripheral device 159 does not allow another connection until the computer platform 100 is reset or rebooted.

[0085] Although as Figure 1 depicted, the peripheral device 159 can be the baseboard management controller 170, according to further implementations, the peripheral device 159 can be a component other than the baseboard management controller. In an example, the peripheral device 159 can be a graphics processing unit (GPU).

[0086] In another example, the peripheral device 159 can be a smart I / O peripheral device 119. In the context used herein, a "smart I / O peripheral device" refers to a component of a computer platform that provides one or more functions to the host of the computer platform that have been controlled by the host in a traditional architecture. A smart I / O peripheral device can also be referred to as a "data processing unit" or "DPU". Generally, a smart I / O peripheral device is a hardware processing unit that has been assigned (e.g., programmed with) a specific personality. A smart I / O peripheral device can provide one or more backend I / O services (or "host offload services") according to its personality. The backend I / O services can be opaque services (e.g., hypervisor virtual switch offload service) or transparent services (encryption service, overlay network access service, and firewall-based network protection service). In an example, one or more hardware processors of the smart I / O peripheral device 119 can execute machine-readable instructions to provide the authentication agent 172. In another example, dedicated hardware of the smart I / O peripheral device 119 that does not execute machine-readable instructions can provide the authentication agent 172. In an example, the dedicated hardware can be a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or another electronic device. According to a further embodiment, the smart I / O peripheral device 119 can use a combination of dedicated hardware and hardware that executes machine-readable instructions to provide the authentication agent 172.

[0087] For Figure 1 the example embodiments depicted and further described herein, the peripheral device 159 is a baseboard management controller 170. In an example, the baseboard management controller 170 can be an embedded system installed on the motherboard of the computer platform 100. According to an example embodiment, the baseboard management controller 170 can include one or more semiconductor packages (or "chips") and one or more semiconductor dies. According to a further embodiment, the baseboard management controller 170 can be an expansion card connected to a connector slot located on the motherboard of the computer platform 100. According to a further embodiment, the baseboard management controller 170 can not include the (multiple) semiconductor packages installed on the motherboard and can not be associated with an expansion card.

[0088] Regardless of its specific form or implementation, the baseboard management controller 170 can generally include one or more general-purpose embedded processing cores 154 (e.g., CPU processing cores), which can execute machine-readable instructions 156 stored in the memory 155 of the baseboard management controller to provide the attestation agent 172. According to a further implementation, the baseboard management controller 170 can use dedicated hardware of the baseboard management controller 170 to provide the attestation agent 172, and the dedicated hardware does not execute readable machine-readable instructions. In an example, the dedicated hardware can be an FPGA, an ASIC, a PLD, or another electronic device.

[0089] In the context used herein, a "baseboard management controller" is a dedicated service processor that uses sensors to monitor the physical state of a computer platform or other hardware and communicates with a management system through a management network. The baseboard management controller 170 can communicate with an application executed at the operating system level through: an IOCTL interface driver, a Representational State Transfer (REST) API, or some other system software agent that facilitates communication between the baseboard management controller and the application. The baseboard management controller 170 can perform hardware-level access to the hardware devices of the computer platform 100, including the system memory 114. The baseboard management controller 170 can be capable of directly modifying the hardware devices. The baseboard management controller 170 can operate independently of the operating system of the computer platform 100. The baseboard management controller 170 can be located on the motherboard or main circuit board of the computer platform 100. The fact that the baseboard management controller is installed on the motherboard of the managed server / hardware or otherwise connected or attached to the managed server / hardware does not prevent the baseboard management controller from being considered "separate" from the server / hardware. As used herein, the baseboard management controller has the management ability for the subsystems of the computing device and is separated from the processing resources that execute the operating system of the computing device. Thus, the baseboard management controller 170 is separated from the (one or more) hardware processors 110 that execute the instructions corresponding to the operating system kernel 104.

[0090] According to an example embodiment, the baseboard management controller 170 has a management plane and a separate security plane. The baseboard management controller 170 can provide various management services for the computer platform 100 through its management plane. One or more of these management services can be the service(s) 174 used by one or more user space processes 108. For example, the management services provided by the baseboard management controller 170 can include monitoring sensors (e.g., temperature sensors, cooling fan speed sensors); monitoring the operating system status; monitoring the power status; logging computer platform 100 events; providing the ability to install virtual media; providing the ability to boot the computer platform 100 from virtual media; providing remote control management functions for the computer platform 100; and other management services.

[0091] According to an example embodiment, the baseboard management controller 170 provides security functions or services for the computer platform 100 through its security plane, such as key management (e.g., functions related to storing and loading encryption keys), firmware image verification, platform encrypted identity acquisition, measurement hash loading, measurement hash acquisition; and other security services. According to an example embodiment, as part of its security plane, the baseboard management controller 170 can verify and load firmware instructions from the firmware 176 stored in the non-volatile memory 184 (e.g., flash memory) of the computer platform 100. The firmware 176 can include machine-readable instructions corresponding to the management stack of the baseboard management controller 170, and the firmware 176 can include code 177 executed by one or more processing cores 154 to provide the verification agent 172. As Figure 1 depicted, the baseboard management controller 170 can be coupled to the non-volatile memory 184 through a bus 183 (e.g., a serial peripheral interface (SPI) bus or other bus).

[0092] In addition to other features, the computer platform 100 can further include one or more I / O bridges 118; one or more mass storage devices 130; one or more network interface cards (NICs) 113; one or more TPMs 188; I / O devices (e.g., keyboard, mouse, touchpad, display, etc.); and other electronic devices.

[0093] According to an example embodiment, the baseboard management controller 170, the NIC(s) 113, the TPM(s) 188, and the processor 110 can communicate through the I / O bridge(s) 118; and the storage device(s) 130 can be coupled to the processor 110 through the I / O bridge(s) 118. As Figure 1As depicted, according to some embodiments, the storage device(s) 130 may store an operating system image 132 (corresponding to the operating system kernel 104), operating system bootloader code (corresponding to the operating system bootloader), auxiliary agent code 134 (corresponding to the auxiliary agent 106); and application code 136 (corresponding to the application 103). For Figure 1 In an example embodiment, the NIC 113 couples the I / O bridge(s) 118 to the network fabric 190. According to a further example embodiment, the baseboard management controller 170 may include a NIC that communicates with the network fabric 190.

[0094] Generally, the network fabric 190 may be associated with one or more types of communication networks such as (by way of example) a Fibre Channel network, a Compute Express Link (CXL) fabric, a dedicated management network, a local area network (LAN), a WAN, a global network, a wireless network, or any combination thereof.

[0095] The TPM 188 is an example of a security processor of the computer platform 100, which, among other functions, may also be used to provide cryptographic services for the computer platform 100 and securely store the cryptographic artifacts of the computer platform 100 (e.g., secure boot variables, hashes for verifying integrity measurements, keys, etc.). In an example, the TPM 188 may be a physical hardware component installed on the motherboard of the computer platform 100. In another example, the TPM 188 may be a virtual TPM (vTPM). In another example, the TPM 188 may be a firmware TPM (fTPM). According to a further embodiment, the computer platform 100 may not include a TPM.

[0096] According to some embodiments, the TPM 188 may be configured to perform one or more trusted computing operations described in the Trusted Platform Module Library Specification, Family 2.0, Level 00, Revision 01.59 (November 2019) (hereinafter referred to as the "TPM 2.0 Specification") published by the Trusted Computing Group. According to further embodiments, the TPM 188 may perform one or more trusted computing operations not described in the TPM 2.0 Specification. According to further example embodiments, the computer platform 100 may include security components in addition to the TPM. According to further embodiments, the computer platform 100 may not have a TPM or other security processor. According to further embodiments, the computer platform 100 may have a TPM 188 or other security processor, but does not use the TPM 188 / security processor.

[0097] According to example embodiments, the computer platform 100 may have multiple TPMs 188. In an example, the computer platform 100 may have a host-attached TPM 188 that assists the agent 106 in operations related to cryptographic processing. Additionally, the computer platform 100 may have another TPM 188 that assists the baseboard management controller 170 in operations related to cryptographic processing. In an example, the TPM 188 may include a random number generator that may generate and return a random number as a response to an API call via the API call. In an example, in order to generate a random number to be used as a one-time number, the verification agent 172 may generate an API call to the TPM 188. The random number generator may generate a random number from an input provided by an entropy source. In an example, the random number generator may be the digital random number generator module described in Section 11.4.11, Part 1 of the TPM 2.0 Specification.

[0098] In another example, the TPM 188 may include a hash module or engine that applies a cryptographic hash algorithm to an input for providing a hash or digest. In an example, the hash engine may apply the cryptographic hash function described in Section 11.4.2, Part I of the TPM 2.0 Specification.

[0099] Figure 2 is a sequence flow diagram 200 depicting a technique for provisioning (multiple) credentials for a user space process 108 according to example embodiments. Refer to Figure 2 , for this example, the host management credential infrastructure includes the agent 106 of the host 201 and the verification agent 172 of the peripheral device 202. Figure 1The host 101 is an example of the host 201, and Figure 1 the peripheral device 159 is an example of the peripheral device 202.

[0100] For this example, the verification agent 172 evaluates the trustworthiness of the user space process 108 based on the expected state trust model. More specifically, for this example, a signed manifest file 203 has been provisioned for the peripheral device 202. The signed manifest file 203 contains a list of expected integrity metrics (e.g., the expected digest D REF and additional attributes), as well as additional integrity metrics for applications and / or services that have been approved for use with the peripheral device 202. In the example, the manifest file can have records, where each record is associated with an expected set of integrity metrics for the user space process 108. In the example, a record can contain the expected digest D REF for the associated specific user space process 108, as well as one or more non-digest integrity metrics (or "attributes") of the user space process 108.

[0101] According to an example implementation, the user space process 108 provides a registration request 204 to the secondary agent 106. In the example, the request 204 can be an API call to the registration API of the secondary agent 106. In response to receiving the registration request 204, the secondary agent 106 measures the run-time invariant content of the user space process 108 to obtain or determine the corresponding run-time digest D RUNTIME , as depicted at 208. Additionally, determining the run-time digest D RUNTIME can include applying a cryptographic hash algorithm to one or more memory paragraphs associated with the user space process 108. In another example, determining the run-time digest D RUNTIME can include the secondary agent 106 combining one or more measures of the content in memory with other information, such as one or more attributes of the user space process 108 and / or the text content from one or more libraries dynamically linked to the user space process 108. Regardless of the specific method used, the basic assumption is that the same method is used to obtain the corresponding expected digest D REF contained in the manifest file 203.

[0102] As depicted at 212, the auxiliary agent 106 may determine one or more non-digest integrity measures or attributes of the user space process 108. Additionally, the auxiliary agent 106 may generate metadata that describes the (multiple) attributes. In an example, the attribute may be a process path associated with the user space process 108. In an example, the attribute may be the name of the executable file associated with the user space process 108. In an example, the attribute may be a combination of the name of the executable file associated with the user space process 108 and one or more command arguments passed to the user space process 108. In an example, the attribute may be an environment variable associated with the user space process 108. In an example, the attribute may be the range of one or more text segments associated with the user space process 108. In an example, the attribute may be a permission associated with a specific text segment associated with the user space process 108. As depicted at 216, the auxiliary agent 106 sends a report to the verification agent 172, the report including the metadata that describes the (multiple) attributes and a representation of the runtime digest D RUNTIME and the data.

[0103] Then, according to an example implementation, the verification agent 172 may evaluate the trustworthiness of the user space process 108 for determining whether to issue the (multiple) credentials to the user space process 108. Although Figure 2 not depicted, it is assumed that the verification agent 172 has verified the manifest file 203 based on the signature of the file 203. To evaluate the trustworthiness of the user space process 108, as depicted in block 224, the verification agent 172 accesses the manifest file 203 to read one or more expected integrity measures of the user space process 108 for determining the expected state of the user space process 108. In an example, according to block 224, the verification agent 172 may read the expected digest D REF of the user space process 108 from the manifest file 203. In another example, according to block 224, the verification agent 172 may read metadata from the manifest file 203 that represents one or more attributes of the user space process 108. As depicted in decision block 232, the verification agent 172 may then determine whether the current state of the user space process 108 corresponds to the expected state of the user space process 108. If the current state does not correspond to the expected state, then authentication fails. Otherwise, if the current state of the user space process corresponds to the expected state of the user space process 108, then authentication passes.

[0104] In an example, if the runtime digest D RUNTIME does not match any of the expected digests D REFIf there is a mismatch, the current state of the user space process 108 may not correspond to the expected state. In another example, the metadata of the report 220 may represent attributes that are unexpected according to the manifest file 203. Therefore, the current state of the user space process 108 does not correspond to its expected state.

[0105] In an example, the metadata of the report 220 may represent specific environment variables, and the metadata of the manifest file 203 may indicate an expectation for such environment variables that is not met by the user space process 108. More specifically, certain environment variables are considered potential attack vectors for security attacks. In an example, for the LINUX operating system, environment variables such as LD_PRELOAD and LD_LIBRARY_PATH are considered potentially dangerous in a production environment because an attacker can use them to hijack execution and insert malicious libraries. In an example, the manifest file 203 can identify one or more environment variables that are prohibited from being used in conjunction with the user space process 108 (and thus, it is expected that the user space process 108 does not use these environment variables). In another example, the manifest file 203 can identify specific environment variables that are expected to be used in a certain way. For example, a malicious agent can use a specific environment variable to load a malicious library whose name matches the name of a legitimate or authorized library. The manifest file 203 can, for example, identify the environment variable and indicate an expectation for how the variable is to be used. In an example, the manifest file 203 can identify the value of the environment variable. The value represents the path to the library that the operating system is to load. Therefore, if the user space process 108 is associated with a specific environment variable that is not used as expected, the current state of the user space process 108 does not correspond to its expected state.

[0106] In another example, the metadata of the report may represent the process path of the user space process 108, which may be different from the expected process path of the user space process 108 indicated by the metadata of the manifest file 203. In another example, compared to the expected name represented by the metadata of the manifest file 203, the metadata of the report 220 may represent an unexpected name of the executable file corresponding to the user space process 108. In another example, compared to the expected command arguments represented by the metadata of the manifest file 203, the metadata of the report 220 may represent unexpected command arguments being passed to the user space process 108.

[0107] According to an example embodiment, in response to determining that the current state of the user space process 108 does not correspond to the expected state (decision block 232), the verification agent 172 rejects the registration request, as depicted at 236. Additionally, according to an example embodiment, the verification agent 172 records the rejection of the request, as depicted at 236. According to some embodiments, the verification agent 172 may perform different and / or one or more response actions in response to determining that the current state of the user space process 108 does not correspond to the expected state of the user space process 108.

[0108] As used in the context herein, "response action" refers to measures against actual or potential tampering activities. In an example, the response action may include rejecting a credential request, as described herein. In another example, the response action may include recording the rejection of a credential request, as described herein. In an example, the response action may include powering off a computer platform that includes the peripheral device 202 and the host 201. In another example, the response action may include rebooting the computer platform. In another example, the response action may include generating data for generating an alert on a management dashboard. In another example, the response action may include sending an alert message to a system administrator. In another example, the response action may include sending an alert message to a remote management server (e.g., Figure 1 the remote management server 194). In another example, the response action may include imposing a restriction, i.e., providing a specific password, key, or other credential (e.g., a credential provided by a system administrator) before allowing the computer platform to reboot. In another example, the response action may include isolating the computer platform from an external network. In another example, the response action may include pausing the operation of the computer platform associated with an external entity. According to some embodiments, the verification agent 172 may select one or more response actions to initiate based on a predefined policy that defines the response actions and the criteria for triggering the response actions.

[0109] As depicted at 232, if the verification agent 172 determines that the current state of the user space process 108 corresponds to the expected state of the user space process 108, the verification agent 172 initiates the action of provisioning (multiple) credentials for the user space process 108, as depicted at 240. The provisioning includes the verification agent 172 generating (multiple) credentials and sending the (multiple) credentials to the secondary agent 106, as depicted at 240. The provisioning may further include the verification agent 172 recording the (multiple) credentials and establishing an association of the (multiple) credentials with the expected digest D REF establishing an association. Additionally, the provisioning may include the secondary agent 106 providing the (multiple) credentials to the user space process, as depicted at 248.

[0110] Figure 3FIG. 300 is a sequence flow diagram depicting a technique for provisioning credentials for user space process 108 according to a further example embodiment. Referring to Figure 3 , for this example, the technique uses a host managed credential infrastructure that includes a secondary agent 106 of host 301 and an attestation agent 172 of peripheral device 302. Figure 1 The host 101 of Figure 1 is an example of host 301, and the peripheral device 159 of

[0111] Sequence flow diagram 300 begins with user space process 108 submitting a registration request 304 to secondary agent 106. As an example of registration request 304, user space process 108 may submit an API call to the registration API of secondary agent 106. As depicted at 308, secondary agent 106 measures user space process 108 and determines a corresponding runtime digest D RUNTIME .

[0112] Then, secondary agent 106 generates a report 320 that includes runtime digest D RUNTIME and sends the report to attestation agent 172, as depicted at 312. According to some embodiments, report 320 may also include metadata describing one or more non-digest integrity measures or attributes of user space process 108. In an example, the attribute(s) may include information that uniquely identifies a particular user process 108, e.g., the name of the executable file corresponding to user space process 108 and the process path of user space process.

[0113] As depicted at 321, attestation agent 172 may process report 320 to determine whether to provision credentials for user space process 108. Using the TOFU trust model, attestation agent 172 trusts the first use of user space process 108. Attestation agent 172 may uniquely identify user space process 108 based on one or more attributes of the metadata included in report 320. If attestation agent 172 determines that this is not the first use of user space process 108, then attestation agent 172 rejects the registration request and performs one or more other actions, such as logging the rejection (as depicted at 322) and possibly one or more further response actions. Additionally, according to some embodiments, attestation agent 172 may notify secondary agent 106 of the rejection.

[0114] As also depicted in Figure 3 , if attestation agent 172 determines that this is the first use of user space process 108, then attestation agent 172 passes the runtime digest DRUNTIME Designate (box 324) as the expected digest D REF To continue, as depicted at 324. Additionally, according to some embodiments, the verification agent 172 may designate one or more attributes of the user space process as corresponding expected integrity measures of the user space process 108 according to the example embodiments.

[0115] Then, the verification agent 172 may initiate an action to provision (a) credential(s) for the user space process 108. The provisioning includes the verification agent 172 generating (a) credential(s), as depicted at 328. The provisioning may include the verification agent 172 sending (a) credential(s) to the secondary agent 106, and the secondary agent 106 recording (a) credential(s) and associating (a) credential(s) with the expected digest D REF To establish an association, as depicted at 332. Additionally, the provisioning may include the secondary agent 106 providing (a) credential(s) to the user space process 108, as depicted at 336.

[0116] Figure 4 Is a sequence flow diagram 400 depicting techniques for monitoring the trustworthiness of the user space process 108 and revoking (a) credential(s) of the user space process 108 when the monitoring reveals that the process 108 is no longer trustworthy. Refer to Figure 4 , the monitoring is performed by the host-managed credential infrastructure, which includes the secondary agent 106 of the host 401 and the verification agent 172 of the peripheral device 402. Figure 1 The host 101 of Figure 1 The peripheral device 159 of

[0117] As depicted at 404, the verification agent 172 sends a re-verification request 408 to the secondary agent 106 to initiate re-verification. In an example, the verification agent 172 may send a re-verification request for a specific user space process 108 to the secondary agent 106 according to a schedule (e.g., a periodic schedule).

[0118] The secondary agent 106 responds to the re-verification request 408 as follows. First, according to the example embodiments, the secondary agent 106 measures the user space process 108 and determines the current runtime digest D RUNTIME , as depicted at 412. According to the example embodiments, the secondary agent 106 may also determine in addition to the current runtime digest D RUNTIMEOne or more integrity measures other than. For example, the secondary agent 106 determines one or more non-digest integrity measures or attributes of the user space process 108 and determines the metadata describing the (multiple) attributes, as depicted at 416. Then, as depicted at 420, the secondary agent 106 can generate a report 424 and send the report to the verification agent 172, the report containing data representing the runtime digest D RUNTIME and the metadata describing the (multiple) attributes.

[0119] Then, the verification agent 172 performs the following actions to re-evaluate the trustworthiness of the user space process 108. The verification agent 172 reads one or more expected integrity measures of the user space process 108 and determines the expected state of the user space process 108, as depicted at 428. In an example, the verification agent 172 can read one or more expected integrity measures of the user space process 108 from a manifest file (e.g., Figure 2 manifest file 203). In another example, the verification agent 172 and / or reads one or more expected integrity measures of the user space process 108 from a storage of the (multiple) initial integrity measures obtained during registration (e.g., obtained during registration as depicted in Figure 3 the registration based on the TOFU security model). In an example, the expected state of the user space process 108 can correspond to a specific expected digest D REF , and a set of one or more non-digest expected integrity measures (e.g., associated file names, process paths, passed command arguments, expectations for specific environment variables, or (multiple) other user process attributes).

[0120] Next, as depicted at 436, the verification agent 172 determines whether the current state of the user space process 108 corresponds to the expected state of the user space process 108. If so, the verification agent 172 takes no further action to re-verify because the user space process 108 is still considered trustworthy. However, if the current state of the user space process 108 does not correspond to the expected state of the user space process 108, the verification agent 172 can revoke the (multiple) credentials of the user space process 108, as depicted at 440, and communicate with the secondary agent 106 to cause the secondary agent 106 to mark the (multiple) credentials as revoked, as depicted at 444. Additionally, according to some embodiments, the verification agent 172 can perform one or more additional response actions for the revocation of the (multiple) credentials, such as logging the revocation and one or more other actions.

[0121] The verification agent 172 can periodically test the host credential management infrastructure using integrity checks to determine whether the infrastructure has been tampered with. Figure 5Depicts a sequence flow diagram 500 illustrating a single integrity check corresponding to the failure of the secondary agent 106 to respond to a re-verification request 504. Figure 6 Depicts a sequence flow diagram illustrating another integrity check of the host credential management infrastructure using an active one-time number.

[0122] Refer to Figure 5 , for this example, the host management credential infrastructure includes the secondary agent 106 of the host 501 and the verification agent 172 of the peripheral device 502. Figure 1 The host 101 of [[ ]] is an example of the host 501, and Figure 1 the peripheral device 159 of [[ ]] is an example of the peripheral device 502.

[0123] As depicted at 504, the verification agent 172 sends a re-verification request 506 to the secondary agent 106 at a scheduled time. For this example, the secondary agent 106 does not respond to the re-verification request 506 within the expected time period. In the example, the expected time period can be measured starting from the time when the re-verification request 506 is sent from the verification agent 172. In other words, the verification agent 172 does not receive a response from the secondary agent 106 within the predetermined time measured after sending the re-verification request 506. In another example, the verification agent 172 can measure a predetermined time period for the secondary agent 106 to confirm the sending of the re-verification request 506, and the verification agent 172 may not receive the confirmation within the expected time period.

[0124] Generally, the failure of the secondary agent 106 to respond within the expected time period may be caused by tampering with the host credential management infrastructure (e.g., tampering with the operating system kernel and / or the secondary agent 106). Thus, as Figure 5 depicted, when it is determined (as depicted at 508) that no response to the re-verification request 506 from the secondary agent 106 is received within the expected time period, the verification agent 172 revokes all host credentials associated with all registered user space processes 108, as depicted at 512. Additionally, according to some embodiments, due to the non-responsiveness of the secondary agent 106, the verification agent 172 can perform one or more other response actions. However, if a response to the re-verification request 506 is received within the expected time period, the verification engine 172 processes the response, as depicted at 510. In the example, the processing of the response can be according to the Figure 4 sequence flow diagram 400 discussed above.

[0125] Refer to Figure 6 , for this example, the host management credential infrastructure includes the secondary agent 106 of the host 601 and the verification agent 172 of the peripheral device 602. Figure 1The host 101 is an example of the host 601, and Figure 1 the peripheral device 159 is an example of the peripheral device 602.

[0126] As depicted at 604, the verification agent 172 sends an active one-time number 608 to the secondary agent 106 according to a schedule. For this example, as depicted at 612, the secondary one-time number 106 determines a response to the active one-time number 608 by applying a predetermined function to the active one-time number 608 and sends the response to the verification agent 172.

[0127] In the example, the active one-time number 608 can be a randomly generated or pseudo-randomly generated number. In the example, the predetermined function can be a mathematical function applied to the active one-time number 608. In the example, the predetermined function can be a mathematical function for adding a predetermined number to the active one-time number 608 to produce a result (response one-time number) sent as the response 616.

[0128] Figure 6 It is depicted that the response 616 is received by the verification agent 172. For this example, as depicted at 620, the verification agent 172 determines the expected response to the active one-time number 608. In this way, the verification agent 172 applies the expected predetermined function to the active one-time number 608 to determine whether the response 616 corresponds to the expected result. As depicted at 624, if the verification agent 172 determines that the response 616 corresponds to the expected response, the integrity check of the host credential management infrastructure using the active one-time number 608 is completed. Otherwise, if the response is unexpected, the verification agent 172 can perform or initiate one or more response actions, including revoking all host credentials associated with the registered user space process 108, as depicted at 628.

[0129] Although not depicted in the example in conjunction with Figure 6 shown, an unexpected response to the active one-time number 608 could be that the secondary agent 106 does not respond 616 to the active one-time number. For this case, the verification agent 172 can perform or initiate one or more response actions, including revoking all credentials of the registered user space process 108.

[0130] According to further embodiments, other techniques can be used to monitor the integrity of the host credential management infrastructure. For example, according to some embodiments, the auxiliary agent 106 can be configured to send heartbeat messages according to an expected schedule (e.g., according to a periodic schedule). The failure of the verification agent 172 to receive a particular heartbeat message within a corresponding expected period alerts the verification agent 172 to a potential tampering with the auxiliary agent 106. Thus, the verification agent 172 can initiate one or more response actions in response to the non-receipt of a heartbeat message within the corresponding expected period. In another variant, the heartbeat message can have an expected content or format, and the verification agent 172 can initiate one or more response actions because a particular heartbeat message does not contain content or format that conforms to the expectation.

[0131] Figure 7 FIG. 700 is a sequence flow diagram depicting techniques for establishing a communication channel between a user space process 108 and a peripheral device 702 according to an example embodiment. For this example, the user space process 108 is associated with a host 701. Figure 1 The host 101 of FIG. 1 is an example of the host 701. The peripheral device 702 includes a verification agent 172. Figure 1 The peripheral device 159 of FIG. 1 is an example of the peripheral device 702.

[0132] The user space process 108 initiates the communication channel by sending a request 706 to establish a communication channel to the peripheral device 702 (as depicted at 704). The verification agent 172 of the peripheral device 702 responds to the request 706 by performing one or more actions to verify whether the user space process 108 possesses the credential(s), as depicted at 712. This verification can include the user space process 108 taking one or more actions to demonstrate possession of the credential, as depicted at 708. Then, as depicted at 716, the verification agent 172 can determine whether to allow the establishment of the communication channel, and if allowed, the management service (e.g., Figure 1 the management service 174 of FIG. 1) of the peripheral device 702 and the user space process 108 can then establish the communication channel, as depicted at 720. Otherwise, as depicted at 724, in addition to other possible response actions, the verification agent 172 can also reject the communication channel and record the rejection.

[0133] Reference Figure 8, according to an example embodiment, the non-transitory machine-readable storage medium 800 stores machine-readable instructions 810. The machine-readable instructions, when executed by a peripheral device, cause the peripheral device to communicate with an operating system-based kernel of a host. In an example, the peripheral device may be a baseboard management controller. In another example, the peripheral device may be a graphics processing unit. In another example, the peripheral device may be an intelligent I / O peripheral device. In an example, communicating with the operating system-based kernel includes communicating with an auxiliary agent of the kernel. In an example, the auxiliary agent may correspond to a loadable kernel module (LKM). In another example, the auxiliary agent may correspond to a kernel driver. In another example, the auxiliary agent may correspond to an eBPF module. In another example, the auxiliary agent may be an integrated part of the kernel core.

[0134] The instructions 810, when executed by a peripheral device, cause the peripheral device to receive an integrity measure of a user space process of the host from the operating system kernel. In an example, the operating system kernel may be a LINUX kernel. In another example, the operating system kernel may be a WINDOWS NT kernel. In an example, the integrity measure may correspond to a hash of the contents in memory associated with the user space process. In an example, the contents in memory may be runtime invariant contents that are expected not to change during runtime. In an example, the contents in memory may correspond to a text segment associated with the user space process. In an example, the integrity measure may correspond to multiple invariant memory segments associated with the user space process, such as multiple text segments associated with the user space process. In an example, the integrity measure may include a combination of a hash of the contents in memory associated with the user space process and time-invariant contents from one or more libraries dynamically linked to the user space process. In an example, the integrity measure may be a hash of the contents in memory associated with the user space process, and data representing one or more attributes of the user space process other than the contents in memory.

[0135] In an example, the integrity measure may be an attribute of the user space process other than a digest or hash. In an example, the integrity measure may be the process path of the user space process. In an example, the integrity measure may be the name of the executable file corresponding to the user space process. In an example, in addition to one or more command arguments passed to the user space process, the integrity measure may also be the name of the executable file associated with the user space process. In an example, the integrity measure attribute may be a specific name of a specific environment variable. For example, the integrity measure may be the specific name of the environment variable and the path associated with the environment variable. In an example, the integrity measure may be a compromise indicator associated with the user space process.

[0136] When executed by a peripheral device, instruction 810 further causes the peripheral device to verify whether a first state of a user space process corresponds to an expected state of the user space process based on an integrity measurement. In an example, the verification may include determining whether an expected integrity measurement of the user space process corresponds to the integrity measurement received from the operating system kernel. In an example, the verification may include determining whether a runtime digest of the content in the memory associated with the user space process matches an expected digest of the user space process. In an example, the verification may include determining whether the user space process is associated with a compromise indicator. In an example, the verification may include determining whether the attributes of the user space process correspond to the expected attributes of the user space process.

[0137] When executed by a peripheral device, instruction 810 further causes the peripheral device to communicate with the kernel to provision authentication credentials for the user space process in response to verifying that the first state corresponds to the expected state, thereby allowing the user space process to use the services provided by the peripheral device. In an example, the authentication credentials may be a token. In an example, the authentication credentials may be a randomly generated or pseudo-randomly generated number. In an example, the authentication credentials may be part of a set of authentication credentials including an asymmetric encryption key pair and a digital certificate. In an example, the digital certificate may be an X.509 digital certificate. In an example, the authentication credentials may be a set of authentication credentials including a username and a password.

[0138] In an example, provisioning the authentication credentials includes the peripheral device sending the authentication credentials to the kernel using an encrypted communication channel between the peripheral device and the kernel. In an example, the service may be a management service. In an example, the service may be a management service for obtaining operating system events from the kernel. In an example, the service may provide a log of events detected by the peripheral device. In an example, the service may update at least one of the system software or firmware. In an example, the service may be remotely controlled. In an example, the user space process may be associated with an application or service executed by the host.

[0139] Reference Figure 9 Referring, computer platform 900 includes a host 904 and a peripheral device 912. In an example, the host 904 may be associated with an operating system. In an example, the host 904 may provide the main functions for supporting the operating system and supporting user space processes. In an example, the peripheral device may be a baseboard management controller. In another example, the peripheral device may be a graphics processing unit. In another example, the peripheral device may be an intelligent I / O peripheral device.

[0140] The host 904 includes a hardware processor 908 that executes machine-readable instructions associated with an operating system kernel. In an example, the hardware processor 908 may include one or more CPU processing cores. In an example, the operating system kernel may be a WINDOWS NT kernel or a LINUX kernel. In an example, the instructions may correspond to a loadable kernel module (LKM). In another example, the instructions may correspond to a kernel driver. In another example, the instructions may correspond to an eBPF module. In another example, the instructions may be an integrated part of the kernel core.

[0141] The kernel measures user space processes at different times to provide a time series of integrity measurements. In an example, the integrity measurement may correspond to a hash of the contents in memory associated with a user space process. In an example, the contents in memory may be contents that are expected not to change during runtime. In an example, the contents in memory may correspond to a text segment associated with a user space process. In an example, the integrity measurement may correspond to multiple invariant memory segments associated with a user space process, such as multiple text segments associated with a user space process. In an example, the integrity measurement may be a hash of the contents in memory associated with a user space process and data representing one or more attributes of the user space process other than the contents in memory. In an example, the integrity measurement may include a combination of a hash of the contents in memory associated with a user space process and time-invariant contents from one or more libraries dynamically linked to the user space process.

[0142] In an example, the integrity measurement may be an attribute of a user space process other than a digest or a hash. In an example, the attribute may be the process path of a user space process. In an example, the attribute may be the name of an executable file corresponding to a user space process. In an example, the attribute may be the name of an executable file associated with a user space process in addition to one or more command arguments passed to the user space process. In an example, the attribute may be a specific environment variable associated with a user space process. In an example, the attribute may indicate how to use a specific environment variable. In an example, the attribute may be a path associated with an environment variable. In an example, the attribute may be a compromise indicator associated with a user space process.

[0143] The peripheral device 912 authenticates a user space process based on the credentials assigned to the user space process. In an example, the credentials may be a token. In an example, the credentials may be a random number. In an example, the credentials may be part of a set of credentials that includes an asymmetric cryptographic key pair and a digital certificate. In an example, the digital certificate may be an X.509 digital certificate. In an example, the credentials may be a set of credentials that includes a username and a password.

[0144] The peripheral device 912 receives integrity metrics, and for each integrity metric, the peripheral device 912 verifies whether the state of the user space process corresponds to the expected state of the user space process to provide a corresponding verification result. In an example, the verification may include determining whether the expected integrity metric of the user space process corresponds to the integrity metric received from the operating system kernel. In an example, the verification may include determining whether the user space process is associated with a compromise indicator. In an example, the verification may include determining whether the attributes of the user space process correspond to the expected attributes of the user space process.

[0145] The peripheral device 912 manages credentials based on the verification result. In an example, managing credentials includes provisioning credentials. In another example, managing credentials includes revoking credentials. In another example, managing credentials includes associating the credentials with one or more privileges.

[0146] Reference Figure 10 ,Technique 1000 includes provisioning (block 1004) credentials for a user space process by a peripheral device. In an example, provisioning credentials includes generating a token. In an example, provisioning credentials includes using a random number generator to generate a random number corresponding to the token. In another example, provisioning credentials includes using a pseudorandom number generator to generate a pseudorandom number corresponding to the token. In another example, provisioning credentials includes generating an asymmetric cryptographic key pair and a digital certificate. In another example, provisioning credentials includes the peripheral device sending the credentials to the operating system kernel. In an example, provisioning credentials includes the operating system kernel sending the credentials to the user space process. In an example, provisioning credentials includes assigning one or more privileges to the credentials. In an example, provisioning credentials includes associating an integrity metric with the credentials.

[0147] Technique 1000 includes authenticating (block 1008) a user space process by a peripheral device based on the credentials. Technique 1000 includes an agent based on the operating system kernel providing (block 1012) the integrity metric of the user space process to the peripheral device. In an example, the auxiliary agent may correspond to an LKM. In another example, the auxiliary agent may correspond to a kernel driver. In another example, the auxiliary agent may correspond to an eBPF module. In another example, the auxiliary agent may be an integrated part of the kernel core.

[0148] In an example, the integrity metric may correspond to a hash of the contents in the memory associated with the user space process. In an example, the contents in the memory may be contents that are expected not to change during runtime. In an example, the contents in the memory may correspond to the text segment associated with the user space process. In an example, the integrity metric may correspond to multiple invariant memory segments associated with the user space process, such as multiple text segments associated with the user space process.

[0149] In an example, the integrity measure can be a summary or hash of the contents in the memory associated with a user space process, and data representing one or more attributes of the user space process other than the contents in the memory. In an example, the integrity measure can include a combination of the hash of the contents in the memory associated with the user space process and the time-invariant contents from one or more libraries dynamically linked to the user space process.

[0150] In another example, the integrity measure can be an attribute of the user space process other than the summary or hash. In an example, the integrity measure can be the process path of the user space process. In another example, the integrity measure can be the name of the executable file corresponding to the user space process. In another example, in addition to one or more command arguments passed to the user space process, the integrity measure can also be the name of the executable file associated with the user space process. In an example, the attribute can be a specific environment variable associated with the user space process. In an example, the attribute can indicate how to use the specific environment variable. In an example, the attribute can be the path associated with the environment variable. In an example, the integrity measure can be a compromise indicator associated with the user space process.

[0151] Technique 1000 includes determining (block 1016) an observed state of a user space process by a peripheral device based on the integrity measure. In an example, determining the observed state can include determining a set of one or more observed integrity measures of the user space process, and comparing the set with a set of one or more expected integrity measures of the user space process to determine whether the (multiple) observed integrity measures match the (multiple) expected integrity measures. More specifically, technique 1000 includes verifying (block 1020) by the peripheral device whether the observed state corresponds to an expected state of the user space process. In an example, determining whether the observed state corresponds to the expected state includes determining whether the expected summary of the user space process corresponds to the runtime summary of the user space process. In another example, determining whether the observed state corresponds to the expected state includes determining whether the user space process is associated with a compromise indicator.

[0152] In an example, determining whether the observed state corresponds to the expected state includes determining whether the process path of the user space process corresponds to the expected process path of the user space process. In an example, determining whether the observed state corresponds to the expected state includes determining whether the name of the executable file corresponding to the user space process corresponds to the expected file name of the user space process. In an example, determining whether the observed state corresponds to the expected state includes determining whether the command arguments corresponding to the user space process correspond to the expected command arguments of the user space process. In an example, determining whether the observed state corresponds to the expected state includes determining whether the range of segments of the user space process corresponds to the expected range of the segments.

[0153] In other examples, determining whether an observed state corresponds to an expected state includes determining whether a user space process is associated with a specific environment variable (e.g., the LD_PRELOAD environment variable or the LD_LIBRARY_PATH environment variable) and / or determining whether the specific environment variable is used in an expected manner. In an example, determining whether an observed state corresponds to an expected state includes determining whether a user space process is associated with a specific environment variable, and if so, determining whether the environment variable has a specific associated load path. In another example, determining whether an observed state corresponds to an expected state includes determining whether a user space process is associated with a specific environment variable, and if so, verifying the load path associated with the environment variable to ensure that the load path references a legitimate or authorized resource (e.g., an authorized library).

[0154] Technique 1000 includes revoking (block 1024) a credential by a peripheral device in response to the observed state not corresponding to the expected state. In an example, revoking the credential includes the peripheral device notifying an operating system kernel-based agent of the revocation of the credential. In an example, revoking includes the peripheral device recording the revocation. In an example, revoking includes the peripheral device initiating a response action. In an example, the response action includes sending an alert message. In an example, the response action includes isolating the computer platform from the network.

[0155] According to an example embodiment, a peripheral device establishes a communication channel with a host. Establishing the communication channel includes the peripheral device authenticating a user space process based on a credential. Among potential advantages, the credentials of the user space process can be securely managed by the peripheral device in a manner that allows revocation of the credentials of an untrusted user space process without human intervention.

[0156] According to an example embodiment, the peripheral device sends a request for an updated integrity measure of a user space process to the kernel; and selectively revokes the credential based on the response to the request. Among potential advantages, the credentials of the user space process can be securely managed by the peripheral device in a manner that allows revocation of the credentials of an untrusted user space process without human intervention.

[0157] According to an example embodiment, the peripheral device receives an updated integrity measure in response to a request; and determines an updated state of the user space process based on the updated integrity measure. The peripheral device verifies whether the updated state corresponds to the expected state. The peripheral device revokes the credential in response to the updated state not corresponding to the expected state. Among potential advantages, the credentials of the user space process can be securely managed by the peripheral device in a manner that allows revocation of the credentials of an untrusted user space process without human intervention.

[0158] According to an example embodiment, the peripheral device revokes a credential in response to the peripheral device not receiving an updated integrity measure within an expected time interval associated with the sending of a request. Among potential advantages, the credentials of user space processes can be securely managed by the peripheral device without human intervention in a manner that allows revocation of the credentials of untrusted user space processes.

[0159] According to an example embodiment, the peripheral device revokes at least one other credential associated with at least one other user space process in response to the peripheral device not receiving an updated integrity measure within an expected time interval. Among potential advantages, the credentials of user space processes can be securely managed by the peripheral device without human intervention in a manner that allows revocation of the credentials of untrusted user space processes.

[0160] According to an example embodiment, the peripheral device sends a nonce to the kernel at a corresponding time according to a predetermined schedule. The peripheral device controls the validity of the credential in response to the sending of the nonce. Among potential advantages, the credentials of user space processes can be securely managed by the peripheral device without human intervention in a manner that allows revocation of the credentials of untrusted user space processes.

[0161] According to an example embodiment, the peripheral device sends a given nonce. The kernel is expected to respond to the sending of the given nonce with an expected value obtained by applying a predetermined function to the given nonce. The peripheral device receives a second value from the kernel in response to the sending of the given nonce; and determines that the second value does not correspond to the expected value. The peripheral device revokes the credential in response to determining that the second value does not correspond to the expected value. Among potential advantages, the credentials of user space processes can be securely managed by the peripheral device without human intervention in a manner that allows revocation of the credentials of untrusted user space processes.

[0162] According to an example embodiment, the peripheral device sends a given nonce, and the kernel is expected to respond to the sending of the given nonce within a predetermined time interval. The peripheral device determines that the kernel fails to respond to the sending of the given nonce within the predetermined time interval. The peripheral device revokes the credential in response to determining that the kernel fails to respond to the sending of the given nonce within the predetermined time interval. Among potential advantages, the credentials of user space processes can be securely managed by the peripheral device without human intervention in a manner that allows revocation of the credentials of untrusted user space processes.

[0163] According to an example embodiment, the peripheral device includes a baseboard management controller, a smart input / output (I / O) peripheral device, or a graphics processing unit (GPU). Among potential advantages, the credentials of user space processes can be securely managed by the peripheral device without human intervention in a manner that allows revocation of the credentials of untrusted user space processes.

[0164] According to an example embodiment, an initial integrity measurement of a user space process is provided by an operating system kernel to a peripheral device. The peripheral device determines an expected state of the user space process based on the initial integrity measurement. Among potential advantages, credentials of the user space process can be securely managed by the peripheral device in a manner that allows revocation of the credentials of an untrusted user space process without human intervention.

[0165] According to an example embodiment, a manifest is provisioned for the peripheral device, the manifest including data representing an expected integrity measurement of a user space process. The peripheral device determines an expected state of the user space process based on the expected integrity measurement. Among potential advantages, credentials of the user space process can be securely managed by the peripheral device in a manner that allows revocation of the credentials of an untrusted user space process without human intervention.

[0166] The detailed description set forth herein references the accompanying drawings. Whenever possible, the same reference numbers are used in the drawings and the prior description to refer to the same or like parts. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only. Although several examples are described in this document, modifications, adaptations, and other embodiments are possible. Accordingly, the detailed description does not limit the disclosed examples. Instead, the proper scope of the disclosed examples may be defined by the appended claims.

[0167] The terminology used herein is for the purpose of describing particular examples only and is not intended to be limiting. As used herein, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. As used herein, the term "plurality" is defined as two or more than two. As used herein, the term "another" is defined as at least a second or more. As used herein, the term "connected" is defined as directly connected without any intervening element or indirectly connected with at least one intervening element, unless otherwise stated. Two elements may be mechanically coupled, electrically coupled, or communicatively linked by a communication channel, path, network, or system. As used herein, the term "and / or" refers to and encompasses any and all possible combinations of the associated listed items. It will also be understood that although the terms first, second, third, etc. may be used herein to describe various elements, these elements should not be limited by these terms, as these terms are only used to distinguish one element from another, unless otherwise stated or the context indicates otherwise. As used herein, the term "includes" means including but not limited to, and the term "including" means including but not limited to. The term "based on" means at least partially based on.

[0168] Although the present disclosure has been described with respect to a limited number of embodiments, those skilled in the art who benefit from the present disclosure will appreciate many modifications and variations of the present disclosure. The appended claims are intended to cover all such modifications and variations.

Claims

1. A non-transitory machine-readable storage medium storing machine-readable instructions that, when executed by a peripheral device, cause the peripheral device to perform the following operations: Communicate with an operating system-based kernel of a host; Receive an integrity measure of a user space process of the host from the operating system kernel; Verify whether a first state of the user space process corresponds to an expected state of the user space process based on the integrity measure; And In response to verifying that the first state corresponds to the expected state, communicate with the kernel to provision authentication credentials for the user space process, thereby allowing the user space process to use services provided by the peripheral device.

2. The non-transitory machine-readable storage medium according to claim 1, wherein: The instructions, when executed by the peripheral device, further cause the peripheral device to establish a communication channel with the host, wherein establishing the communication channel includes authenticating the user space process by the peripheral device based on the credentials.

3. The non-transitory machine-readable storage medium according to claim 1, wherein, The instructions, when executed by the peripheral device, further cause the peripheral device to perform the following operations: Send a request for an updated integrity measure of the user space process to the kernel; and Selectively revoke the credentials based on a response to the request.

4. The non-transitory machine-readable storage medium according to claim 3, wherein, The instructions, when executed by the peripheral device, further cause the peripheral device to perform the following operations: Receive the updated integrity measure in response to the request; Determine an updated state of the user space process based on the updated integrity measure; Verify whether the updated state corresponds to the expected state; And Revoke the credentials in response to the updated state not corresponding to the expected state.

5. The non-transitory machine-readable storage medium according to claim 3, wherein, The instructions, when executed by the peripheral device, further cause the peripheral device to revoke the credentials in response to the peripheral device not receiving the updated integrity measure within an expected time interval associated with the sending of the request.

6. The non-transitory machine-readable storage medium according to claim 5, wherein, The instructions, when executed by the peripheral device, further cause the peripheral device to revoke at least one other credential associated with at least one other user space process in response to the peripheral device not receiving the updated integrity measure within the expected time interval.

7. A computer platform, comprising: A host including a hardware processor for executing machine-readable instructions associated with an operating system kernel, wherein the kernel is configured to measure user space processes at different times to provide a time series of integrity measures; and A peripheral device for performing the following operations: Authenticate the user space process based on credentials assigned to the user space process; Receive the integrity measure; For each integrity measure among the integrity measures, verify whether the state of the user space process corresponds to an expected state of the user space process to provide a corresponding verification result; and Manage the credentials based on the verification result.

8. The computer platform according to claim 7, wherein, The peripheral device is further configured to perform the following operations: Send a one-time number to the kernel at corresponding times according to a predetermined schedule; and Control the validity of the credentials in response to the sending of the one-time number.

9. The computer platform according to claim 8, wherein, The peripheral device is used to further perform the following operations: Send a given one-time number among the one-time numbers, wherein it is expected that the kernel responds to the sending of the given one-time number with an expected value obtained by applying a predetermined function to the given one-time number; Receive a second value from the kernel in response to the sending of the given one-time number; Determine that the second value does not correspond to the expected value; and Revoke the credential in response to determining that the second value does not correspond to the expected value.

10. The computer platform according to claim 8, wherein, The peripheral device is used to further perform the following operations: Send a given one-time number among the one-time numbers, wherein it is expected that the kernel responds to the sending of the given one-time number within a predetermined time interval; Determine that the kernel fails to respond to the sending of the given one-time number within the predetermined time interval; and Revoke the credential in response to determining that the kernel fails to respond to the sending of the given one-time number within the predetermined time interval.

11. The computer platform according to claim 7, wherein, The peripheral device includes a baseboard management controller, a smart input / output (I / O) peripheral device, or a graphics processing unit (GPU).

12. A method, comprising: Provisioning a credential for a user space process by a peripheral device; Authenticating the user space process by the peripheral device based on the credential; Providing an integrity measure of the user space process by an agent based on an operating system kernel to the peripheral device; Determining an observed state of the user space process by the peripheral device based on the integrity measure; Verifying by the peripheral device whether the observed state corresponds to an expected state of the user space process; And Revoking the credential by the peripheral device in response to the observed state not corresponding to the expected state.

13. The method according to claim 12, further comprising: Providing an initial integrity measure of the user space process by the agent based on the operating system kernel to the peripheral device; And Determining the expected state by the peripheral device based on the initial integrity measure.

14. The method according to claim 12, further comprising: Provisioning an inventory for the peripheral device, the inventory including data representing an expected integrity measure of the user space process; And Determining the expected state by the peripheral device based on the expected integrity measure.

15. The method according to claim 12, wherein, Verifying whether the observed state corresponds to the expected state includes the peripheral device determining whether a value corresponding to an attribute of the user space process other than the hash of the content in the memory associated with the user space process is different from the expected value of the attribute.

16. The method according to claim 15, wherein, The attribute includes at least one of a process path, a name of an executable file corresponding to the user space process, arguments passed in a call to the file, an environment variable, a size of a text segment in the memory associated with the user space process, or a permission associated with the text segment in the memory associated with the user space process.

17. The method according to claim 12, wherein, Verifying whether the observed state corresponds to the expected state includes determining, by the peripheral device, whether a measure of invariant content associated with a library dynamically linked to the user space process is different from an expected measure of the invariant content of the user space process.

18. The method according to claim 12, further comprising: measuring, by the operating system kernel-based agent, memory content associated with the user space process and expected to be invariant; and determining, by the operating system kernel-based agent, the integrity measure based on the result of the measurement.

19. The method according to claim 12, further comprising: measuring, by the operating system kernel-based agent, content associated with a library dynamically linked to the user space process; and determining, by the operating system kernel-based agent, the integrity measure based on the result of the measurement.

20. The method according to claim 12, wherein, Provisioning the credential includes: allocating, by the peripheral device, a permission to the credential; and associating, by the peripheral device, the permission with the expected state.

Images