Trusted License Agent Secure Enclave Server Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for secure access to remote servers are inadequate as they cannot assure the authenticity of client applications, particularly when the client device may be compromised by malware or unauthorized entities.
Innovation Solution
A system that employs a trusted license agent loaded into a secure enclave on client computing devices, which performs remote attestation to prove its integrity and authenticity, establishing a secure connection with the server and verifying user and machine identities to ensure authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure processing environment (secure enclave) is used to protect digital information, then security and authenticity of client applications are improved, but device complexity increases
Solution Approach 1:
The license agent is nested within the secure enclave, creating a hierarchical security structure where the secure enclave contains the license agent, which in turn contains the protected code. This nesting allows the security functionality to be embedded within the existing device architecture without requiring a completely separate complex system.
Solution Approach 2:
The license agent acts as an intermediary between the protected code and the secure enclave. It receives code from the code provider, stores it in the secure enclave, and manages the execution rights. This intermediary layer simplifies the interaction between different security components and makes the system more manageable.
2Reliability
If remote attestation is performed to verify integrity of secure enclave, then security authentication is improved, but communication overhead and processing time increase
Solution Approach 1:
The system performs preliminary actions by pre-establishing trust relationships and pre-configuring the secure enclave with the necessary attestation capabilities. The license agent is pre-loaded with the code and configured to perform attestation, so when execution is needed, the process can proceed more efficiently without requiring all verification steps to be performed from scratch.
3Object-affected harmful factors
If the license agent stores and executes protected code in the secure enclave, then protection against malware is improved, but memory resources and processing capacity are consumed
Solution Approach 1:
The license agent extracts and stores only the essential protected code and its execution rights in the secure enclave, rather than storing all possible code and data. This selective extraction reduces the memory footprint and processing resources required while maintaining effective protection against malware for the specific code that needs to be executed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Technologies for secure server access include a client computing device that loads a license agent into a secure enclave established by a processor of the client computing device. The license agent receives a request from an application to access a remote server device. The license agent opens a secure connection with the server device and performs remote attestation of the secure enclave. The license agent authenticates the user and transmits a machine identifier and a user identifier to the server device. The machine identifier may be based on an enclave sealing key of the client computing device. The server device verifies that the machine identifier and the user identifier are bound to a valid application license. If the machine identifier and the user identifier are successfully verified, the application communicates with the server device using the secure connection. Other embodiments are described and claimed.