Cryptographically implemented device data restrictions

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for cryptographically implemented data restrictions. One of the methods includes receiving a data access request prompted by user interaction on an application executing on the client device; transmitting an attestation nonce request to a secure processor of the client device; generating a cryptographic key pair and an attestation nonce; transmitting data comprising (i) the public key from the cryptographic key pair and (ii) the generated attestation nonce; validating an attestation packet received from the server in response to the transmission of the data; in response to validating the attestation packet, transmitting data restrictions specified by the user of the client device; generating a signed policy including the data restrictions; and transmitting the signed policy to the server specifying the data restrictions for the server to abide by.

Images