Privacy protected input-output port control

Systems and techniques for privacy protected input-output port control are described herein. In an example, an indication may be obtained that a protected port is disabled. A set of application attributes stored in a secure memory location may be compared to a set of attested application attributes to create a verification flag. At least one port attribute of the protected port may be obtained based on the verification flag. The protected port may be enabled using the at least one port attribute. Other examples, for controlling an input-output port using computer firmware and trusted execution techniques are further disclosed.

BACKGROUND

Biometric security uses a unique biological element of a user to confirm the user's identity. The unique biological elements may be desirable targets for theft as they may be used to spoof the identity of a user allowing an attacker to gain access to sensitive data. Malware is sometimes used to steal private data such as the unique biological elements. Software may attest that it is not malware or the user may be asked to verify software access to personal data. However, these methods may be subject to circumvention.

DETAILED DESCRIPTION

Biometric authentication may access user information that the user may consider private. For example, the iris of the user's eye may be used as a biometric identifier. The iris, much like a fingerprint, has a high degree of uniqueness making it a reliable source of identity. The user may wish to keep such personally identifiable information private.

An infrared (IR) image of the user's iris may not be easily available by techniques outside of a user device that captures the user's iris using an IR image. The user may wish to be protected from malware capturing this information without user knowledge. A typical user may not be sophisticated enough to distinguish between a good software stack and malware that mimics a user interface. In an example, An imaging device (e.g., camera, scanner, etc.) may be connected to, for example, a Universal Serial Bus (USB) port and/or a mobile industry processor interface alliance (MIPI) port (e.g., Camera Serial Interface, etc.). Software-based techniques may be used to determine the integrity of the operating system hosting the imaging device. However, the software may not be able to establish its own integrity leaving open the possibility that the software and/or operating system are compromised rendering this approach unreliable. Other existing solutions may include some user interaction where the user may be asked to determine the integrity of the software platform. However, attackers may employ social engineering techniques to trick the user into verifying the integrity of the software platform.

The presently disclosed configurations allow the device to protect the user from malware. In an example, the presently disclosed configurations use a combination of hardware, firmware, and software components that limit user interaction to address these issues by enabling the IR camera only after the software platform has been verified. Original equipment manufacturer (OEM) (e.g., computer manufacturer, integrated circuit manufacturer, etc.) configuration information obtained through computing system firmware (e.g., a basic input-output system (BIOS), unified extensible firmware interface (UEFI), etc.) may be used to describe which input-output port supports a privacy protected imaging device.

The input-output port may be disabled by the computing system firmware during boot to protect the input-output port until the integrity of the software platform may be verified. Once a verified software stack is up and running, software running inside a Trusted Execution Environment (TEE) may use trusted platform module (TPM) measurements to verify the integrity of the software stack. The TEE may communicate with a converged security management engine firmware (CSME FW) using hardware hooks to enable the CSME FW to enable the port. This technique may simplify the manufacturing flow for the OEM to configure the camera port as the OEM may only specify which port is identified for privacy protection. In addition, this technique may prevent attackers from compromising the software stack hosting the imaging device and obtaining the user's private data.

Various approaches to implement the TEE may be used depending on the relevant hardware architecture. For example, ARM®-based processor architectures may implement a TEE using TrustZone® technology features, so that the integrity of the software platform may be verified before an input-output port is enabled thereby securing the input collected from a device connected to the port from attack. Also for example, Intel®-based processor architectures may implement the TEE using Software Guard Extensions (SGX) features such as secure enclaves.

FIG. 1illustrates an environment100including an input-output privacy engine108for privacy protected input-output port control, according to an embodiment.

A user104may wish to use a biometric identifier (e.g., iris, fingerprint, etc.) to authenticate with a system (e.g., computing device, software application, access control system, etc.). For example, the user104may wish to login to device102using an image capture from her iris106. Biometric identifiers may be high risk targets for attackers due to their high level of uniqueness. Attackers may employ various techniques such as, for example, malicious software or social engineering tactics, to obtain biometric identifiers of the user104so the identifier can be used to gain unauthorized access to systems on which the user104has been granted access.

The threat of these attacks may be reduced by verifying the integrity of the software platform (e.g., operating system, software application, etc.) that controls the processing of a device used to collect biometric identifiers. The threat can be further reduced by performing the verification in a trusted environment that prevents outside access to the verification process. In addition, by limiting interaction of the user, the threat posed by social engineering techniques is reduced.

The environment100includes a device (e.g., computing device, mobile device, smartphone, internet of things (IoT) device, etc.)102communicatively coupled via a port (e.g., USB, MIPI, etc.) to an imaging device122(e.g., camera, scanner, etc.). The imaging device122is used to capture the biometric identifier of the user104, for example, the106. The device102includes an input-output privacy engine108. In an example, the port is a hardware device coupled integrated into the device102.

The input-output privacy engine108includes a secure memory110providing a trusted execution environment, such as a secure enclave. For example, a secure enclave may be configured as a secure segment of memory enabling protected execution of a set of executable code unsecured access outside the secure memory110. The secure memory110includes a platform attestation enclave112that is used for securely executing code for verifying and/or attesting to the integrity of a software platform.

The secure memory110also includes a platform service enclave114that is used for securely executing code for requesting services (e.g., input-output port activation requests) provided by the software platform. The secure memory110, platform attestation enclave112, and platform services enclave114are described in more detail inFIG. 2.

The input-output privacy engine108includes a security manager118that enables and/or disables connectivity on an input-output port of the device102. The security manager118is described in more detail inFIG. 2.

The input-output privacy engine108may include a trusted platform module (TPM)120that may collect measurements for the platform that may be used to verify and/or attest to the integrity of the software platform. For example, the TPM may collect measurements from a known good (e.g., trusted) copy of the software platform which may then be compared to measurements of the software platform loaded in the platform attestation enclave112. The TPM120is described in more detail inFIG. 2.

The input-output privacy engine108may communicate with an external attestation server (e.g., attestation server of a cloud based software attestation service, third party software provider, etc.)116that may be used to collect the measurements for the known good copy of the software platform. In an example, periodic updates may be received from the attestation server that may include whether older versions of the software platform have been revoked. The attestation server116is described in more detail inFIG. 2.

FIG. 2illustrates an example of a system200for privacy protected input-output port control, according to an embodiment. The system200includes components of the input output privacy engine108as described inFIG. 1.

The system200includes a processor202that is communicatively coupled to a computing system firmware204. In an example, the computing system firmware (e.g., a basic input-output system (BIOS), unified extensible firmware interface (UEFI), etc.)204causes the transmission of a port control message224to a port register206to disable an input-output port (e.g., a Universal Serial Bus (USB) port of an extensible host controller, etc.). In another example, the computing system firmware204causes the transmission of a lane control message226to a lane register208to disable a lane of a channel corresponding to an input-output port (e.g., a lane of a channel corresponding with a Camera Serial Interface port, Serial Peripheral Interface, etc.).

In an example, the OEM may include (e.g., per-program) configuration information in the computing system firmware204establishing which port or lane contains a privacy-protected port and a corresponding port control message224or lane control message226is sent to disable the port and/or lane based on this configuration information. For example, during manufacturing, a smartphone OEM may configure the computing system firmware204to identify a camera port for protection and a privacy policy for the camera port. The smartphone OEM may also provide information in the computing system firmware204to send the configuration information of the privacy protected camera port.

The configuration information may include information necessary to enable and/or disable a port. For example, an extensible host controller (XHCI) may support a write-once register (e.g., port register206) that allows it to be written from the computing system firmware204. This register can be used to enable/disable each individual physical port by writing a 1 or a 0 on the port. Ports may be enabled by default and disabled when a 0 is written by the computing system firmware204. This allows the computing system firmware204to lock the physical port that it would like to privacy protect during power on process. Once locked another reset may be performed to unlock the port.

For example, a MIPI Controller supports “n” lanes which are configured by the computing system firmware204in “m” ports. As a result, when a specific port is to be disabled, all the lanes associated with that port would need to be individually disabled. The configuration information in the computing system firmware204may include the information from the OEM for lane assignment to individual ports. The new register is written once from the computing system firmware204and may include a granularity of “n” bits to allow individual enable/disable of each lane.

The processor202is communicatively coupled to secure memory110via a secure communication channel. In an example, the communication between the processor202and the secure memory110is encrypted. In an example, the secure memory and the processor may create a trusted execution environment (TEE) used to run application code and load application data protected from malicious applications. In an example, the processor may encrypt application code and application data directed towards secure memory to be protected from outside access. In an example, the secure memory includes secure memory areas or enclaves. In an example, the application code and the application data may each be loaded in a separate enclave.

The secure memory110is communicatively coupled to a trusted platform module (TPM)120. The TPM120may include a crypto-processor that can be used to store measurements of the software loaded on the platform during boot sequence into Platform Configuration Registers (PCRs) embedded inside the TPM. In an example, the TPM120may generate a quote of the stored PCR measurements using a hash key provided by the Platform Attestation Enclave (PAE)112. These measurements may represent a summary of a hardware and software configuration of a computing device. In an example, the PAE112may use the PCR measurements to validate the event log generated during the boot sequence. The event log may contain security version number of the software. The PAE112may compare the security version number with the security version number of a known good software and hardware combination to verify the integrity of the computing platform. In an example, the PAE112may make measurements from the TPM120. In an example, the PAE112may obtain a platform software version and may determine if the platform software version is the same as the latest known good version of the software platform.

In an example, the PAE112may obtain TPM120platform configurations register (PCR) measurements of the software that boots on the platform. The PAE112may compare the known good set of TPM120PCR measurements that indicate that the software running on the platform is capable of properly privacy protecting the imaging device122from malware resident in RING0(e.g., execution of operating system kernel) and RING3(e.g., execution of applications).

In some examples, the system200may include an attestation server116. In an example, the attestation server may be provided by a third-party software provider. In an example, PAE112sends a message to the attestation server116to determine if the software security version has been revoked. In an example, the message may be sent on a weekly basis. In an example, the PAE may determine the integrity of the software based at least in part on a response received from the attestation server116.

The trusted execution environment which includes the processor202and secure memory110may also include a platform services enclave (PSE)114. The PSE114may receive an indication of the integrity of the software platform from the PAE112. In an example, the PSE114may determine the integrity of the software platform using data received from the PAE112. In an example, The PSE112may use information received from other enclaves or external servers to make the determination.

The system200includes a security manager118that is communicatively coupled with the PSE114via a secure communication channel218. In an example, the secure communication channel may encrypt and or sign the communication between the PSE114and the security manager118. In an example, the security manager is implemented in firmware running on a security co-processor of a computing device.

The security manager118may send a port control message228to the port register206to enable the input-output port and/or sends a lane control message230to the lane register208to enable the lane of the channel corresponding to the input-output port. Thus, the same register(s), port register206and/or lane register208used by the computing system firmware204to block the port are used by the security manager118to unblock the port.

For example, at boot of the device, the computing system firmware204may begin execution and disable the port based on the settings provided by the OEM. The computing system firmware204may send the information indicating that the port is disabled to the security manager118(e.g., using a host embedded controller interface (HECI) message, etc.). After the computing system firmware204completes execution, the operating system boots. It is unknown at this point whether the operating system is good or bad (e.g., compromised, malicious, etc.). The PAE112starts, makes measurements from the TPM120, retrieves the operating system security version, validates the running operating system is the same as the latest known good security version, and determines whether the operating system is good or bad.

In an example, the PAE112communicates with the PSE114. The PSE114communicates with the security manager118which includes a platform services dynamic application loader applet (PSDA). The PSDA communicates with the PSE114to read which port should be enabled and to write to the port register206and/or the lane register208to enable the port. After the device is booted the platform attestation enclave112contacts the attestation server116periodically (e.g., weekly, etc.) to make sure that the operating system security version is not revoked. The security manager118determines if a port should be enabled using the software integrity information returned from PAE114. In an example, the security manager obtains an indication of the integrity of the software platform from the PSE114. In an example, the port is enabled based on the indication. In an example, the security manager118enables the port when it receives proper health attestation of the software stack running on the platform.

It will be understood that the system200may be extended to additional input-output mechanisms in which a user desires privacy. By way of example and not limitation, the system200may be used for fingerprint controllers operating on a Serial Peripheral Interface port (SPI), near-field communication (NFC) card readers interfacing with an input-output port, or any other input-output mechanism that the user wishes to operate only if trusted software is running on the platform. In some examples, the user may be provided an option to enable or disable a specific input-output port if the capability has not been provided by the OEM. For example, an application may be provided that to the user that is capable of writing a 0 to the port register of USB port 0 to disable USB port 0 at boot. The security manager118may obtain the indication from the software and verify the integrity of the running operating system before enabling the port.

In some examples, an indication is obtained within programming of the computing system to indicate that a protected port is disabled. In an example, the indication that the protected port is disabled is received from a computing system firmware. In an example, the indication that the protected port is disabled is obtained from a host embedded controller interface message. In an example, the protected port is a Universal Serial Bus port. In an example, the protected port is a Camera Serial Interface port. In an example, the protected port is a Serial Peripheral Interface port. For example, an indication in the computing system firmware204that USB port 0 is disabled may be received by the security manager118.

A set of application attributes stored in a secure memory location may be compared to a set of attested application attributes to create a verification flag. In an example, the set of attested application attributes is obtained from a trusted platform module. In an example, the set of attested application attributes is obtained from an attestation server. In an example, the set of application attributes and the set of attested application attributes may include an application security version number. In an example, the set of application attributes may include a first signature of a running application and the set of attested application attributes may include a second signature of a known trusted application and the first signature is compared to the second signature to create the verification flag. For example, the TPM120may create a hash value of the running operating system and the hash of the running operating system may be compared to a hash of a known good copy of the operating system to determine the integrity of the running operating system.

At least one port attribute of the protected port may be obtained based on the verification flag. In an example, the at least one port attribute may include a port register of the protected port. In an example, the at least one port attribute may include a lane register. For example, the protected port may be USB port 0 with an associated port register.

The protected port may be enabled using the at least one port attribute. In an example, enabling the protected port may include write a value to the port register. In an example, enabling the protected port may include write a value to the lane register. For example, the security manager118may write a 1 to the port register of USB port 0 to enable the port.

FIG. 3illustrates an example of a method300for privacy protected input-output port control, according to an embodiment.

At operation302, method300obtains an indication that a protected port is disabled. In an example, the indication that the protected port is disabled is received from a computing system firmware (e.g., a basic input-output system (BIOS), unified extensible firmware interface (UEFI), etc.). In an example, the indication that the protected port is disabled is obtained from a host embedded controller interface message. In an example, the protected port is a Universal Serial Bus port. In an example, the protected port is a Camera Serial Interface port. In an example, the protected port is a Serial Peripheral Interface port.

At operation304, method300compares a set of application attributes stored in a secure memory location to a set of attested application attributes to create a verification flag. In an example, the set of attested application attributes is obtained from a trusted platform module. In an example, the set of attested application attributes is obtained from an attestation server. In an example, the set of application attributes and the set of attested application attributes may include an application version number. In an example, the set of application attributes may include a first signature of a running application and the set of attested application attributes may include a second signature of a known trusted application and the first signature is compared to the second signature to create the verification flag.

At operation306, method300obtains at least one port attribute of the protected port based on the verification flag. In an example, the at least one port attribute may include a port register of the protected port. In an example, the at least one port attribute may include a lane register.

At operation308, method300enables the protected port using the at least one port attribute. In an example, enabling the protected port may include write a value to the port register. In an example, enabling the protected port may include write a value to the lane register.

Machine (e.g., computer system)400may include a hardware processor402(e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memory404and a static memory406, some or all of which may communicate with each other via an interlink (e.g., bus)408. The machine400may further include a display unit410, an alphanumeric input device412(e.g., a keyboard), and a user interface (UI) navigation device414(e.g., a mouse). In an example, the display unit410, input device412and UI navigation device414may be a touch screen display. The machine400may additionally include a storage device (e.g., drive unit)416, a signal generation device418(e.g., a speaker), a network interface device420, and one or more sensors421, such as a global positioning system (GPS) sensor, compass, accelerometer, or other sensor. The machine400may include an output controller428, such as a serial (e.g., Universal Serial Bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate or control one or more peripheral devices (e.g., a printer, card reader, etc.).

The storage device416may include a machine readable medium422on which is stored one or more sets of data structures or instructions424(e.g., software) embodying or utilized by any one or more of the techniques or functions described herein. The instructions424may also reside, completely or at least partially, within the main memory404, within static memory406, or within the hardware processor402during execution thereof by the machine400. In an example, one or any combination of the hardware processor402, the main memory404, the static memory406, or the storage device416may constitute machine readable media.

While the machine readable medium422is illustrated as a single medium, the term “machine readable medium” may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) configured to store the one or more instructions424.

ADDITIONAL NOTES & EXAMPLES

Example 1 is a method to implement protected input-output port control, comprising electronic operations, which when performed by circuitry of a computing device, causes the computing device to perform the electronic operations including: obtaining an indication that a protected input-output port is disabled; comparing a set of application attributes stored in a secure memory location to a set of attested application attributes to create a verification flag; obtaining at least one port attribute of the protected input-output port based on the verification flag; and enabling the protected input-output port using the at least one port attribute.

In Example 2, the subject matter of Example 1 optionally includes, wherein the indication that the protected input-output port is disabled is received from a computing system firmware.

In Example 3, the subject matter of any one or more of Examples 1-2 optionally include, wherein the indication that the protected input-output port is disabled is obtained from a host embedded controller interface message.

In Example 4, the subject matter of any one or more of Examples 1-3 optionally include, wherein the set of attested application attributes is obtained from a trusted platform module.

In Example 5, the subject matter of any one or more of Examples 1-4 optionally include, wherein the set of attested application attributes is obtained from an attestation server.

In Example 6, the subject matter of any one or more of Examples 1-5 optionally include, wherein the set of application attributes and the set of attested application attributes includes an application version number.

In Example 7, the subject matter of any one or more of Examples 1-6 optionally include, wherein the set of application attributes includes a first signature of a running application and the set of attested application attributes includes a second signature of a known trusted application, and wherein the first signature is compared to the second signature to create the verification flag.

In Example 8, the subject matter of any one or more of Examples 1-7 optionally include, wherein the at least one port attribute includes a port register of the protected input-output port.

In Example 9, the subject matter of Example 8 optionally includes, wherein enabling the protected input-output port includes writing a value to the port register.

In Example 10, the subject matter of any one or more of Examples 1-9 optionally include, wherein the at least one port attribute includes a lane register of the protected input-output port.

In Example 11, the subject matter of Example 10 optionally includes, wherein enabling the protected input-output port includes writing a value to the lane register.

In Example 12, the subject matter of any one or more of Examples 1-11 optionally include, wherein the protected input-output port is a Universal Serial Bus port.

In Example 13, the subject matter of any one or more of Examples 1-12 optionally include, wherein the protected input-output port is a Camera Serial Interface port.

In Example 14, the subject matter of any one or more of Examples 1-13 optionally include, wherein the protected input-output port is a Serial Peripheral Interface port.

Example 15 is a system to implement protected input-output port control, the system comprising means to perform any method of Examples 1-14.

Example 16 is a machine readable medium to implement protected input-output port control, the machine readable medium including instructions that, when executed by a machine, cause the machine to perform any method of Examples 1-14.

Example 17 is a computing apparatus to implement protected input-output port control, the computing apparatus comprising: a processor; a memory; a protected input-output port; and a security management component operably coupled to the processor and memory, the security management component configured to: obtain an indication that the protected input-output port is disabled; compare a set of application attributes stored in a secure memory location of the memory to a set of attested application attributes to create a verification flag; obtain at least one port attribute of the protected input-output port based on the verification flag; and enable the protected input-output port using the at least one port attribute.

In Example 18, the subject matter of Example 17 optionally includes, wherein the indication that the protected input-output port is disabled is received from a computing system firmware.

In Example 19, the subject matter of any one or more of Examples 17-18 optionally include, wherein the indication that the protected input-output port is disabled is obtained from a host embedded controller interface message.

In Example 20, the subject matter of any one or more of Examples 17-19 optionally include, wherein the set of attested application attributes is obtained from a trusted platform module.

In Example 21, the subject matter of any one or more of Examples 17-20 optionally include, wherein the set of attested application attributes is obtained from an attestation server.

In Example 22, the subject matter of any one or more of Examples 17-21 optionally include, wherein the set of application attributes and the set of attested application attributes includes an application version number.

In Example 23, the subject matter of any one or more of Examples 17-22 optionally include, wherein the set of application attributes includes a first signature of a running application and the set of attested application attributes includes a second signature of a known trusted application, and wherein the first signature is compared to the second signature to create the verification flag.

In Example 24, the subject matter of any one or more of Examples 17-23 optionally include, wherein the at least one port attribute includes a port register of the protected input-output port.

In Example 25, the subject matter of Example 24 optionally includes, the security management component further to write a value to the port register.

In Example 26, the subject matter of any one or more of Examples 17-25 optionally include, wherein the at least one port attribute includes a lane register.

In Example 27, the subject matter of Example 26 optionally includes, the security management component further to write a value to the port register write a value to the lane register.

In Example 28, the subject matter of any one or more of Examples 17-27 optionally include, wherein the protected input-output port is a Universal Serial Bus port.

In Example 29, the subject matter of any one or more of Examples 17-28 optionally include, wherein the protected input-output port is a Camera Serial Interface port.

In Example 30, the subject matter of any one or more of Examples 17-29 optionally include, wherein the protected input-output port is a Serial Peripheral Interface port.

In Example 31, the subject matter of any one or more of Examples 17-30 optionally include, further comprising a device connected via the protected input-output port.

Example 32 is a non-transitory computer-readable storage medium to implement protected input-output port control, the computer-readable storage medium including instructions that when executed by a computer, cause the computer to: obtain an indication that a protected input-output port is disabled; compare a set of application attributes stored in a secure memory location to a set of attested application attributes to create a verification flag; obtain at least one port attribute of the protected input-output port based on the verification flag; and enable the protected input-output port using the at least one port attribute.

In Example 33, the subject matter of Example 32 optionally includes, wherein the indication that the protected input-output port is disabled is received from a computing system firmware.

In Example 34, the subject matter of any one or more of Examples 32-33 optionally include, wherein the indication that the protected input-output port is disabled is obtained from a host embedded controller interface message.

In Example 35, the subject matter of any one or more of Examples 32-34 optionally include, wherein the set of attested application attributes is obtained from a trusted platform module.

In Example 36, the subject matter of any one or more of Examples 32-35 optionally include, wherein the set of attested application attributes is obtained from an attestation server.

In Example 37, the subject matter of any one or more of Examples 32-36 optionally include, wherein the set of application attributes and the set of attested application attributes includes an application version number.

In Example 38, the subject matter of any one or more of Examples 32-37 optionally include, wherein the set of application attributes includes a first signature of a running application and the set of attested application attributes includes a second signature of a known trusted application, and wherein the first signature is compared to the second signature to create the verification flag.

In Example 39, the subject matter of any one or more of Examples 32-38 optionally include, wherein the at least one port attribute includes a port register of the protected input-output port.

In Example 40, the subject matter of Example 39 optionally includes, wherein the instructions to enable the protected input-output port include instructions to write a value to the port register.

In Example 41, the subject matter of any one or more of Examples 32-40 optionally include, wherein the at least one port attribute includes a lane register of the protected input-output port.

In Example 42, the subject matter of Example 41 optionally includes, wherein the instructions to enable the protected input-output port include instructions to write a value to the lane register.

In Example 43, the subject matter of any one or more of Examples 32-42 optionally include, wherein the protected input-output port is a Universal Serial Bus port.

In Example 44, the subject matter of any one or more of Examples 32-43 optionally include, wherein the protected input-output port is a Camera Serial Interface port.

In Example 45, the subject matter of any one or more of Examples 32-44 optionally include, wherein the protected input-output port is a Serial Peripheral Interface port.

Example 46 is a system to implement protected input-output port control, the system comprising: means for obtaining an indication that a protected input-output port is disabled; means for comparing a set of application attributes stored in a secure memory location to a set of attested application attributes to create a verification flag; means for obtaining at least one port attribute of the protected input-output port based on the verification flag; and means for enabling the protected input-output port using the at least one port attribute.

In Example 47, the subject matter of Example 46 optionally includes, further comprising: means for receiving the indication that the protected input-output port is disabled is received from a basic input output system.

In Example 48, the subject matter of any one or more of Examples 46-47 optionally include, further comprising: means for obtaining from a host embedded controller interface message the indication that the protected input-output port is disabled.

In Example 49, the subject matter of any one or more of Examples 46-48 optionally include, further comprising: means for obtaining from a trusted platform module the set of attested application attributes.

In Example 50, the subject matter of any one or more of Examples 46-49 optionally include, further comprising: means for obtaining from an attestation server the set of attested application attributes.

In Example 51, the subject matter of any one or more of Examples 46-50 optionally include, wherein the set of application attributes and the set of attested application attributes includes an application version number.

In Example 52, the subject matter of any one or more of Examples 46-51 optionally include, wherein the set of application attributes includes a first signature of a running application and the set of attested application attributes includes a second signature of a known trusted application, and wherein the first signature is compared to the second signature to create the verification flag.

In Example 53, the subject matter of any one or more of Examples 46-52 optionally include, wherein the at least one port attribute includes a port register of the protected input-output port.

In Example 54, the subject matter of Example 53 optionally includes, wherein the means for enabling the protected input-output port includes means for writing a value to the port register.

In Example 55, the subject matter of any one or more of Examples 46-54 optionally include, wherein the at least one port attribute includes a lane register of the protected input-output port.

In Example 56, the subject matter of Example 55 optionally includes, wherein the means for enabling the protected input-output port includes means for writing a value to the lane register.

In Example 57, the subject matter of any one or more of Examples 46-56 optionally include, wherein the protected input-output port is a Universal Serial Bus port.

In Example 58, the subject matter of any one or more of Examples 46-57 optionally include, wherein the protected input-output port is a Camera Serial Interface port.

In Example 59, the subject matter of any one or more of Examples 46-58 optionally include, wherein the protected input-output port is a Serial Peripheral Interface port.

In Example 60, the subject matter of any one or more of Examples 46-59 optionally include, further comprising a device connected via the protected input-output port.