Fingerprint revocation

Systems and methods for fingerprint revocation are described. In some embodiments, an Information Handling System (IHS) may include: a processor; and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: identify an endpoint device; and transmit a key management command to the endpoint device over a network, where the endpoint device includes a host processing system and an off-host processing system segregated from the host processing system, where the off-host processing system includes an off-host processor and an off-host memory coupled to the off-host processor, where the off-host memory includes Personal Identifiable Information (PII) encrypted with a master key, and where the off-host processor is configured to change a status of the master key in response to having received the key management command.

FIELD

This disclosure relates generally to Information Handling Systems (IHSs), and more specifically, to systems and methods for fingerprint revocation.

BACKGROUND

In some cases, an IHS or some feature thereof may be protected using biometric verification. Generally speaking, biometric verification involves techniques by which a user can be uniquely identified by evaluating one or more of the user's distinguishing biological traits. A record of a user's unique characteristic (e.g., fingerprint, iris, etc.) is captured and kept in the IHS's memory as a reference template.

Later on, when identification verification is required (e.g., when the user wants to log into the IHS, change a configuration setting, etc.), a new template is captured and compared with the reference template. If the newly captured template matches the reference template, the user's identity is confirmed. And, if the user's identity is confirmed, the user is granted access to the IHS or to a subset of its features.

SUMMARY

Embodiments of systems and methods for distributed authorization are described herein. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: identify an endpoint device; and transmit a key management command to the endpoint device over a network, where the endpoint device includes a host processing system and an off-host processing system segregated from the host processing system, where the off-host processing system includes an off-host processor and an off-host memory coupled to the off-host processor, where the off-host memory includes Personal Identifiable Information (PII) encrypted with a master key, and where the off-host processor is configured to change a status of the master key in response to having received the key management command.

In various embodiments, identifying the endpoint device may include receiving an indication, from the endpoint device, that the endpoint device is connected to the network. The key management command may include a revocation command, and the off-host processor may be configured to delete or invalidate the master key in response to having received the revocation command. The master key may have an expiration, the key management command may include a renewal command, and the off-host processor may be configured to reset the expiration in response to having received the renewal command.

In some cases, the PII may include at least one of: username and password, fingerprint data, facial scan data, iris scan data, voice sample data, smartcard data, magnetic card data, or near-field communication (NFC) data. The key revocation command may be transmitted to the endpoint device through an out-of-band channel bypassing the host processing system. The off-host processor may have access to a secondary network controller segregated from a primary network controller coupled to the host processor.

The endpoint device may include an embedded controller coupled to the off-host processing system, the PII may be encrypted with a first key and with the master key prior to being stored in the off-host memory, the first key may be derivable by the embedded controller, and the master key may not be derivable by the embedded controller.

In another illustrative, non-limiting embodiment, an off-host processing system may be coupled to an IHS such that the off-host processing system is segregated from a host processing system, the off-host processing system having an off-host processor and an off-host memory, the off-host memory having program instructions stored thereon that, upon execution by the off-host processor, cause the off-host processor to: store a master key in the off-host memory; receive fingerprint information from a user; encrypt the fingerprint information with the master key; store the encrypted fingerprint information in the off-host memory; receive a key management command over a network; and change a status of the master key in response to the command.

In some cases, receiving the key management command may occur in response to transmitting an indication, to an authentication server, that the IHS is connected to the network. The key management command may include a revocation command, and the off-host processor may be configured to delete or invalidate the master key in response to having received the revocation command. The master key may have an expiration, the key management command may include a renewal command, and the off-host processor may be configured to reset the expiration in response to having received the renewal command.

The key revocation command may be received by the IHS through an out-of-band channel bypassing the host processing system. The off-host processor may have access to a secondary network controller segregated from a primary network controller coupled to the host processor. The IHS may further include an embedded controller coupled to the off-host processing system, where the fingerprint information is encrypted with a first key and with the master key prior to being stored in the off-host memory, where the first key is derivable by the embedded controller, and where the master key is not derivable by the embedded controller.

In yet another illustrative, non-limiting embodiment, in an Information Handling System (IHS) having an off-host processing system, the off-host processing system segregated from a host processing system, the off-host processing system having an off-host processor and an off-host memory, a method may be performed by the off-host processor, the method comprising: receiving a key management command over a network; and changing a status of the master key in response to the command, where the master key is stored in the off-host memory, and where the master key is used by the off-host processor to encrypt fingerprint information stored in the off-host memory.

The key management command may include a revocation command, and the off-host processor may be configured to delete or invalidate the master key in response to having received the revocation command. The master key may have an expiration, the key management command may include a renewal command, and the off-host processor may be configured to reset the expiration in response to having received the renewal command. The key revocation command may be received by the off-host processor through a secondary network controller segregated from a primary network controller coupled to the host processor. The IHS may further include an embedded controller coupled to the off-host processing system, where the fingerprint information is encrypted with a first key and with the master key prior to being stored in the off-host memory, where the first key is derivable by the embedded controller, and where the master key is not derivable by the embedded controller.

DETAILED DESCRIPTION

Systems and methods described herein may provide fingerprint revocation. In various embodiments, a local biometric reference template or any other sensitive data, such as Personal Identifiable Information (PII) sits at rest encrypted with symmetric key, referred to as a “master key,” that is issued by a systems administrator inside an out-of-band and/or always available hardware or cryptographic software secured storage container. The system administrator can revoke the master key in the event that the biometric template is compromised through detecting tampering through software or physically. The user is reissued a new master key and re-enrolls. During login or Next-Generation Data Security (NGDS) data loading, as examples, the candidate template is captured, send to the secure processor. The reference is decrypted with the master key, if still present, and compared to the candidate template in the secure processor. During provisioning, the device ID and user ID are sent to a remote authentication server and a master key is returned to the device secure container (e.g., over a Transport Layer Security or TLS connection). If devices are compromised, template information can no longer be used.

In some embodiments, each user may be issued a master key, which is a unique symmetric encryption key, from the remote authentication server to encrypt local securely stored biometric and PII data. In some cases, the master key can be trusted to be destroyed due to container's high availability, out of band, single developer ownership and post process immunities. As such, techniques described herein may secure against multiple users on single device, rogue employees after termination, mass biometric data leakage, and lost device PII leaks. Moreover biometric and PII are secure for migration and/or roaming.

FIG. 1is a schematic view illustrating an example of an IHS according to some embodiments. As shown, IHS100includes processor102, which is connected to bus104. Bus104serves as a connection between processor102and other components of IHS100. Input device106is coupled to processor102to provide input to processor102. Examples of input devices may include keyboards, touchscreens, pointing devices such as mice, trackballs, and trackpads, and/or a variety of other such devices. Programs and data are stored on mass storage device108, which is coupled to processor102. Examples of mass storage devices may include hard discs, optical disks, magneto-optical discs, solid-state storage devices, and/or a variety other mass storage devices.

IHS100further includes display110, which is coupled to processor102by video controller112. System memory114is coupled to processor102to provide processor102with fast storage to facilitate execution of computer programs. Examples of system memory may include random access memory (RAM) devices such as dynamic RAM (DRAM), synchronous DRAM (SDRAM), solid state memory devices, and/or a variety of other memory devices.

In an embodiment, chassis116houses some or all of the components of IHS100. It should be understood that other buses and intermediate circuits may be deployed between the components described above and processor102to facilitate interconnection between those components and processor102.

Referring now toFIG. 2, an embodiment of environment200where off-host authentication processing system206may be used is illustrated. Environment200includes IHS202, which may be IHS100and/or may include some or all of the components of IHS100. For example, IHS100may be a server IHS, a desktop IHS, a laptop/notebook IHS, a tablet IHS, a mobile phone IHS, and/or a variety of other IHSs. IHS202comprises host processing system204, which in turn comprises host processor204a, host memory204b, and/or other components.

For example, host processor204aof host processing system204may include processor102, whereas host memory204bmay include system memory114. More generally, host processing system204may include a variety of processing systems utilized by IHS202to perform processing operations related to, for example, executing an Operating System (OS) and/or other software applications.

IHS202also comprises embedded controller system210that includes embedded controller processor210a, embedded controller memory210b, and/or other embedded controller components. For example, embedded controller processor210ain embedded controller system210may include a processor, and embedded controller memory210bin embedded controller system210may include a memory device having instructions that, when executed by embedded controller processor210a, cause embedded controller processor210ato perform operations discussed further below.

In the illustrated embodiment, embedded controller processor210ais coupled to off-host processor206avia bus212such as, for example, a Low-Pin Count (LPC) connection. However, bus212may be any variety of physical/logical bus connections that support encrypted communications, including but not limited to, an LPC connection, a USE, a Thunderbolt interface, an I2C, an SPI, a PCI, and/or other bus connections.

IHS202also includes network interface controller214that provides first network controller214a, second network controller214b, and/or other network interface controller components. In some embodiments, network interface controller214is compliant with INTEL CORPORATION's Active Management Technology (AMT) and/or “vPro” technology. In an embodiment, first network controller214ain network interface controller214may be segregated, distinct from, and/or otherwise separate from second network controller214bby assigning to the first network controller214aa first Media Access Control (MAC) address that is different from a second MAC address that is assigned to the second network controller214b. In another embodiment, first network controller214aand second network controller214bmay be segregated from each other in another manner such as, for example, by providing first network controller214aon a different network interface controller than second network controller214b.

Host processor204aof host processing system204is coupled to first network controller214ain network interface controller214via bus216a, and embedded controller processor210ain embedded controller system210is coupled to second network controller214bin network interface controller214via bus216b. In some embodiments, buses216aand216bmay be part of the same bus such as, for example, an I2C connection that couples host processing system204and embedded controller system210to network interface controller214. However, bus214may be any variety of physical/logical bus connections that support encrypted communications, including but not limited to, I2C, USB, Thunderbolt, SPI, PCI, and/or other bus connections.

Host processor204amay be configured to only have access to the first network controller214aby providing host processor204aa first MAC address that is assigned to first network controller214a, while embedded controller processor210amay be configured to only have access to second network controller214bby providing embedded controller processor210aa second MAC address that is assigned to second network controller214b. However, as discussed above, first network controller214aand second network controller214bmay be provided on different network interface controllers such that buses216aand216bare physically separate buses.

IHS202is coupled to off-host authentication processing system206that includes off-host processor206a, off-host memory206b, and/or other off-host processing components. In some cases, off-host authentication processing system206may be physically disposed outside of chassis116—that is, off-host authentication processing system206is not a part of IHS202; and it only coupled to it via bus212. As used herein, the term “off-host” refers to external off-host authentication processing system206being distinct from host processing system204.

Particularly, off-host processor206awithin off-host authentication processing system206may include a secure processor that is segregated, distinct from, and/or otherwise separate from processor102in IHS202, and off-host memory206bwithin external off-host authentication processing system206may include a memory device that is segregated, distinct from, and/or otherwise separate from system memory114in IHS202such that off-host memory206bis accessible by off-host processor206abut not by host processor204a. In an example, off-host authentication processing system206may be provided, at least in part, using a CONTROLVAULT system that is available from DELL, INC.

Authentication system or device209may include, for example, an input device such as a keyboard, a fingerprint reader device or other biometric data reader device, a smart card reader device, an radio frequency identification (RFID) or Near Field Communication (NFC) device that is configured to wirelessly connect to a mobile user device (e.g., a mobile phone), and/or a variety of other authentication devices. Authentication device209may be coupled to off-host processor206in off-host authentication processing system206via USB or Smart Card Interface (SCI) bus209a. However, bus209amay be any variety of physical/logical bus connections including but not limited to, USB, SCI, Thunderbolt, I2C, SPI, PCI, and/or other bus connections.

Each of first network controller214aand second network controller214bis coupled to network218such as, for example, a local area network (LAN), the Internet, and/or a variety of other networks.

Authentication IHS220is coupled to network218. In an embodiment, authentication IHS220may be implemented as IHS100discussed above with reference toFIG. 1and/or may include some or all of the components of IHS100. For example, authentication IHS220may be a server IHS or authentication server that may operates to verify user authentication credential inputs and/or verify authentication tokens. In an embodiment, authentication IHS220is associated with at least one authentication IHS private key and at least one authentication IHS public key. The at least one authentication IHS private key and the at least one authentication IHS public key may be stored in storage device that is accessible by authentication IHS220.

In an embodiment, IHS202is associated with at least one user IHS private key and at least one user IHS public key. The at least one user IHS private key and the at least one user IHS public key may be stored in storage device that is accessible by off-host authentication processing system206. For example, the at least one user IHS private key and the at least one user IHS public key may be stored on off-host memory206b, on host memory204b, and/or in a variety of other user IHS storage locations. Furthermore, the at least one user IHS public key may be shared with other systems such as, for example, authentication IHS220.

Directory system222is also coupled to network218. In an embodiment, directory system222may include an active directory service available from MICROSOFT CORPORATION. For example, directory system222may include an active directory service that is provided on a server IHS and that operates to authenticate and authorize users, assign and enforce security policies, install and update software, and/or perform a variety of other directory system operations.

In an embodiment, network218, authentication IHS220, and directory system222may be controlled by the same entity. For example, a business or government may provide, house, or otherwise maintain control of each of network218, authentication NS220, and directory system222in order to provide an increased level of security using environment200.

In some embodiments, the system ofFIG. 2may be used to perform out-of-band authentication such that a user must authenticate to off-host authentication processing system206in order to access functionality of IHS202that is provided by its host processing system204. The authentication of a user to access the functionality of IHS202is controlled by off-host authentication processing system206, authentication IHS220, and/or directory system222that operate to verify the user and release a token to host processing system204that provides the user access to IHS202.

Particularly, verification of a user may be performed by authentication IHS220such that IHS202never stores authentication credentials for any user, while authentication tokens are encrypted and exchanged between off-host authentication processing system206and authentication IHS220such that authentication IHS220can send an approval message to directory system222to provide for the release of a token to host processing system204that allows a user access to IHS202if they have been validated. Because host processing system204and off-host authentication processing system206need not interact in the out-of-band authentication system, host processing system204and off-host authentication processing system206may be physically segregated (e.g., there may be no communications bus connecting or directly connecting host processing system204and external off-host authentication processing system206) to prevent any access or compromise of host processing system204from enabling an unauthorized user to access functionality of IHS202.

Turning now toFIG. 3, an example of method300for fingerprint revocation is depicted. Prior to the start of method300, there may be a provisioning operation whereby an IT administrator provides master key310to off-host processing system206in a secure manner. For example, master key310may be stored in off-host memory206bbefore IHS202is physically handed to the user. Alternatively, a device ID (e.g., a service tag, etc.) and/or user ID may be sent to authentication server220over the network, and master key310may be returned to IHS202's off-host processing system206(e.g., over a TLS connection).

In the embodiment described inFIG. 3, it is assumed that the provisioning operation has already taken place. For ease of explanation, each operation of method300is shown within the entity that is configured to perform that operation, including IHS202, off-host processing system206, and authentication IHS220.

Method300starts at block301. At block302, IHS202begins a biometric enrollment process and captures biometric data provided by the user. The enrollment process may be required for the user's subsequent login into IHS202and/or to allow the user to access certain features of IHS202. Such an enrollment process may take place, for example, when the user is first handed IHS202(e.g., new hire, replacement device, etc.).

In some cases, block302may be performed by an Operating System (OS) executed by host processing system204of IHS202. In other cases, however, block302may be performed by off-host processing system206.

Blocks303-308are performed by off-host processing system206in order to provide security that would not otherwise be available if only host processing system204were present in IHS202. Particularly, at block303, off-host processing system206processes the biometric or PII data received at block302. For example, in the case of a fingerprint or other biometric data, block303creates a reference template. Block304determines whether the data has been processed. If so, the reference template is saved at block305, and block306closes the enrollment session.

The process of saving the reference template includes determining whether master key310is available within off-host memory206bat block307. If so, the template is encrypted with master key310at block308, and then stored as PII/Bio data309in off-host memory206b.

It should be noted that, in some cases, PII/Bio data309is stored in off-host memory206bin an encrypted form by default. As such, another key (a “first key” or “container key”) may provide an additional level of encryption, wrapping already encrypted information. For example, in some cases, PII/Bio data309may be encrypted with master key310and then with the first key prior to being stored in off-host memory206b. In certain cases, the first key may be derivable by EC system210(e.g., based upon a measured processor characteristic, a voltage within host processor204a, a temperature of host processor204a, and/or a serial number of host processor204a), whereas master key310may not be. Rather, master key310may be a symmetric key provided by authentication IHS220during the provisioning phase for added security.

At this point, IHS202has master key310and PII/Bio data309stored in off-host memory206b. After PII/Bio data309is encrypted with master key310, both master key310and PII/Bio data309may be encrypted with the first or container key.

Later the user may lose IHS202, may leave his or her employment, may suffer a device malfunction that requires IHS202to leave his or her possession, etc. At this point, authentication IHS220may send revocation command311to off-host processing system206through out-of-band interface312. In some cases, receipt of revocation command311may occur in response to off-host processing system206transmitting an indication, to authentication server220, that IHS202is connected to the network. Alternatively, transmission of revocation command311may be initiated by authentication server220in response to authentication server220's own detection that IHS202has a network connection.

Upon receipt of command311, off-host processing system206deletes or invalidates master key310. With master key310now invalidated or deleted from off-host memory206b, PII/Bio data309is no longer retrievable.

It should be noted that, in some situations, master key310may be invalidated or deleted even when the user is still allowed to operate IHS202and/or IHS202is functional. For example, authentication server220may revoke master key310in the event that PII Bio data309is compromised through detecting tampering through software or physically. In those cases, the user may be reissued a new master key and may re-enroll.

Because key revocation command311is transmitted to IHS202through an out-of-band channel, it bypasses host processing system204and therefore is not subject to OS vulnerabilities. As shown inFIG. 2, off-host processor206ahas access to secondary network controller214b, which is segregated from primary network controller214acoupled to host processor204a.

In some implementations, revocation command311may be generalized into a key management command, which includes a revocation command or a renewal command, configured to change a status of master key311and therefore make it dynamic. For instance, in some cases master key311may have an expiration time or date. If the expiration is reached, master key311may be automatically invalidated or deleted by off-host processing system206.

In these cases, master key311's expiration may be reset by a renewal command issued by authentication server311. Such a command may be sent to IHS202at regular intervals, immediately before the expiration of master key311, or each time HS202has a network connection. As such, if the user loses IHS202or leaves his or her employment, authentication IHS220may then stop sending the renewal command to IHS202, thus allowing master key311to expire.