Exclusive self-hosting method and device

Abstract

A method for causing a third party provider having a third party provider domain to access a program domain of a device owner and an apparatus for allowing a third party to access a locked device are provided. Mutually authenticating the third party provider domain and the locked device owner's program domain using two or more exclusive self-hosting credentials; the locked device owner's program domain is unlocked after mutually authenticating the third party provider domain and the locked device owner's program domain.

Description

[0001] This application is a divisional application of the PCT international patent application PCT / US2021 / 052802 with an application date of September 30, 2021, which has entered the Chinese national phase with Chinese patent application number 202180079937.0 and the invention name being “Exclusive Self-Hosting Method and Device”. Technical Field

[0002] The present invention generally relates to protecting program domains, and more particularly, to a method and apparatus for securely unlocking program domains through exclusive self-hosting. Background Art

[0003] Electronic devices and computer programs can restrict access by requiring user-supplied credentials to gain access. Thus, for example, a smartphone can be locked and require user-supplied credentials such as a password, fingerprint, or facial image to unlock the phone, and a computer program or file can also require user-supplied credentials to gain access.

[0004] Occasionally, someone other than the user requests exceptional access (i.e., without credentials provided by the user) to an electronic device, program, or file, which is referred to herein as, but not limited to, the program domain. Thus, for example, there are many instances where U.S. government authorities request access to smartphones through the use of a search warrant. If the user refuses to provide credentials, other means must be used to provide exceptional access to the smartphone.

[0005] One prior art method of gaining ad hoc access to encrypted data that can also be used to unlock a smartphone or other program domain is through the use of a secret backdoor mechanism, where the program domain accepts unlock requests established by a third party without the owner's knowledge or involvement. Inherently, backdoors are problematic because they reduce the owner's security without authorization. Their unauthorized placement within the program domain ensures that the user of the backdoor (including any passwords required for the backdoor) and its use are not authorized by the owner. Furthermore, since the backdoor password or other operational data is stored in an external database, such backdoors are vulnerable to hacking, theft, and abuse.

[0006] Another prior art method of providing ad hoc access to a program domain is through "key escrow," where the keys (credentials) required to unlock the program domain are escrowed by a third party, sometimes referred to as a trusted third party. They are designated as trusted because the domain owner does not hold an enforceable agreement governing the actions of the third party and the credentials held. These third parties can include businesses that may wish to access the secure business-related communications of their employees, or governments that want to be able to view the contents of encrypted communications without complying with privacy rights and due process (also known as anomalous access).

[0007] A technical problem with the use of key escrow is that access to protected information must be provided only to the intended recipients and at least one intended third party. Access to third parties should only be granted under strictly controlled circumstances, such as a court order. So far, no prior art system has been shown to meet this requirement. All proposed systems also require the correct functioning of certain socio-judicial links, such as the process of access requests, the review of the requester and the "legitimacy" of the request (e.g. by a court) and the granting of access by third-party technical and public authorities responsible for access control. All such links / controls have serious problems from the point of view of system design security. Systems in which a single key unlocks many program domains become particularly vulnerable, since an accidental disclosure of the key would lead to the complete compromise of many devices, requiring immediate rekeying or system replacement.

[0008] At the national level, key escrow is controversial in many countries for at least two reasons. One involves distrust of the security of structured escrow arrangements. Many countries have a long history of inadequate privacy protections, with various public and private organizations having due process rights to information about others, even if that information is held only under an affirmative legal obligation to protect it from unauthorized access. The other is technical concerns about the additional vulnerabilities that could be introduced by supporting key escrow operations. To date, no key escrow system has been designed that satisfies both objections, and almost all systems fail to meet even one of the goals.

[0009] Key escrow is proactive and anticipates the need for key access; a retroactive alternative is key disclosure, which requires users to surrender their keys / passwords upon request from law enforcement or face legal penalties. Key disclosure avoids some of the technical issues and risks of key escrow systems, but also introduces new risks, such as key loss and legal issues (e.g. involuntary self-incrimination).

[0010] In summary, while key escrow systems can attempt to provide adequate security, such systems suffer from several drawbacks. First, key escrow systems require the use of a central database containing billions of passwords for billions of program domains, which can be compromised by hackers or confiscated by government authorities. Second, key escrow systems require trusted third parties to uphold their oaths to be trustworthy administrators and intermediaries. Third, key escrow systems cannot guarantee that government authorities will honestly administer the law and their own charters independently and separately from the trustworthiness of trusted third parties.

[0011] Although methods and apparatus using the prior art initially appear to be easy to use and reasonably secure, these benefits have proven difficult to achieve in practice, and there is a need in the art to provide methods and systems that can provide improved security. Specifically, such systems and methods should provide that ad hoc access to a program domain is only by authorized parties with authorization indications. Such methods and apparatus should be easy to implement and robust to prevent participants from attempting to illegally gain access to a locked program domain. Summary of the invention

[0012] The present invention overcomes the shortcomings of the prior art by providing a secure system or method that establishes that any third party attempting to unlock a program domain is authorized to do so, and that any unlock attempt is retained for the owner / property regardless of success or failure.

[0013] Certain embodiments provide a method for a TP having a third party (TP) domain to unlock a locked device owner's program domain (Device Owner'S Program Domain, DO-PD). The method includes: the TP domain performs a first authentication on the DO-PD; the DO-PD performs a second authentication on the TP domain; and after a successful first authentication and a successful second authentication, unlocking the locked DO-PD. Various embodiments provide: the first authentication or the second authentication includes exchanging messages between the DO-PD and the TP domain, wherein the message is a credential or includes a credential; the TP domain includes a first subdomain (TP-PD) contained in the DO-PD and a subdomain (TP-'PD) not in the DO-PD; the DO-PD is a horizontal program domain; the DO-PD is in an electronic device, which can be a smartphone or a computer or a tablet; the DO-PD is a vertical program domain; the DO-PD includes a database, a word processor, a spreadsheet, or a mobile safe; the TP is a first TP having a first TP domain, wherein the method also includes a second TP having a second TP domain; or, the first authentication of the TP domain to the DO-PD and the second authentication of the DO-PD to the TP domain are mutual authentication using exclusive self-hosting.

[0014] Certain other embodiments provide a method for a TP with a third party (TP) domain to unlock a locked device owner's program domain (DO-PD). The method includes: the TP domain performs a first authentication on the DO-PD; the DO-PD performs a second authentication on the TP domain; and after a successful first authentication and a successful second authentication, unlocking the locked DO-PD. The first authentication of the TP domain to the DO-PD is successful when the first credential is equal to the second credential, the second authentication is successful when the third credential is equal to the fourth credential, and at least one of the four credentials is generated, disclosed or stored in the DO-PD. Various embodiments provide: the first credential and the third credential are resident credentials, the second credential and the fourth credential are challenge credentials; the first credential and the second credential are both disclosed or calculated during the first authentication, and the third credential and the fourth credential are both disclosed or calculated during the second authentication.

[0015] Still other embodiments provide a method for unlocking a locked device owner's program domain (DO-PD) with a third party (TP) domain using a credential for authentication. The credential includes at least one of a password, a random number, a device ID of the electronic device credential, a shared secret key of the PD and TP domains, an encrypted password, an encrypted random number, an encrypted device ID of the electronic device credential, an encrypted shared secret key of the PD and TP domains, a password, a random number, a device ID of the electronic device credential, a shared secret key of the PD and TP domains, a hashed password, a hashed random number, a hashed device ID of the electronic device credential, or a hashed shared secret key of the PD and TP domains.

[0016] Certain other embodiments provide a method for unlocking a locked device owner's program domain (DO-PD) with a third party (TP) domain using a TP, the method using credentials for authentication, wherein at least one credential is disclosed or generated using a key of at least one TP key pair, a key of a PD key pair, or a shared secret key.

[0017] Certain embodiments provide a method for a third party (TP) domain with a TP unlocking a locked device owner's program domain (DO-PD), wherein an additional third party's authentication is required to unlock the DO-PD.

[0018] Certain embodiments provide an apparatus for unlocking a locked device owner's program domain (DO-PD) by a TP having a third party (TP) domain, wherein the DO-PD has a memory and is programmed to perform the following steps: the TP domain performs a first authentication on the DO-PD; the DO-PD performs a second authentication on the TP domain; and after a successful first authentication and a successful second authentication, unlocking the locked DO-PD. Various embodiments provide: the first authentication or the second authentication includes exchanging messages between the DO-PD and the TP domain, wherein the message is a credential or includes a credential; the TP domain includes a first subdomain (TP-PD) contained within the DO-PD and a subdomain (TP-'PD) not within the DO-PD; the DO-PD is a horizontal program domain; the DO-PD is within an electronic device, which may be a smartphone or a computer or a tablet; the DO-PD is a vertical program domain; the DO-PD includes a database, a word processor, a spreadsheet, or a mobile safe; the TP is a first TP having a first TP domain, wherein the method further includes a second TP having a second TP domain; or, the first authentication of the TP domain to the DO-PD and the second authentication of the DO-PD to the TP domain are mutual authentication using exclusive self-hosting.

[0019] Certain embodiments provide an apparatus for a TP with a third party (TP) domain to unlock a locked device owner's program domain (DO-PD), wherein the DO-PD has a memory and is programmed to perform the following steps: the TP domain performs a first authentication on the DO-PD; the DO-PD performs a second authentication on the TP domain; and after a successful first authentication and a successful second authentication, unlocking the locked DO-PD. The first authentication of the DO-PD by the TP domain is successful when the first credential is equal to the second credential, the second authentication is successful when the third credential is equal to the fourth credential, and at least one of the four credentials is generated, disclosed or stored in the DO-PD. Various embodiments provide: the first credential and the third credential are resident credentials, the second credential and the fourth credential are challenge credentials; the first credential and the second credential are both disclosed or calculated during the first authentication, and the third credential and the fourth credential are both disclosed or calculated during the second authentication.

[0020] Still other embodiments provide a device for unlocking a locked device owner's program domain (DO-PD) with a TP of a third party (TP) domain, the device using a credential for authentication. The credential includes at least one of a password, a random number, a device ID of the electronic device credential, a shared secret key of the PD and TP domains, an encrypted password, an encrypted random number, an encrypted device ID of the electronic device credential, an encrypted shared secret key of the PD and TP domains, a password, a random number, a device ID of the electronic device credential, a shared secret key of the PD and TP domains, a hashed password, a hashed random number, a hashed device ID of the electronic device credential, or a hashed shared secret key of the PD and TP domains.

[0021] Certain other embodiments provide a device for unlocking a device owner's program domain (DO-PD) locked with a third party (TP) domain, the device using credentials for authentication, wherein at least one credential is disclosed or generated using a key of at least one TP key pair, a key of a PD key pair, or a shared secret key.

[0022] Certain embodiments provide an apparatus for unlocking a locked device owner's program domain (DO-PD) with a third party (TP) domain, wherein the DO-PD has a memory and is programmed to perform the steps of: additional third party authentication is used to unlock the DO-PD.

[0023] These features, together with various ancillary provisions and features which will become apparent to those skilled in the art from the following detailed description, are achieved by the method and apparatus of the present invention, a preferred embodiment of which is shown by way of example only with reference to the accompanying drawings, as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is a schematic diagram of an embodiment of an exclusive self-hosting method, showing a device owner's program domain DO-PD and a third-party provider domain TPP;

[0025] Figure 2 and Figure 3 is shown for execution Figure 1 A schematic diagram of the steps of an embodiment of a system;

[0026] Figure 4 is a flow chart of the exclusive self-hosting method of the first embodiment;

[0027] Figure 5 is a flow chart of an exclusive self-hosting method according to a second embodiment;

[0028] Figure 6 is a flow chart of an exclusive self-hosting method according to a third embodiment;

[0029] Figure 7 is a flowchart of an exclusive self-hosting method according to a fourth embodiment;

[0030] Figure 8 is a flowchart of an exclusive self-hosting method according to a fifth embodiment;

[0031] Fig. 9 is a flowchart of an exclusive self-hosting method according to a sixth embodiment;

[0032] Fig.10 is a flow chart of an exclusive self-hosting method according to a seventh embodiment;

[0033] Fig.11is a flow chart of an exclusive self-hosting method according to an eighth embodiment;

[0034] Fig.12 is a flow chart of an exclusive self-hosting method according to a ninth embodiment;

[0035] Fig.13 is a flowchart of an exclusive self-hosting method according to a tenth embodiment;

[0036] Fig.14 is a flow chart of an exclusive self-hosting method according to an eleventh embodiment;

[0037] Fig.15 is a flow chart of an exclusive self-hosting method according to a twelfth embodiment;

[0038] Fig.16 is a flowchart of an exclusive self-hosting method according to a thirteenth embodiment;

[0039] Fig.17 is a flowchart of the exclusive self-hosting method of the fourteenth embodiment; and

[0040] Fig.18 is a table showing some features of fourteen embodiments.

[0041] Reference symbols are used in the drawings to indicate certain components, aspects or features shown therein, and reference symbols common to more than one drawing indicate similar components, aspects or features shown therein. DETAILED DESCRIPTION

[0042] Various embodiments described herein are directed to a third party gaining special access to a locked program domain by mutual authentication using exclusive self-hosting. Mutual authentication refers to a multi-step authentication in which each party authenticates one party to the other party. Exclusive self-hosting refers to using credentials held within the locked program domain. Thus, for example, using credentials stored in the locked program domain, the third party self-authenticates to the locked program domain and the locked program domain authenticates the third party. After mutual authentication, the third party is authorized to access the previously locked program domain.

[0043] As opposed to using central, off-device storage, mutual authentication using exclusive self-hosting provides an on-device escrow capability, which ensures that the credentials can neither be stolen through a central database hack nor misled intentionally or through coercion by a third party working with government authorities alone or with any other external party. The described methods and systems provide exceptional access to locked program domains on a per-device basis and do not provide a mechanism for any form of mass surveillance. As a further protection against mass surveillance, certain embodiments provide that when a normal password is installed, no notification of the creation, existence, or identification information of the escrowed credentials is provided to the third party and the third party remains unaware until the third party is hired by a government agency or other competent investigative agency in possession of the locked device, which may only reveal the ability of the TPP to perform exceptional access to the device.

[0044] Typically, each authentication requires a comparator step in which a pair of credentials are compared, wherein authentication occurs when the credentials are found to be equal to one another. The credentials are referred to herein as, but not limited to, resident credentials and challenge credentials. The term "resident credential" refers to a standard copy of a credential held by the authenticator, and the term "challenge credential" refers to a working measurement copy of a credential that is revealed or calculated by the authenticator after being presented by the authenticated party. Thus, for each authenticator, a comparator step determines whether the challenge credential is the same as the resident credential that the authenticator trusts. In some embodiments, the pair of credentials are initialized or calculated to be initially identical and undergo an encryption / decryption step, after which the pair of credentials will only be identical if the correct key was used during the initialization, calculation, or encryption / decryption step.

[0045] The exclusive self-hosting approach can utilize a combination of different messages (access data) and content, encryption methods (asymmetric and symmetric), and one-way function credential types to accomplish authentication of program domains and third parties. Public key cryptography provides a method to protect authentication of one-way function credentials, while symmetric cryptography provides a method for generating and protecting one-way function credentials for two-way authentication. Each type of credential exhibits unique functional characteristics that support its role in authentication, with an emphasis on one-way functionality and state expression. HSA (Hardware Security Area) on some devices can replace encrypted messages.

[0046] In some embodiments, exclusive self-hosting can utilize one or more encryption key pairs or shared secret keys and use credentials to mutually authenticate the parties, and the credentials used include, but are not limited to, encrypted messages, hash keys and / or random numbers, device IDs, and timestamps. The exclusive self-hosting method described herein can be used with horizontal program domains and vertical program domains. Horizontal domains specify content categories covering different applications, typically involving entire devices, locations, or operating systems. An example of a horizontal program domain is a smartphone running iOS. Vertical domains specify content specific to vertical applications, such as databases, word processors, spreadsheets, or mobile safes. In the case of an address book application running on an Android OS device, a vertical domain is typically a subdomain of a horizontal domain. It is worth noting that in addition to operations performed on the domain containing the subdomain, security operations can also be performed on the subdomain. Crucially, a subdomain may remain locked when its parent domain is converted from locked to unlocked.

[0047] As an example, and not meant to limit the scope of the invention, the invention is described herein based on a third party provider (TPP) obtaining access to a locked program domain (PD) with an associated domain owner (DO), which is referred to herein as DO-PD. The DO-PD is controlled by the program P and may also include associated hardware, such as but not limited to a smartphone, tablet or other computer device, or a portion of a computer memory or computer file. The TPP is a party other than the DO, which may be, for example but not limited to, the manufacturer of the PD and / or any associated hardware. The TPP has two associated domains. One TPP domain is separated from the DO-PD and is referred to herein as the TPP-'PD (TPP rather than the PD), and the other TPP domain is an encrypted partitioned portion of the DO-PD under the control of the DO-PD program P, referred to herein as the TPP-PD. The operations within the TPP-PD are limited, including receiving data from the DO-PD, calculating additional data using available data, and sending data to the DO-PD.

[0048] Certain embodiments provide for unlocking the PD using exclusive self-hosting, wherein the credentials used to unlock the PD are: 1) stored and / or computed in the PD; 2) used within the PD to authenticate the TPP; and 3) used by the TPP to authenticate the PD. In certain other embodiments, the authentication step includes a two-way authentication process in which messages are exchanged and compared between the third party provider and the program domain.

[0049] Figure 11 is a schematic diagram of one embodiment of an exclusive self-hosting method, which shows a domain owner program domain DO-PD 120, a first third party provider TPP-'PD 110, and a second third party provider domain TPP-PD 112. DO-PD 120 is controlled by DO 20 through program P, TPP-'PD 110 is controlled by TPP 10 and is external to and secure from any programming in DO-PD, TPP-PD 112 is a domain that is an encrypted partitioned portion of DO-PD and has limited capabilities, including receiving data from DO-PD, computing additional data using available data, and sending data to DO-PD. Thus, for example, Figure 1 DO-PD memory 121 is shown, including volatile and nonvolatile memory accessible from the DO-PD, and TPP-PD memory 135 is shown, including volatile and nonvolatile memory accessible from TPP-PD 112. Generally, DO-PD 120 cannot access information stored in TPP-PD memory 135. Thus, for example, TPP 110 may provide a copy of TPP private key 115 to TPP-PD memory 135. When TPP-PD memory 135 is within DO-PD 120, the DO-PD cannot access the TPP private key.

[0050] Figure 1 The use of two-way authentication is shown by holding only a unique credential stored in the DO-PD memory 121. Optionally, authentication is performed by holding and computing the credential, where the unlocking of the program domain proves the true identity of both the PD and the TPP by comparing the holding of a fully owned private key held by each party and computing the credential generated by the application program from the time the device program domain was initially locked. In some embodiments, the calculation of the credential includes the use of a one-way mathematical function that precludes reverse engineering the credential to its previous value in polynomial time. A significant advantage of this calculation method is that hash values ​​can be openly stored and exchanged between parties without the need for privacy protection efforts and cryptographic protection.

[0051] Schematic diagram 100 shows a method for DO 20 to set a lock of DO-PD 120 and for TPP 10 to unlock a locked DO-PD. In an initial step, TPP-PD 110 obtains or generates a key pair, such as TPP public key 111 and TPP private key 115. In one embodiment, keys 111 and 115 can be, for example, but not limited to, a public key pair known in the art. In an alternative embodiment, TPP key pair 111 / 115 can be accompanied by additional keys used in symmetric encryption.

[0052] To lock the DO-PD 120, in block 122, the DO 20 engages with the DO-PD 120, which establishes the DO-PD for self-hosted locking. This may include generating a PD key pair, which may include, for example but not limited to, a public key pair including a PD private key and a PD public key and an additional symmetric key pair, which is used to generate one or more shared secret keys (referred to herein as SSKs) stored in a non-volatile memory DO-PD memory 121. Alternatively, the DO-PD may generate and store the PD keys prior to performing the steps of block 122, or block 122 may be performed while the program domain owner is establishing a normal password for locking the DO-PD 120. In addition, the TPP public key 111 is provided to the DO-PD 120 and is also stored in the DO-PD memory 121. In certain other embodiments, the generation of the keys may occur during unlocking of the DO-PD 120 and before they are required for authentication.

[0053] Once DO-PD 120 is locked, DO-PD operates under the control of Program P, as described below, which controls third-party unlocking of the DO-PD. In addition, DO-PD 120 may also execute programming to unlock the DO-PD normally, such as by a password.

[0054] In the step of box 123, exclusive self-hosted credentials are generated (also referred to as "calculated") from the TPP public key 111 and the PD key pair stored in the DO-PD memory 121. As described in detail below, the exclusive self-hosted credentials generated in box 123 may include, but are not limited to, one or more passwords, keys (including, but not limited to, public and symmetric key pairs and calculated shared secret keys), and assigned random numbers, including hash keys, hash random numbers, device IDs, and timestamps, which are calculated values ​​checked at key moments in the unlocking process. In some embodiments, as described below, the exclusive self-hosted credentials include both resident credentials and challenge credentials. In certain other embodiments, the generation of credentials may occur during the unlocking of the DO-PD 120 and before they are required for authentication.

[0055] Figure 1 1 shows exclusive self-hosted credentials generated during the setup of the lock of the DO-PD 120. However, in general, it is only important to generate the credentials before they are used to unlock, so in various embodiments, some or all of the credentials may be generated prior to the setup of block 122, such as Figure 1 Some or all of the credentials are shown generated, and may be generated after the DO-PD 120 is placed in the managed mode of block 125 .

[0056] Finally, as provided by the step in block 124 , the DO-PD 120 is then locked.

[0057] To unlock the locked DO-PD 120, the TPP 10 obtains permission to access the DO-PD 120, for example, through a court order that provides the TPP with authority to unlock the DO-PD. After obtaining and verifying this access, the TPP 10 sends an electronic request to block 113 to unlock the DO-PD, which is sent to block 125 in the DO-PD 120, which places the DO-PD in an escrow mode ("Emode").

[0058] The electronic request of block 113 to place DO-PD 120 in Emode may be generated by any of a variety of methods. Thus, for example, the electronic request of block 113 may be a predetermined alphanumeric code or format of an alphanumeric code entered in place of a standard password, or for the example of a smart phone, may be a specific button combination pressed on the phone, similar to a reset of the phone.

[0059] The managed mode is a limited interactive state available when the DO-PD 120 is locked, whereby only a designated third-party TPP can unlock the DO-PD. Prior to unlocking the DO-PD 120, the TPP 10 must prove that certain conditions have been met before any action is taken to unlock the DO-PD. When the DO-PD 120 is placed in managed mode in block 125, a portion of the DO-PD 120 is set aside as a TPP-PD 112. The TPP-PD 112 provides "workspace-restricted" operation through the P of the DO-PD 120, whose operation is limited to receiving certain data from the DO-PD 120 or TPP-'PD 110, computing certain additional data using the available data, and sending certain data to the DO-PD or TPP-'PD.

[0060] In certain embodiments, block 125 performs steps to ensure that TPP 10 is the TPP authorized to unlock DO-PD 120 , such as by determining whether request 113 is a predetermined credential in a format or stored in DO-PD 120 .

[0061] As described below, the locked DO-PD 120 is unlocked by mutual identification of exclusive self-hosted credentials by the domain TPP-'PD 110 and the domain DO-PD 120. Because the process of unlocking the TPP-'PD 110 is controlled by the TPP 10, and the DO-PD 120 was previously controlled by the DO 20, the use of the exclusive self-hosted credentials to unlock the DO-PD 120 presumably also authenticates both the TPP and the DO.

[0062] Once the DO-PD 120 is placed in Emode, the authentication steps of block 126 are performed, specifically, the steps of blocks 131 and 133. As described below, unlocking the DO-PD 120 requires authentication of the DO-PD via the TPP-PD 110 occurring in block 131, and authentication of the TPP-PD 110 by the DO-PD occurring in block 133. The order in which blocks 131 and 133 are performed depends on the embodiment, as long as both blocks are performed.

[0063] The steps of blocks 131 and 133 have access to the contents of the TPP-PD memory 135, which also includes information transfer between the DO-PD memory 121 and the TPP-PD memory 135. The information transferred may include, but is not limited to, certain credentials and certain PD public keys. Typically, the communication between the TPP-PD 112 and the DO-PD 120 is secure and will not be affected by unwanted requests from the DO-PD. This allows the TPP 110 to securely use the TPP private key 115 in the TPP-PD 110 or TPP-PD 112 without worrying about losing the desired control of the private key.

[0064] In block 131, TPP-'PD 110 uses the credentials generated and / or stored in DO-PD to authenticate DO-PD 120 within one or more of TPP-'PD 110 and / or TPP-PD 112. In some embodiments, the authentication of block 131 is accomplished through a two-way authentication process, wherein there is an exchange and comparison of messages between DO-PD 120 and TPP-'PD 110 and / or TPP-PD 112, which requires, for example but not limited to, the use of private or shared PD or TPP keys. As described below, a message is a file that acts as a secure container for credential information used in an unlocking program domain.

[0065] In block 133, DO-PD 120 uses the credentials generated and / or stored in the DO-PD to authenticate TPP-'PD 110 within the DO-PD. In some embodiments, the authentication of block 133 is accomplished through a two-way authentication process, in which messages are exchanged and compared between DO-PD 120 and TPP-'PD 110 and / or TPP-PD 112, which requires, for example, but not limited to, the use of private or shared DP or TPP keys.

[0066] Authentication as discussed herein at blocks 131 and 133 may include, but is not limited to, one or more of the following steps: comparing two credentials, where the credentials may be a resident credential (a standard credential that the authenticator trusts) and a challenge credential (a working measurement credential provided to the authenticator by the authenticated party); exchanging messages between the DO-PD 120 and the TTP-PD 110 or TTP-PD 112 or other third party domain or subdomain, where the message is a credential, contains information used to generate (i.e., calculate) the credential, including but not limited to a random number, a hashed password or other identification code or encryption key, revealing the credential by decrypting it, or retrieving the credential or information used to generate or reveal the credential from a secure object such as a file, or retrieving the credential or information from a secure location. In general, for example, reference is made to Figure 1 As discussed, one or more steps other than the comparison of credentials may be performed prior to the comparison step, or after locking the DO-PD 120 .

[0067] In block 127 , if the authentication in blocks 131 or 133 fails, the unlocking process terminates. If the authentication in blocks 131 and 133 is successful, the DO-PD 120 is unlocked in block 128 .

[0068] In an alternative embodiment, the cooperation of more than one third party is required to unlock the DO-PD 120. Thus, as an example, the TPP 10 may be the manufacturer of the PD (e.g., the manufacturer of a smartphone), while the other third parties may have some other relationship with the PD, such as a different smartphone manufacturer or may be some other entity such as a privacy protection organization. As shown in schematic 100, the TPP 10 is the first to unlock the DO-PD 120. As shown in box 131, after the TPP is authenticated by the DO-PD 120, the DO-PD performs authentication for each other third party in a manner similar to box 131. Thus, for example, for each of the other third parties, messages may be exchanged between the DO-PD 120, enabling the DO-PD to authenticate each of the other third parties. As shown in box 127, authentication by the TPP 10 and each other third party is required to complete the authentication.

[0069] Although schematic 100 is described as being used with a smartphone, the method can be performed on other hardware devices, such as tablets or computers, with or without a dedicated hardware secure area (HSA) or cloud-based secure storage. The method can also be implemented on a locked sub-program domain, which is an independent program domain within another program domain, so that the sub-program domain can remain locked even if the sub-program domain resides within an unlocked program domain, such as controlled by a vertical software application running in a software storage area.

[0070] An example of a locked sub-program domain is a password-protected software program with data. There are no special hardware requirements beyond those that currently exist, and the system can work with or independently of a dedicated hardware enclave such as the Secure Enclave processor in the iPhone and similar enclaves on other devices. In the event of an attempted court-ordered exceptional access, the device cannot be returned to its normal operating state to ensure that the intrusion or attempted intrusion is identified. Exclusive self-hosted credentials are always securely maintained within the program domain and under the full control of the protected program, providing the highest level of security and privacy available while making the device accessible pursuant to a court order. End-to-end encryption remains very complete without an encryption backdoor, but there is an available path for court-ordered exceptional access.

[0071] Figure 2 and Figure 3 is a schematic diagram illustrating one embodiment of a system 200 for performing the steps of schematic diagram 100 .

[0072] Figure 2 System 200 is shown in detail and includes a TPP device 210, a DO device 230 including a lockable DO-PD 120, and a communication capability 220 to connect a program P of the TPP device to a program P of the DO device. TPP device 210 includes communication capability 211, memory 213, and processor 215. In some embodiments, TPP device 210 maintains encryption keys including TPP private keys in memory 213, and optionally, maintains a database of lockable DO-PD and DO-PD public encryption keys.

[0073] As an illustration of a horizontal program domain, DO device 230 is, for example but not limited to, a smartphone, which includes a touch screen 231, a communication connector 232, a memory 233, and a processor 234. The memory 233 contains operating instructions for the system 200, which the processor 234 interprets as operating the touch screen 231 as an input and output device. The communication connectors 211 and 232 are serial communication connectors that can be connected using appropriate communication capabilities 220. Examples of communication connectors 211 or 232 include, but are not limited to, a USB Type-C port, a micro USB port, a QR code, an NFC format, or a FireWire interface ( Memory 233 includes programming required to run DO device 230 (e.g., operating system or virtual machine instructions). Memory 233 may also include a hardware secure area (HSA), including its own dedicated control Hardware Secure Area Program (HSAP), and for iPhones, called a Secure Enclave Processor (SEP), or for Android devices, called Titan M or ARM TrustZone.

[0074] As an illustration of the vertical program domain, DO device 230 is an electronic device, such as a computer or smart phone, having a lockable DO-PD 120 , which may be, for example but not limited to, a database, a word processor, or a spreadsheet.

[0075] The following discussion presents an embodiment of the system 200 operating on the TPP device 210 and the DO device 230. Specifically, the memory 215 includes stored programming instructions that the processor 234 interprets to perform the method steps described herein on the TPP device 210 and communicate with the DO device 220 via the communication cable 210, and the memory 233 includes stored programming instructions that the processor 234 interprets to perform the method steps described herein on the DO device and communicate with the TPP device via the communication cable. As described herein, the memories 215 and 233 may also include stored encryption keys and other information for locking and unlocking the DO-PD 120.

[0076] In one embodiment, the memory 213 includes a processor 215 for executing Figure 1 The functions shown in TPP-PD 110 and TPP-PD 112 are programmed, and memory 233 includes memory for processor 234 to execute Figure 1 The programming of the functions in DO-PD120 is shown.

[0077] encryption

[0078] In various embodiments, the security of exclusive self-hosting is achieved using one or more of two different encryption methods, the computational difficulty of which is proven and accepted. The first method is public key encryption. The second method is symmetric key encryption using a key exchange protocol, which can be, for example, but not limited to, the Diffie-Hellman Key Exchange Protocol (DHKX). In addition, a one-way mathematical function including a hash of a key and a random number and a unique device identifier and a timestamp can be used. The public keys are not disclosed to any Public Key Infrastructure (PKI) entity, but are provided to participants by including them in messages or from accessible domain locations.

[0079] Symmetric encryption: Exclusive self-hosting can use DHKX to use the calculated shared secret key as a escrow password, which in turn is used as a credential or to encrypt one-way function access data that is later disclosed upon abnormal access. In some embodiments, TPP 10 or DO-PD 20 generates a shared secret key from a symmetric key pair (2), where the public key of one key pair matches the private key of another key pair. Although not disclosed through PKI, the public key is still cryptographically treated as a public key.

[0080] Public Key Cryptography: Exclusive self-hosting can use asymmetric public key encryption one-way function of TPP-PD 110 or DO-PD 120 to access data so that the TPP or PD can later disclose the access data for authentication upon abnormal access.

[0081] Certification

[0082] In certain embodiments, exclusive self-hosting may utilize one or more of a variety of credentials for authentication between DO-PD 120 and TPP-'PD 110, including but not limited to passwords, shared secret keys, random numbers, unique device IDs, timestamps, and hashed versions of each credential.

[0083] Shared Secret Key Authentication: In certain embodiments, when initiating abnormal access, exclusive self-hosted authentication may utilize a shared secret key or hashed shared secret key (referred to herein as “HSSK”) calculated from the respective public and private keys of DO-PD 120 and TPP-PD 110 for subsequent authentication.

[0084] Random number authentication:In some embodiments, exclusive self-hosted authentication can utilize random numbers, hashed random numbers, and random number functions as credentials for authentication when unlocking establishment or initiating abnormal access or both unlocking establishment and initiating abnormal access, and the random numbers, hashed random numbers, and random number functions are calculated, for example but not limited to, within DO-PD 120 or TPP-'PD 110. In various embodiments, before abnormal access, the random number or hashed random number value is encrypted and stored as a credential for use in subsequent authentication. The generation of random numbers, random number functions, and hashing are known in the art.

[0085] In some embodiments, the random number used for authentication (referred to herein as a "special random number") is selected from a predetermined random number pool or stored in a specific format. If the provided special random number is within a predetermined random number pool or has a predetermined format, authentication is performed.

[0086] Unique device identifier (ID) and timestamp : In some embodiments, exclusive self-hosted authentication can utilize unique device ID one-way function credentials and / or timestamp one-way function credentials.

[0087] information

[0088] In some embodiments, exclusive self-hosting may be authenticated using messages. A message is a secure object of information that may be encrypted, for example, and may be exchanged between DO-PD 120 and TPP-PD 112 or TPP-'PD 110, and may contain items used to generate credentials, such as encryption keys or encrypted credentials, or may itself be a credential.

[0089] Generally, as described in further detail herein, the message may include, but is not limited to, including credentials, passwords, random numbers, device IDs, device time, encryption keys, or hashed versions of any of these. The message may also be encrypted.

[0090] In some embodiments, a message may contain more than one item, such as an encryption key and a credential such as a password, or more than one encryption key. For some embodiments, messages with more than one item are useful for efficiently providing multiple items required to authenticate the parties. Implementation Details and Assumptions

[0091] Certain embodiments of the exclusive self-hosting method and apparatus of the present invention include a program (P) running in one or more of DO-PD 120, TPP-'PD 110 or TPP-PD 112, at least one encrypted container "message" object and three participants including a DO such as DO 20, TPP 10 and a Government Authority (GA). TPP 10 is a third party and optionally also a provider of the program domain (i.e., a device manufacturer). It should be understood that TPP 10 can be a third party that performs the role of TPP without actually providing DO-PD 120 to DO 20. TPP 10 always has a public key pair consisting of their private key and public key stored in TPP-'PD 110. In several embodiments, DO-PD 120 can have at least one public key pair. Although the public keys of the key pair are not secret, they are not disclosed, but are available in an administrative manner without security. The private key is secret and is securely stored and managed. One-way function access data is any data used in the calculation of passwords, keys, nonce values, random number functions, unique device identifiers, timestamps, hash versions, etc.

[0092] In some embodiments, DO-PD 120 is unlocked using P after each party has authenticated the other by comparing the resident credentials and the challenge credentials. In the event of abnormal access, these credentials (e.g., escrow passwords) are compared to each other for effective matching, thereby verifying the authenticity of the TPP and DO-PD. Thus, for example, when the resident credentials stored, disclosed, or calculated in the DO-PD are equal to the challenge credentials provided to the DO-PD from TPP-'PD 110 or TPP-PD 112, the DO-PD 120 authenticates the TPP-'PD 110. In addition, for example, when the resident credentials stored, disclosed, or calculated in the TPP-'PD or TPP-PD 112 are equal to the challenge credentials provided from the DO-PD to the TPP-'PD or TPP-PD, the TPP-'PD 110 authenticates the DO-PD 120. In certain other embodiments, the challenge credentials are generated during the unlocking process. In some embodiments, program P runs on TPP-PD 110 before TPP authenticates DO-PD 120, and then runs on TPP-PD 112 after TPP authenticates DO-PD.

[0093] Each escrow password copy is in a disclosed or undisclosed state. As disclosed, each password copy is an alphanumeric sequence. As undisclosed, each password copy is an alphanumeric sequence that is different from (not equal to) the alphanumeric sequence of its disclosed state. When a password copy is encrypted, it is converted from a disclosed state to an undisclosed state by the P. When a password copy is stored in either the PD or the Hardware Security Area (HSA), its state is not changed by the P of the PD. The resident escrow password is disclosed by the P of the DO-PD, and the challenge escrow password is disclosed or calculated by the P of the TPP-PD through the operation of the real TPP. The HSAP always returns the stored information to the P of the PD in the state received from the P. Whether the resident escrow password is undisclosed, disclosed, or in a calculated state, it is unique to the DO-PD. Whether the challenge escrow password is undisclosed, disclosed, or in a calculated state, it also only exists in the TPP-PD.

[0094] In certain embodiments, when expanded to a hash value, the escrow password may be passed and compared both inside and outside of encrypted messages, as possession is limited by access to the non-hashed escrow password. Thus, for example, the source of the hashed escrow password may be securely stored to ensure that a challenge escrow password in its hashed form can only be disclosed by the authentic TPP.

[0095] In some embodiments, during abnormal access, when setting a normal password and creating a managed password credential, a hash key credential can be created and securely stored, and then used to authenticate the device program domain and third parties to prevent imposters. In some embodiments, a hash key challenge credential is created during abnormal access.

[0096] In some embodiments, credentials such as escrow passwords are generated as products of symmetric encryption, and these same keys as passwords can also be used to encrypt access data. The escrow password can be generated directly based on the hash value of P or access data generated from the key pair combination. The hash value, including the hash value from the random number, is used to authenticate the third party and the DO-PD.

[0097] Certain embodiments may include multiple third parties that may use multiple different key pairs during the authentication process. Thus, a message may support multiple unique security containers of credentials using different public keys, where the DO-PD 120 encrypts the escrow challenge credentials into a single message n times via P using n unique public keys, so that n third parties are required to disclose their respective valid challenge credentials via P for comparison with the resident credentials. The involvement of additional third parties reduces the risk that the TPP 10 may accidentally or intentionally choose to unlock the device without meeting the conditions. The leading third-party candidates come from the TPP group because they are fully involved stakeholders. The complete resident credentials can be matched so that P unlocks the DO-PD 120. Each copy of the challenge credential can also be placed in its own message. Embodiments utilizing escrow passwords are best suited for multiple third parties, where authentication is required at the beginning of the unlocking process to confirm the DO-PD 120 and the TPP 10, and due to multiple third parties and time delays, authentication is performed again at the completion of the authentication process, where the DO-PD is then unlocked by the TPP.

[0098] According to box 125, various embodiments do not represent a built-in time delay function for failed unlocking attempts, or a time constraint function for the TPP 10 and other potential third parties for the time allocated by the P to unlock the DO-PD 120 once the PD is placed in managed mode. Time delays and time constraint functions are viable supplements to the embodiments. It is reasonable that a limited time may be allowed to pass between placing the program domain in Emode and receiving a valid challenge credential. Such a time limit will strictly limit "man-in-the-middle" password attacks. It is also reasonable that a failed attempt to disclose a valid challenge credential may trigger a delay period that must pass before another attempt is allowed. This delay period will further limit attempts to brute force unlock the program domain. It is also reasonable that, particularly in the case of multiple third-party implementations, the time limit may force the amount of time allowed to submit the authentication of all designated third parties required to unlock the program domain. This restriction further reduces the risk of a single third-party provider converting its agreed role.

[0099] The exclusive self-hosted approach presented herein assumes two security states in which the PD is independent of the system. The first and highest state is a state in which the Hardware Security Area (HSA) such as the iPhone's Secure Enclave Processor (SEP) and similar hardware devices are combined with system encryption lock via a normal password. The second security state operates without the benefits of HSA, whereby security is managed through system encryption lock via normal password installation. The third state is an unlocked state in which no normal password is installed and no security system is active. While the first and second states of OS encryption are objectively secure from an outsider's perspective, any credential system that relies on these defenses is vulnerable to any known or unknown weaknesses of these systems. By providing methods that include and do not include HSA and / or system encryption, this presentation focuses on delivering the highest level of security that is currently integrated, but is also completely independent of the operating system.

[0100] Certain other embodiments include additional third parties that are authenticated by DO-PD 120 during unlocking of the DO-PD. Thus, for example and without limitation, DO-PD 120 may authenticate each additional third party by the methods described above.

[0101] Multiple third parties

[0102] The present invention is generally described as including a single third party as a TPP. However, typically more than one third party may be involved in the unlocking of the program domain. The messages described herein support multiple unique security containers using credentials with different public keys, where DO encrypts the escrow challenge credentials N times into a single message via P using N unique public keys, so that N third parties are required to disclose their respective valid challenge credentials via P for comparison with the resident credentials. The participation of additional third parties reduces the risk that the TPP may accidentally or intentionally choose to unlock the device without meeting the conditions. The leading third party (TP) candidates come from the TPP group because they are fully involved stakeholders. The complete resident credentials can be matched so that P unlocks the PD. Each copy of the challenge credential can also be placed in its own message. In some embodiments, the escrow password is very suitable for multiple third parties, where authentication is required at the beginning of the unlocking process to confirm the PD and TPP, and due to multiple third parties (TP) and time delays, it is again suitable for authentication when the authentication process is completed, where the PD is then unlocked by the TPP.

[0103] In general, any of the embodiments described herein may be adapted to support any number of third parties, such as but not limited to that shown in the second embodiment.

[0104] Example

[0105] Each embodiment of the exclusive self-hosting method presented herein utilizes different messages (access data) and content, encryption methods (asymmetric and symmetric), and some combination of one-way function credential types to complete the authentication of program domains and third parties. Public key cryptography provides a method to protect the authentication of one-way function credentials, while symmetric cryptography provides a method for generating and protecting one-way function credentials for two-way authentication. Each type of credential exhibits unique functional characteristics that support its role in authentication and focuses on one-way functionality and state expression. HSA (Hardware Security Area) on some devices can replace encrypted messages.

[0106] Several embodiments of the method shown in schematic diagram 100 are now shown in more detail. The following discussion refers to the operation between DO-PD 120, TPP-'PD 110 and TPP-PD 112. It should be understood that the programming of DO-PD 120, such as program P, is stored in memory 233 and executed in processor 234, that DO-PD memory 121 and TPP-PD memory 135 are both within memory 233, and that DO-PD and TPP-'PD 110 communicate via communication cable 220.

[0107] In the following discussion, it should be understood that statements about operations occurring within DO-PD 120, TPP-PD 110, and TPP-PD 112 have the following meanings: DO-PD 120 "creates," "forms," ​​"encrypts," or "decrypts" a message (for example) means that the message is computed using processor 234 and stored in memory 233; DO-PD 120 "hashes" a value (for example) means that the value is submitted to a hash algorithm that produces a hash value using processor 234 and is stored in non-volatile memory 233; DO-PD 120 "uses" a message (for example) means that the entire message or a portion of the content is retrieved from memory 233 for computation in processor 234; DO-PD 120 "copies" or "renames" a message or variable (for example) means that a copy of the message or variable is copied as another message or variable as it is stored in memory 233; DO-PD 120 "stores" a message (for example) means that a copy of the message or variable is stored in DO-PD memory 121; 120 "destroys" or "deletes" a message (for example) meaning that the message is erased from memory 233; DO-PD 120 "provides", "releases" or "discloses" a message (for example) to TPP-PD 112" meaning that the message is copied from memory 233 to TPP-PD memory 135; TPP-PD 110 "creates", "forms", "discloses", "encrypts" or "decrypts" a message (for example) meaning that the message is calculated using processor 215 and is stored in memory 213; TPP-PD 110 "hashes" a number (for example) meaning that the number is hashed using processor 215 and is stored in memory 213; TPP-PD 110 "uses" a message (for example) meaning that the message is retrieved from memory 213 for calculation in processor 215; TPP-PD 110 "copies" or "renames" a message (for example) meaning that a copy of the message is stored in memory 213; TPP-PD 110 provides a message to DO-PD 120 or TPP-PD 112, for example. 112 “provides”, “releases” or “discloses” a message (for example) means that the message is copied from memory 213 to DO-PD memory 121 or TPP-PD memory 135, respectively; TPP-PD 112 “creates”, “forms”, “discloses”, “encrypts” or “decrypts” a message (for example) means that the message is calculated using P using processor 215 of DO-PD 120 and stored in TPP-PD memory 135; TPP-PD 112 “hashes” a number (for example) means that the number is hashed using P using processor 215 of DO-PD 120 and stored in TPP-PD memory 135;TPP-PD 112 "uses" a message (e.g.) meaning that the message is retrieved from TPP-PD memory 135 using P for computation in processor 215 with processor 215 of DO-PD 120; TPP-PD 112 "copies" a message (e.g.) meaning that a copy of the message is stored in TPP-PD memory 135; TPP-PD 112 "provides," "releases," or "discloses" a message (e.g.) to DO-PD 120 or TPP-PD 110 meaning that the message is copied from TPP-PD memory 135 to DO-PD memory 121 or memory 213, respectively; and TPP-PD 112 "stores" a message (e.g. meaning that a copy of the message is stored in TPP-PD memory 135. ;

[0108] As described above, several embodiments are now presented that illustrate various features of an exclusive self-hosting method and system, and Fig.18 Table 1800 is included, which shows the embodiment features in the top row, each embodiment in the right column, and the use of each feature of each embodiment in the body of the table. These features include the use of secure HSA storage, the number of messages exchanged between DO-PD 120 and TTP-PD 110 or TPP-PD 112, methods such as public key encryption, symmetric key encryption, and the total number of encryption methods used, and the use of "A" credential types including passwords and hashed passwords and the use of "B" credential types including shared secret keys or hashed shared secret keys, random numbers, hashed random numbers or random number functions, device identification numbers, and timestamps.

[0109] In general, each embodiment utilizes at least one message, one encryption method, and two types of credentials. And they all use at least one "B" credential type. Except for Example 9, all embodiments use at least one public encryption key pair. Examples 1 and 3 both use HSA (Hardware Security Area), as well as escrow passwords and random numbers as authentication credentials. Examples 1 and 10 to 14 use only public key encryption methods. Examples 2 to 8 utilize public key and symmetric encryption methods. Examples 6, 7, 8, and 14 do not use "A" credential types.

[0110] First embodiment

[0111] First embodiment exclusive self-hosting method in Figure 4 4 is shown as a flowchart 401 and a flowchart 402, wherein flowchart 401 includes steps for locking the DO-PD 120 in blocks 411-419, and wherein flowchart 402 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 401 in blocks 421-437. To help illustrate Figure 4To illustrate the domains in which each block in the DO-PD is executed, the blocks are aligned along the vertical dashed domains labeled TPP-PD 110, TPP-PD 112, and DO-PD 120.

[0112] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 401 as follows.

[0113] In block 411, the TPP 10 creates a TPP key pair as a TPP private key and a TPP public key. The TPP private key is stored in the TPP-PD 110, and the TPP public key is provided to and stored in the DO-PD memory 121.

[0114] In block 412 , after the DO 20 is bonded with the DO-PD 120 , the DO-PD 120 creates a PD key pair using P as a PD private key and a PD public key stored in the DO-PD memory 121 .

[0115] In block 413 , DO-PD 120 uses P to create and store an escrow password.

[0116] In block 414, DO-PD 120 uses P to store a copy of the escrow password as escrow passcode #1 and escrow passcode #2.

[0117] In block 415, DO-PD 120 uses P to encrypt escrow password #2 into message #1 using the TPP public key as described above in the section entitled Encryption.

[0118] In block 416, DO-PD 120 uses P to encrypt the PD public key and message #1 into message #2 using the TPP public key, as described above in the section entitled Encryption.

[0119] In block 417 , DO-PD 120 uses P to store message # 2 and the TPP public key in DO-PD memory 121 .

[0120] In block 418, DO-PD 120 transmits Escrow Password #1 and PD Private Key to the Hardware Secure Area (HSA) using P, as described above.

[0121] In block 419 , DO-PD 120 uses P to delete the escrow password and PD public key.

[0122] After executing block 419, the DO-PD 120 is locked according to the first embodiment exclusive self-hosting method.

[0123] As shown in blocks 125, 126, 127 and 128, the DO-PD 120 locked according to the steps of flowchart 401 may be unlocked according to the steps of flowchart 402 as follows:

[0124] In block 421 , as indicated in block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0125] In block 422 , TPP-PD 110 places DO-PD 120 in managed mode using P and releases message # 2 from DO-PD 120 to TPP-PD 112 , as indicated in block 125 .

[0126] In block 423, TPP-'PD 110 uses P to decrypt Message #2 using the TPP private key, thereby revealing the PD public key and Message #1.

[0127] In block 424, the TPP-'PD 110 creates a temporary (Temp) TPP key pair using P as a temporary TPP private key and a temporary TPP public key, and creates a random number RND#1.

[0128] In block 425 , the TPP-′ PD 110 uses P to encrypt the temporary TPP public key and RND#1 into message #3 using the PD public key, and releases message #3 to the DO-PD 120 .

[0129] In block 426, DO-PD 120 decrypts Message #3 using the PD private key, thereby revealing the temporary TPP public key and RND #1.

[0130] In block 427 , DO-PD 120 uses P to copy RND#1 from block 426 to RND#2.

[0131] In block 428 , DO-PD 120 uses P to encrypt RND#2 into message #4 using the temporary TPP public key and provides message #4 to TPP-′ PD 110 .

[0132] In block 429, TPP-'PD 110 decrypts Message #4 using P using the temporary TPP private key, thereby revealing RND #2.

[0133] Then, box 430 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential RND#1 from box 424 and the challenge credential RND#2 from box 429. If the correct key was used when determining the credentials, then in box 430, RND#1 and RND#2 are the same. Therefore, in box 430, TPP-'PD 110 uses P to compare RND#1 and RND#2. If RND#1 is equal to RND#2, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 430 is "Y", and if RND#1 is not equal to RND#2, the authentication fails and the result of box 430 is "N".

[0134] If the result of block 430 is “N”, then the authentication has failed and execution of unlocking of the DO-PD 120 stops at block 431 .

[0135] If the result of block 430 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110 and unlocking proceeds to block 432 where TPP-PD 112 decrypts Message #1 using the TPP private key, thereby revealing Escrow Password #2.

[0136] In block 433 , TPP-PD 112 uses P to encrypt escrow password #2 into message #5 using the PD public key and provides message #5 to DO-PD 120 .

[0137] In block 434, DO-PD 120 decrypts message #5 using P using the PD private key to reveal escrow password #2.

[0138] Then, block 435 performs a test whereby DO-PD 120 authenticates TPP-' PD 110. Specifically, DO-PD 120 uses P to compare the resident credential escrow password #1 from block 418 and the challenge credential escrow password #2 from block 434. If the correct key was used when determining the credentials, then in block 435, escrow password #1 and escrow password #2 are the same. Therefore, in block 435, DO-PD 120 uses P to compare escrow password #1 with escrow password #2. If escrow password #1 is equal to escrow password #2, then TPP-' PD 110 is authenticated by DO-PD 120 and the result of block 435 is "Y", while if escrow password #1 is not equal to escrow password #2, the result of block 435 is "N".

[0139] If the result of block 435 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 436 .

[0140] If the result of block 435 is "Y", then all authentications have passed and unlocking proceeds to block 437 where the DO-PD 120 uses P to unlock the DO-PD.

[0141] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0142] Second embodiment

[0143] Second embodiment of the exclusive self-hosting method Figure 5 501 and 502, wherein flowchart 401 includes steps for locking DO-PD 120 in blocks 511-526, and wherein flowchart 402 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 501 in blocks 527-549. Except as expressly noted, the second embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiment.

[0144] This embodiment shows a second third party, denoted "TP", having devices with TP-'DP partitions similar to the TPP-'PD partitions.

[0145] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 501 as follows.

[0146] In block 511 , the TPP-PD 110 creates a TPP key pair as a TPP private key and a TPP public key, and creates a symmetric TPP key pair as a symmetric TPP private key and a symmetric TPP public key, and provides the TPP public key and the symmetric TPP public key to the DO-PD 120 .

[0147] In block 512 , the TP-PD creates a symmetric TP key pair as a symmetric TP private key and a symmetric TP public key, and provides the symmetric TP public key to the DO-PD 120 .

[0148] In box 513, DO-PD 120 uses P to create symmetric PD key pair #1 as symmetric PD private key #1 and symmetric PD public key #1, creates symmetric PD key pair #2 as symmetric PD private key #2 and symmetric PD public key #2, creates symmetric PD key pair #3 as symmetric PD private key #3 and symmetric PD public key #3, and creates a PD key pair as the PD public key and the PD private key.

[0149] In block 514, DO-PD 120 uses P to create an escrow password from the generated random number.

[0150] In block 515, DO-PD 120 replicates the escrow cryptogram using P to form escrow cryptogram #1 and escrow cryptogram #2.

[0151] In block 516, DO-PD 120 uses P to create a shared secret key SSK#1 using the symmetric PD private key #1 and the symmetric TPP public key.

[0152] In block 517, DO-PD 120 uses P to create a shared secret key SSK#2 using the symmetric PD private key #2 and the symmetric TPP public key.

[0153] In block 518, DO-PD 120 uses P to create a shared secret key SSK#3 using the symmetric PD private key #3 and the symmetric TP public key.

[0154] In block 519, DO-PD 120 hashes SSK#2 into HSSK#2 using P.

[0155] In block 520, DO-PD 120 uses P to hash SSK#3 into HSSK#3.

[0156] In block 521, DO-PD 120 uses P to encrypt Escrow Password #1 into Message #1 using the PD public key.

[0157] In block 522, DO-PD 120 uses P to encrypt the escrow password #2 and the PD private key using SSK #1 into message #2.

[0158] In block 523, DO-PD 120 uses P to encrypt device ID #1, symmetric PD public key #1, and symmetric PD public key #2 into message #3 using the TPP public key.

[0159] In block 524, DO-PD 120 uses P to encrypt SSK#1 using SSK#2 into Message#4.

[0160] In block 525 , DO-PD 120 uses P to store Message # 1 , Message # 2 , Message # 3 , Message # 4 , HSSK # 2 , and HSSK # 3 in DO-PD memory 121 .

[0161] In block 526, DO-PD 120 uses P to destroy the escrow password, symmetric PD private key #1, symmetric PD private key #2, symmetric PD private key #3, symmetric PD public key #2, symmetric PD public key #3, SSK #1, SSK #2, and SSK #3.

[0162] After executing block 526, the DO-PD 120 is locked according to the second embodiment exclusive self-hosting method.

[0163] As indicated by blocks 125 , 126 , 127 , and 128 , the DO-PD 120 that was locked according to the steps of flowchart 501 may be unlocked according to the steps of flowchart 502 , as follows.

[0164] In block 527 , as indicated in block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0165] In block 528 , the TPP-′ PD 110 places the DO-PD 120 in managed mode using P and releases Message # 3 to the DO-PD 120 , as indicated in block 125 .

[0166] In block 529 , DO-PD 120 uses P to encrypt device ID # 2 and the current device time of DO-PD (time # 1 , Time # 1 ) into message # 5 using the TPP public key, and releases message # 5 and message # 3 to TPP-PD 112 .

[0167] In block 530, TPP-PD 112 decrypts message #5 using P using the TPP private key, revealing device ID #2 and time #1.

[0168] Then, box 531 performs a test to determine that the preset time limit has not passed since the unlock. Specifically, TPP-PD 112 uses P to compare the resident credential time #1 and the current device time, i.e., the challenge credential actual time. If the preset amount of time has not been exceeded, the unlock will proceed. Therefore, in box 531, TPP-PD 112 uses P to compare time #1 with the actual time. If |time #1-actual time|≤preset time, the result of box 531 is "Y", then the unlock was timely, and if |time #1-T|>M, too much time has passed, and the result of box 531 is "N".

[0169] If the result of block 531 is “N”, then the authentication has failed and execution of unlocking of the DO-PD 120 stops at block 532 .

[0170] If the result of block 531 is "Y", then DO-PD 120 unlock proceeds to block 533 and TPP-'PD uses P to decrypt message #3 using the TPP private key, revealing device ID #1, symmetric PD public key #1, and symmetric PD public key #2.

[0171] Then, box 534 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential device ID#1 from box 533 and the challenge credential device ID#2 from box 530. If the correct key was used when determining the credentials, then in box 534, device ID#1 and device ID#2 are the same. Therefore, in box 534, TPP-'PD 110 uses P to compare device ID#1 with device ID#2. If device ID#1 is equal to device ID#2, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 534 is "Y", while if device ID#1 is not equal to device ID#2, the authentication fails and the result of box 534 is "N".

[0172] If the result of block 534 is "N", then authentication has failed and execution of unlocking of the DO-PD 120 stops at block 535.

[0173] If the result of block 534 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110, and unlocking proceeds to block 536, where TPP-PD 112 uses P to create a shared secret key SSK#4 using the symmetric TPP private key and asymmetric public key#2.

[0174] In block 537, TPP-PD 112 hashes SSK#4 into HSSK#4 and provides both to DO-PD.

[0175] Then, block 538 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential HSSK#2 from block 615 with the challenge credential HSSK#4 from block 633. If the correct key was used when determining the credentials, then in block 538, HSSK#2 and HSSK#4 are the same. Therefore, in block 538, DO-PD 120 uses P to compare HSSK#2 with HSSK#4. If HSSK#2 is equal to HSSK#4, TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 538 is "Y", while if HSSK#2 is not equal to HSSK#4, the result of block 538 is "N".

[0176] If the result of block 538 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 539 .

[0177] If the result of block 538 is "Y", then the TPP has been authenticated and unlock proceeds to block 540 to begin authentication of the TP, and where TP-PD uses P to create a shared secret key SK#5 using the symmetric TP private key and symmetric PD public key #3.

[0178] In block 541 , the TP-PD uses P to hash SSK#5 into HSSK#5, which is provided to the DO-PD 120 .

[0179] In block 542, DO-PD 120 compares HSSK#3 and HSSK#5 using P, where the authentication TP matches.

[0180] Then, block 542 performs a test whereby DO-PD 120 authenticates the second third party TP. Specifically, DO-PD 120 uses P to compare the resident credential HSSK#3 from block 525 with the challenge credential HSSK#5 from block 541. If the correct key was used when determining the credential, then in block 542, HSSK#3 and HSSK#5 are the same. Therefore, in block 538, DO-PD 120 uses P to compare HSSK#3 with HSSK#5. If HSSK#3 is equal to HSSK#5, then TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 542 is "Y", while if HSSK#3 is not equal to HSSK#5, the result of block 542 is "N".

[0181] If the result of block 542 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 543 .

[0182] If the result of block 542 is "Y", then DO and third party authentication have passed, and unlocking proceeds to block 544, where DO-PD 120 uses P to decrypt Message #4 using SSK #4, revealing SSK #1.

[0183] In block 545, DO-PD 120 decrypts Message #2 using P using SSK #1, revealing Escrow Password #2 and the PD Private Key.

[0184] In block 546, DO-PD 120 decrypts Message #1 using P using the PD private key, revealing Escrow Password #1.

[0185] Then, box 547 performs a second test, whereby DO-PD 120 authenticates TPP-'PD 110. The second authentication of TPP is performed to account for the additional time and activity of additional third-party authentication. Specifically, DO-PD 120 uses P to compare the resident credential escrow password #1 from box 546 and the challenge credential escrow password #2 from box 545. If the correct key was used when determining the credentials, then in box 547, escrow password #1 and escrow password #2 are the same. Therefore, in box 742, DO-PD 120 uses P to compare escrow password #1 with escrow password #2. If escrow password #1 is equal to escrow password #2, TPP-'PD 110 is authenticated by DO-PD 120 and the result of box 547 is "Y", while if escrow password #1 is not equal to escrow password #2, the result of box 547 is "N".

[0186] If the result of block 547 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 548 .

[0187] If the result of block 547 is "Y", then the authentication steps have all been successful and unlocking proceeds to block 744 where the DO-PD 120 uses P to unlock the DO-PD.

[0188] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0189] Third embodiment

[0190] The third embodiment of the exclusive self-hosting method is Figure 6601 and 602, wherein flowchart 601 includes steps for locking DO-PD 120 in blocks 611-618, and wherein flowchart 602 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 601 in blocks 620-636. Except as explicitly noted, the third embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiment.

[0191] As shown in blocks 122, 123, and 124, the DO-PD 120 may be locked according to the steps of flowchart 601 as follows:

[0192] In block 611 , the TPP-′ PD 110 creates a TPP key pair as a TPP private key and a TPP public key, creates a symmetric TPP key pair as a symmetric TPP private key and a symmetric TPP public key, and provides the TPP public key and the symmetric TPP public key to the DO-PD 120 .

[0193] In block 612, after DO 20 interfaces with DO-PD 120, DO-PD 120 creates a PD key pair using P as a PD private key and a PD public key, and creates a symmetric PD key pair as a symmetric PD private key and a symmetric PD public key.

[0194] In block 613, DO-PD 120 creates a first escrow shared secret key (ESSK#1) using P using the symmetric PD private key and the symmetric TPP public key.

[0195] In block 614 , DO-PD 120 hashes ESSK# 1 using P to form Credential Escrow Password # 1 .

[0196] In block 615 , DO-PD 120 stores escrow password # 1 to a hardware secure area (HSA) within memory 233 .

[0197] In block 616, DO-PD 120 encrypts the symmetric PD public key using the TPP public key to form Message #1.

[0198] In block 617 , the DO-PD 120 stores the message # 1 , the PD private key, the PD public key, and the TPP public key in the DO-PD 120 .

[0199] In block 618 , DO-PD 120 deletes the symmetric PD key pair, ESSK# 1 and Escrow Password # 1 , from DO-PD 120 .

[0200] After executing block 618, the DO-PD 120 is locked according to the third embodiment exclusive self-hosting method.

[0201] As indicated by blocks 125 , 126 , 127 , and 128 , the DO-PD 120 that was locked according to the steps of flowchart 601 may be unlocked according to the steps of flowchart 602 , as follows.

[0202] In block 620 , as indicated in block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0203] In block 621 , TPP-'PD 110 uses P to place the program domain into managed mode and retrieves message #1 and the PD public key from DO-PD 120 , as indicated in block 125 .

[0204] In block 622, TPP-'PD 110 creates a temporary TPP private key and a temporary TPP public key using P and RND#1.

[0205] In block 623 , the TPP-PD 110 encrypts the temporary TPP public key and RND#1 using the PPD public key to form message #2, and releases message #2 to the DO-PD 120 .

[0206] In block 624, DO-PD 120 decrypts Message #2 using the PPD private key to reveal the temporary TPP public key and RND #1.

[0207] In block 625 , DO-PD 120 uses P to rename RND#1 from block 624 to RND#2.

[0208] In block 626 , DO-PD 120 encrypts RND#2 using P using the temporary TPP public key to form message #3 and releases message #3 to TPP-′ PD 110 .

[0209] In block 627, TPP-'PD 110 decrypts Message #3 using P using the temporary TPP private key to reveal RND #2.

[0210] Then, box 628 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential RND#1 from box 622 and the challenge credential RND#2 from box 627. If the correct key was used when determining the credentials, then in box 628, RND#1 and RND#2 are the same. Therefore, in box 628, TPP-'PD 110 uses P to compare RND#1 with RND#2. If RND#1 is equal to RND#2, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 628 is "Y", and if RND#1 is not equal to RND#2, the authentication fails and the result of box 628 is "N".

[0211] If the result of block 628 is “N”, then the authentication has failed and execution of the unlocking of the DO-PD 120 stops at block 629 .

[0212] If the result of block 628 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110, and unlocking proceeds to block 630, where TPP-PD 112 decrypts Message #1 using the P using the TPP private key to reveal the symmetric PD public key.

[0213] In block 631, TPP-PD 112 uses P to compute ESSK#2 from the symmetric PD public key and the symmetric TPP private key.

[0214] In block 632, TPP-PD 112 hashes ESSK#2 using P to form Escrow Password #2.

[0215] In block 633 , TPP-PD 112 provides escrow password # 2 to DO-PD 120 using P.

[0216] Then, block 634 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential escrow password #1 from block 615 and the challenge credential escrow password #2 from block 633. If the correct key was used when determining the credentials, then in block 634, escrow password #1 and escrow password #2 are the same. Therefore, in block 634, DO-PD 120 uses P to compare escrow password #1 with escrow password #2. If escrow password #1 is equal to escrow password #2, then TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 634 is "Y", while if escrow password #1 is not equal to escrow password #2, the result of block 634 is "N".

[0217] If the result of block 634 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 635 .

[0218] If the result of block 634 is "Y," then all authentications have passed, and unlocking proceeds to block 636, where the DO-PD 120 uses P to unlock the DO-PD.

[0219] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0220] Fourth embodiment

[0221] Fourth embodiment exclusive self-hosting method in Figure 7701 and 702, wherein flowchart 601 includes steps for locking DO-PD 120 in blocks 711-721, and wherein flowchart 702 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 701 in blocks 723-744. Except as explicitly noted, the fourth embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiments.

[0222] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 701 as follows.

[0223] In block 711 , the TPP-PD 110 creates a TPP key pair as a TPP private key and a TPP public key, creates a symmetric TPP key pair as a symmetric TPP private key and a symmetric TPP public key, and provides the TPP public key and the symmetric TPP public key to the DO-PD 120 .

[0224] In box 712, after DO 20 is joined with DO-PD 120, DO-PD 120 uses P to create symmetric PD domain key pair #1 as symmetric PD private key #1 and symmetric PD public key #1, creates symmetric PD key pair #2 as symmetric PD private key #2 and symmetric PD public key #2, and creates symmetric PD key pair #3 as symmetric PD private key #3 and symmetric PD public key #3.

[0225] In block 713, DO-PD 120 uses P to create a shared secret key ESSK#1 using the symmetric PD private key #1 and the symmetric TPP public key.

[0226] In block 714 , DO-PD 120 hashes ESSK# 1 using P to form Escrow Password # 1 .

[0227] In block 715, DO-PD 120 uses P to create a first shared secret key SSK#1 using the symmetric PD private key #2 and the TPP public key.

[0228] In block 716, DO-PD 120 uses P to create a second shared secret key SSK#2 using the symmetric PD private key #3 and the TPP public key.

[0229] In block 717, DO-PD 120 hashes SSK#1 using P to form HSSK#1, and hashes SSK#2 to form HSSK#2.

[0230] In block 718, DO-PD 120 encrypts Escrow Cryptogram #1 using P using SSK #1 to form Message #1.

[0231] In block 719, DO-PD 120 uses P to encrypt symmetric PD public key #1, symmetric PD public key #2, symmetric PD public key #3, and HSSK #1 from message #2.

[0232] In block 720 , DO-PD 120 uses P to store Message #1, Message #2, and HSSK #2 in memory 233 of DO-PD 120 .

[0233] In block 721, DO-PD 120 uses P to delete Escrow Cryptogram #1, Symmetric PD Private Key #1, Symmetric PD Private Key #2, Symmetric PD Private Key #3, Symmetric PD Public Key #1, Symmetric PD Public Key #2, Symmetric PD Public Key #3, SSK #1, SSK #2, and HSSK #1.

[0234] After executing block 721 , the DO-PD 120 is locked according to the fourth embodiment exclusive self-hosting method.

[0235] As shown in blocks 125, 126, 127 and 128, the DO-PD 120 that was locked according to the steps of flowchart 701 may be unlocked according to the steps of flowchart 702 as follows:

[0236] In block 723 , as indicated in block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0237] In block 724 , the TPP-′ PD 110 uses P to place the DO-PD 120 in managed mode as indicated in block 125 .

[0238] In block 725, DO-PD 120 creates a PD key pair using P as a PD private key and a PD public key.

[0239] In block 726 , DO-PD 120 uses P to store the identification code ID#1 of the DO-PD, encrypts ID#1 and the PD public key using the TPP public key to form message #3, and releases the TPP public key and message #3 to TPP-PD 112 .

[0240] In block 727, TPP-PD 112 decrypts Message #3 using TPP private key P, revealing ID #1 renamed to ID #2 and the PD public key.

[0241] In block 728 , the TPP-PD 112 encrypts ID # 2 using the P PD public key to form message # 4 , and releases message # 4 to the DO-PD 120 .

[0242] In block 729, DO-PD 120 decrypts Message #4 using the PD private key to reveal ID #2.

[0243] Then, block 730 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential ID#1 from block 726 and the challenge credential ID#2 from block 729. If the correct key was used when determining the credentials, then in block 730, ID#1 and ID#2 are the same. Therefore, in block 730, DO-PD 120 uses P to compare ID#1 with ID#2. If ID#1 is equal to ID#2, TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 730 is "Y", while if ID#1 is not equal to ID#2, the result of block 730 is "N".

[0244] If the result of block 730 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 731 .

[0245] If the result of box 730 is "Y", TPP-'PD 110 is authenticated by DO-PD 120 and unlocking proceeds to box 733, where TPP-'PD 110 uses P to decrypt message #2 using TPP private key to disclose symmetric PD public key #1, symmetric PD public key #2, symmetric PD public key #3 and HSSK #1.

[0246] In block 734, TPP-'PD 110 uses P to create SSK #3 using the TPP private key and the symmetric PD public key #2.

[0247] In block 735, TPP-'PD 110 hashes SSK#3 using P to form HSSK#3.

[0248] Then, box 736 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential HSSK#1 from box 733 and the challenge credential HSSK#3 from box 735. If the correct key was used when determining the credentials, then in box 736, HSSK#1 and HSSK#3 are the same. Therefore, in box 736, TPP-'PD110 uses P to compare HSSK#1 with HSSK#3. If HSSK#1 is equal to HSSK#3, DO-PD 120 is authenticated by TPP-'PD110 and the result of box 736 is "Y", and if HSSK#1 is not equal to HSSK#3, the authentication fails and the result of box 736 is "N".

[0249] If the result of block 736 is “N”, then the authentication has failed and execution of the unlocking of the DO-PD 120 stops at block 737 .

[0250] If the result of block 736 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110, and unlocking proceeds to block 738, where TPP-PD 112 computes a shared secret key ESSK#2 using the symmetric PD public key #1 and the symmetric TPP private key.

[0251] In block 739 , TPP-PD 112 hashes ESSK#2 using P to form Escrow Password#2.

[0252] In block 740 , TPP-PD 112 releases SSK# 3 and Escrow Password# 2 to DO-PD 120 .

[0253] In block 741, DO-PD 120 decrypts Message #1 using P using SSK #3 to reveal Escrow Password #1.

[0254] Then, box 742 performs a second test, whereby DO-PD 120 authenticates TPP-'PD 110. The second authentication of TPP is performed to account for the additional time and activity of additional third-party authentication. Specifically, DO-PD 120 uses P to compare the resident credential escrow password #1 from box 741 and the challenge credential escrow password #2 from box 740. If the correct key was used when determining the credentials, then in box 742, escrow password #1 and escrow password #2 are the same. Therefore, in box 742, DO-PD 120 uses P to compare escrow password #1 with escrow password #2. If escrow password #1 is equal to escrow password #2, TPP-'PD110 is authenticated by DO-PD 120 and the result of box 742 is "Y", while if escrow password #1 is not equal to escrow password #2, the result of box 742 is "N".

[0255] If the result of block 742 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 743 .

[0256] If the result of block 742 is "Y", then the authentication steps have all been successful and unlocking proceeds to block 744 where the DO-PD 120 uses P to unlock the DO-PD.

[0257] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0258] Fifth embodiment

[0259] Fifth embodiment exclusive self-hosting method Figure 8801 and 802, wherein flowchart 801 includes steps for locking DO-PD 120 in blocks 811-826, and wherein flowchart 802 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 801 in blocks 828-852. Except as explicitly noted, the fifth embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiments.

[0260] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 801 as follows.

[0261] In block 811 , the TPP-PD 110 creates a TPP key pair as a TPP private key and a TPP public key, creates a symmetric TPP key pair as a symmetric TPP private key and a symmetric TPP public key, and provides the TPP public key and the symmetric TPP public key to the DO-PD 120 .

[0262] In box 812, after DO 20 is coupled with DO-PD 120, DO-PD 120 uses P to create symmetric PD key pair #1 as symmetric PD private key #1 and symmetric PD public key #1, creates symmetric key pair #2 as symmetric PD private key #2 and symmetric PD public key #2, creates symmetric key pair #3 as symmetric PD private key #3 and symmetric PD public key #3, and creates symmetric key pair #4 as symmetric PD private key #4 and symmetric PD public key #4.

[0263] In block 813, DO-PD 120 uses P to create an escrow shared secret key ESSK#1 from the symmetric PD private key #1 and the symmetric TPP public key.

[0264] In block 814, DO-PD 120 hashes ESSK#1 using P to form an escrow password.

[0265] In block 815, DO-PD 120 uses P to copy the escrow password to escrowpasscode#1copy#1.

[0266] In block 816, DO-PD 120 uses P to create a shared secret key SSK#3 using the symmetric PD private key #3 and the symmetric TPP public key.

[0267] In block 817, DO-PD 120 uses P to create a shared secret key SSK#4 using the symmetric PD private key #4 and the symmetric TPP public key.

[0268] In block 818, DO-PD 120 hashes SSK #3 using P to form HSSK #1, and hashes SSK #4 to form HSSK #2.

[0269] In block 819 , DO-PD 120 uses P to copy symmetric PD private key #2 to symmetric PD private key #2 copy #1.

[0270] In block 820, DO-PD 120 encrypts Symmetric PD Private Key #2 Copy #1 using P using ESSK #1 to form Message #2.

[0271] In block 821 , DO-PD 120 uses P to create a shared secret key SSK#2 using the symmetric PD private key #2 and the symmetric PD public key #2.

[0272] In block 822, DO-PD 120 uses P to encrypt symmetric PD public key #2, symmetric PD public key #3, symmetric PD public key #4, and HSSK #1 using the TPP public key to form message #4.

[0273] In block 823, DO-PD 120 encrypts the symmetric PD private key #1 using P using the TPP public key to form message #5.

[0274] In block 824, DO-PO 120 encrypts Escrow Cryptogram #1 Copy #1 using P using SSK #2 to form Message #1.

[0275] In box 825, DO-PD 120 uses P to delete symmetric PD private key #1, symmetric PD private key #2, symmetric PD private key #3, symmetric PD private key #4, symmetric PD public key #1, symmetric PD public key #2, symmetric PD public key #3, symmetric PD public key #4, ESSK #1, SSK #2 and the escrow password.

[0276] In block 826 , DO-PO 120 uses P to store Message #1, Message #2, Message #4, Message #5, and HSSK #2 in DO-PD 120 .

[0277] After executing block 826, the DO-PD 120 is locked according to the fifth embodiment exclusive self-hosting method.

[0278] As indicated by blocks 125 , 126 , 127 , and 128 , the DO-PD 120 that was locked according to the steps of flowchart 801 may be unlocked according to the steps of flowchart 802 , as follows.

[0279] In block 828 , as indicated at block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0280] In block 829 , as indicated in block 125 , the TPP-′ PD 110 uses P to place the DO-PD 120 in managed mode.

[0281] In block 830 , DO-PD 120 creates a PD key pair using P as a PD private key and a PD public key.

[0282] In block 831 , DO-PD 120 creates a random number RND#1 using P, encrypts RND#1 and the PD public key using the TPP public key to form message #6, and releases the TPP public key and message #6 to TPP-PD 110 .

[0283] In block 832, TPP-'PD 110 decrypts Message #6 using P using the TPP public key to reveal RND #1 and the PD public key stored as RND #2.

[0284] In block 833 , the TPP-′ PD 110 encrypts RND#2 using the PPD public key to form message#7 and releases message#7 to the DO-PD 120 .

[0285] In block 834, DO-PD 120 decrypts Message #7 using the PD private key to reveal RND #2.

[0286] Then, block 835 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential RND#1 from block 831 with the challenge credential RND#2 from block 834. If the correct key was used when determining the credentials, then in block 835, RND#1 and RND#2 are the same. Therefore, in block 835, DO-PD 120 uses P to compare RND#1 with RND#2. If RND#1 is equal to RND#2, TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 835 is "Y", while if RND#1 is not equal to RND#2, the result of block 835 is "N".

[0287] If the result of block 836 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 836 .

[0288] If the result of block 836 is “Y”, then TPP-′ PD 110 is authenticated by DO-PD 120 and unlocking proceeds to block 837 where DO-PD 120 releases Message #4 and Message #5 to TPP-′ PD 110 using P.

[0289] In box 838, TPP-'PD 110 uses P to decrypt message #4 using the TPP private key to reveal symmetric PD public key #2, symmetric PD public key #3, symmetric PD public key #4 and HSSK #1, and also creates a shared secret key SSK #5 using the symmetric TPP private key and symmetric PD public key #3.

[0290] In block 839, TPP-'PD 110 hashes SSK#5 using P to form HSSK#3.

[0291] Then, box 840 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential HSSK#1 from box 838 and the challenge credential HSSK#3 from box 839. If the correct key was used when determining the credentials, then in box 840, HSSK#1 and HSSK#3 are the same. Therefore, in box 840, TPP-'PD110 uses P to compare HSSK#1 with HSSK#3. If HSSK#1 is equal to HSSK#3, DO-PD 120 is authenticated by TPP-'PD110 and the result of box 840 is "Y", and if HSSK#1 is not equal to HSSK#2, the authentication fails and the result of box 840 is "N".

[0292] If the result of block 840 is “N”, then the authentication has failed and execution of unlocking of the DO-PD 120 stops at block 841 .

[0293] If the result of block 840 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110, and unlocking proceeds to block 842, where TPP-PD 112 decrypts message #5 using the TPP private key to reveal symmetric PD private key #1.

[0294] In block 843, TPP-PD 112 uses P to create a shared secret key SSK#6 using the TPP private key and the symmetric PD public key #4.

[0295] In block 844, TPP-PD 112 uses P to create a shared secret key ESSK#3 using the TPP private key and the symmetric PD public key #1.

[0296] In block 845 , TPP-PD 112 encrypts symmetric PD private key # 1 and ESSK # 3 using P using SSK # 6 to form message # 3 , and releases SSK # 6 and message # 3 to DO-PD 120 .

[0297] In block 846, DO-PD 120 decrypts Message #3 using P using SSK #6 to reveal Symmetric PD Private Key #1 and ESSK #3.

[0298] In block 847, DO-PD 120 hashes ESSK #3 to form Escrow Password #2.

[0299] In block 848, DO-PD 120 decrypts Message #2 using P using ESSK #3 to reveal Symmetric PD Private Key #2 Copy #1.

[0300] In block 849 , DO-PD 120 uses P to create a shared secret key SSK#2 from symmetric PD private key #2 copy #1 and symmetric PD public key #2.

[0301] In block 850, DO-PD 120 decrypts Message #1 using P using SSK #2 to disclose Escrow Cryptogram #1 Copy #1 stored as Escrow Cryptogram #1.

[0302] Then, block 851 performs a second test whereby DO-PD 120 authenticates TPP-'PD 110 to account for the additional time and activity of the additional third-party authentication. Specifically, DO-PD 120 uses P to compare the resident credential escrow password #1 from block 850 and the challenge credential escrow password #2 from block 847. If the correct key was used when determining the credentials, then in block 851, escrow password #1 and escrow password #2 are the same. Therefore, in block 851, DO-PD 120 uses P to compare escrow password #1 with escrow password #2. If escrow password #1 is equal to escrow password #2, then TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 851 is "Y", while if escrow password #1 is not equal to escrow password #2, the result of block 851 is "N".

[0303] If the result of block 851 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 853 .

[0304] If the result of block 851 is "Y", then all authentications have passed and unlocking proceeds to block 852 where the DO-PD 120 uses P to unlock the DO-PD.

[0305] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0306] Sixth embodiment

[0307] Sixth embodiment of the exclusive self-hosting method Fig. 9 901 and 902, wherein flowchart 901 includes steps for locking the DO-PD 120 in blocks 911-918, and wherein flowchart 902 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 901 in blocks 920-940. Except as explicitly noted, the sixth embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiment.

[0308] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 901 as follows.

[0309] In block 911 , the TPP-PD 110 creates a TPP key pair as a TPP private key and a TPP public key, creates a symmetric TPP key pair as a symmetric TPP private key and a symmetric TPP public key, and provides the TPP public key and the symmetric TPP public key to the DO-PD 120 .

[0310] In block 912, after DO 20 is joined with DO-PD 120, DO-PD 120 uses P to create symmetric PD key pair #1 as symmetric PD private key #1 and symmetric PD public key #1, and creates symmetric PD key pair #2 as symmetric PD private key #2 and symmetric PD public key #2.

[0311] In block 913, DO-PD 120 uses P to create a shared secret key SSK#1 using the symmetric PD private key #1 and the symmetric TPP public key.

[0312] In block 914, DO-PD 120 uses P to create a shared secret key SSK#2 using the symmetric PD private key #2 and the symmetric TPP public key.

[0313] In block 915, DO-PD 120 hashes SSK#1 using P to form HSSK#1, and hashes SSK#2 to form HSSK#2.

[0314] In block 916, DO-PD 120 uses P to encrypt symmetric PD public key #1, symmetric PD public key #2, and HSSK #1 into message #1 using the TPP public key.

[0315] In block 917, DO-PD 120 uses P to store Message #1 and HSSK #2.

[0316] In block 918, DO-PD 120 uses P to delete symmetric PD key pair #1, symmetric PD key pair #2, SSK #1, SSK #2, and HSSK #1.

[0317] After executing block 918, the DO-PD 120 is locked according to the sixth embodiment exclusive self-hosting method.

[0318] As indicated by blocks 125 , 126 , 127 , and 128 , the DO-PD 120 that was locked according to the steps of flowchart 901 may be unlocked according to the steps of flowchart 902 , as follows.

[0319] In block 920 , as indicated at block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0320] In block 921 , as indicated in block 125 , the TPP-'PD 110 uses P to place the DO-PD 120 in managed mode.

[0321] In block 922 , DO-PD 120 creates a symmetric PD key pair # 3 as a symmetric PD private key # 3 and a symmetric PD public key # 3 , and creates a PD key pair as a PD private key and a PD public key.

[0322] In block 923, DO-PD 120 uses P to create a shared secret key SSK#5 using the symmetric PD private key #3 and the symmetric TPP public key.

[0323] In block 924 , DO-PD 120 releases the symmetric TPP public key, PD public key, and symmetric PD public key #3 to TPP-′ PD 110 using P.

[0324] In block 925, TPP-'PD 110 uses P to create a shared secret key SSK#6 using the symmetric PD public key #3 and the symmetric TPP private key.

[0325] In block 926 , the TPP-′ PD 110 encrypts SSK#6 using the PPD public key to form Message#2 and releases Message#2 to the DO-PD 120 .

[0326] In block 927, DO-PD 120 decrypts Message #2 with the PD private key to reveal SSK #6.

[0327] Then, block 928 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare resident credential SSK#5 from block 923 and challenge credential SSK#6 from block 927. If the correct key was used when determining the credentials, then in block 928, SSK#5 and SSK#6 are the same. Therefore, in block 928, DO-PD 120 uses P to compare SSK#5 with SSK#6. If SSK#5 is equal to SSK#6, TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 928 is "Y", while if Escrow Password #1 is not equal to Escrow Password #2, the result of block 928 is "N".

[0328] If the result of block 928 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 931 .

[0329] If the result of block 928 is “Y”, then TPP-′ PD 110 is authenticated by DO-PD 120 and unlocking proceeds to block 929 where DO-PD 120 releases Message # 1 to TPP-′ PD 110 using P.

[0330] In block 930, TPP-'PD 110 decrypts Message #1 using P using the TPP private key to reveal Symmetric PD Public Key #1, Symmetric PD Public Key #2, and HSSK #1.

[0331] In block 932, TPP-'PD 110 uses P to create a shared secret key SSK#3 using the symmetric TPP private key and the symmetric PD public key #1.

[0332] In block 933, TPP-'PD 110 hashes SSK#3 using P to form HSSK#3.

[0333] Then, box 934 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential HSSK#1 from box 930 and the challenge credential HSSK#3 from box 933. If the correct key was used when determining the credentials, then in box 934, HSSK#1 and HSSK#3 are the same. Therefore, in box 934, TPP-'PD110 uses P to compare HSSK#1 with HSSK#3. If HSSK#1 is equal to HSSK#3, DO-PD 120 is authenticated by TPP-'PD110 and the result of box 934 is "Y", and if HSSK#1 is not equal to HSSK#3, the authentication fails and the result of box 934 is "N".

[0334] If the result of block 934 is “N”, then authentication has failed and execution of unlocking of the DO-PD 120 stops at block 935 .

[0335] If the result of block 934 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110, and unlocking proceeds to block 936, where TPP-PD 112 decrypts message #5 using the TPP private key to reveal symmetric PD private key #1.

[0336] In block 937, DO-PD 120 hashes SSK#4 using P to form HSSK#4.

[0337] Then, box 938 performs a second test, whereby DO-PD 120 authenticates TPP-'PD 110. The second authentication of TPP is performed to account for the additional time and activity of authenticating an additional third party. Specifically, DO-PD 120 uses P to compare the resident credential HSSK#2 from box 917 and the challenge credential HSSK#4 from box 937. If the correct key was used when determining the credential, then in box 938, HSSK#2 and HSSK#4 are the same. Therefore, in box 938, DO-PD 120 uses P to compare HSSK#2 with HSSK#4. If HSSK#2 is equal to HSSK#4, TPP-'PD 110 is authenticated by DO-PD 120 and the result of box 938 is "Y", and if HSSK#2 is not equal to HSSK#4, the result of box 938 is "N".

[0338] If the result of block 938 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 939 .

[0339] If the result of block 938 is "Y," then all authentications have passed, and unlocking proceeds to block 940, where the DO-PD 120 uses P to unlock the DO-PD.

[0340] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0341] Seventh embodiment

[0342] Seventh embodiment of the exclusive self-hosting method Fig.101001 and 1002, wherein flowchart 1001 includes steps for locking DO-PD 120 in blocks 1101-1018, and wherein flowchart 1002 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 1001 in blocks 1020-1039. Except as explicitly noted, the seventh embodiment exclusive self-hosting method is generally similar to the aforementioned embodiment exclusive self-hosting method.

[0343] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 1001 as follows.

[0344] In block 1011 , the TPP-PD 110 creates a TPP key pair as a TPP private key and a TPP public key, creates a symmetric TPP key pair as a symmetric TPP private key and a symmetric TPP public key, and provides the TPP public key and the symmetric TPP public key to the DO-PD 120 .

[0345] In block 1012 , after DO 20 is bonded with DO-PD 120 , DO-PD 120 creates a symmetric PD key pair using P as a symmetric PD private key and a symmetric PD public key.

[0346] In block 1013, DO-PD 120 uses P to create SSK#1 using the symmetric PD private key and the symmetric TPP public key.

[0347] In block 1014 , DO-PD 120 uses P to create a random number RND#1.

[0348] In block 1015, DO-PD 120 uses P to hash SSK#1 into HSSK#1 and RND#1 into HRND#2.

[0349] In block 1016, DO-PD 120 uses P to encrypt HSSK #1, RND #1, and the symmetric PD public key into Message #1 using the TPP public key.

[0350] In block 1017 , DO-PD 120 stores Message # 1 and HRND # 2 to DO-PD 120 using P.

[0351] In block 1018, DO-PD 120 uses P to destroy the symmetric PD key pair SSK#1, HSSK#1, and RND#1.

[0352] After executing block 1018, the DO-PD 120 is locked according to the seventh embodiment exclusive self-hosting method.

[0353] As indicated by blocks 125 , 126 , 127 , and 128 , the DO-PD 120 that was locked according to the steps of flowchart 1001 may be unlocked according to the steps of flowchart 1002 , as follows.

[0354] In block 1020 , as indicated at block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0355] In block 1021, as indicated in block 125, the TPP-'PD 110 uses the P to place the PD in managed mode.

[0356] In block 1022, the DO-PD 120 creates a PD key pair using P as a PD private key and a PD public key, and hashes the PD private key into PD private key Hash #1.

[0357] In block 1023 , DO-PD 120 uses P to encrypt the PD public key and PD private key hash # 1 into message # 2 using the TPP public key, and releases the TPP public key and message # 2 to TPP-′ PD 110 .

[0358] In block 1024, TPP-'PD 110 decrypts Message #2 using P using the TPP private key to reveal the PD public key and PD private key Hash #1 which is renamed PD private key Hash #2.

[0359] In block 1025 , TPP-′ PD 110 uses P to encrypt PD private key hash # 2 into message # 3 using PD public key, and releases message # 3 to DO-PD 120 .

[0360] In block 1026, DO-PD 120 decrypts Message #3 using the PD private key, revealing PD private key Hash #2.

[0361] Then, box 1027 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential PD private key hash #1 from box 1022 and the challenge credential PD private key hash #2 from box 1026. If the correct key was used when determining the credentials, then in box 1027, PD private key hash #1 and PD private key hash #2 are the same. Therefore, in box 1027, DO-PD 120 uses P to compare PD private key hash #1 with PD private key hash #2. If PD private key hash #1 is equal to PD private key hash #2, TPP-'PD 110 is authenticated by DO-PD 120 and the result of box 1027 is "Y", while if PD private key hash #1 is not equal to PD private key hash #2, the result of box 1027 is "N".

[0362] If the result of block 1027 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1028 .

[0363] If the result of block 1027 is “Y”, then TPP-′ PD 110 is authenticated by DO-PD 120 and unlocking proceeds to block 1029 where DO-PD 120 releases Message # 1 to TPP-′ PD 110 using P.

[0364] In block 1030, TPP-'PD 110 decrypts Message #1 using P using the TPP private key to reveal HSSK #1, RND #1, and the symmetric PD public key.

[0365] In block 1031, TPP'PD uses P to create SSK#2 using the symmetric TPP private key and the symmetric PD public key.

[0366] In block 1032, TPP-PD hashes SSK#2 into HSSK#2 using P.

[0367] Then, box 1033 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential HSSK#1 from box 1030 and the challenge credential HSSK#2 from box 1032. If the correct key was used when determining the credentials, then in box 1033, HSSK#1 and HSSK#2 are the same. Therefore, in box 1033, TPP-'PD 110 uses P to compare HSSK#1 with HSSK#2. If HSSK#1 is equal to HSSK#2, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 1033 is "Y", and if HSSK#1 is not equal to HSSK#2, the authentication fails and the result of box 1033 is "N".

[0368] If the result of block 1033 is “N”, then authentication has failed and execution of unlocking of DO-PD 120 stops at block 1034 .

[0369] If the result of block 1033 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110, and unlocking proceeds to block 1035, where TPP-' PD 110 releases RND#1 to PD using P.

[0370] In block 1036 , DO-PD 120 uses P to hash RND# 1 into HRND# 1 .

[0371] Then, block 1037 performs a second test, whereby DO-PD 120 authenticates TPP-' PD 110. Specifically, DO-PD 120 uses P to compare the resident credential HRND#1 from block 1036 and the challenge credential HRND#2 from block 1015. If the correct key was used when determining the credentials, then in block 1037, HRND#1 and HRND#2 are the same. Therefore, in block 1037, DO-PD 120 uses P to compare HRND#1 with HRND#2. If HRND#1 is equal to HRND#2, TPP-' PD 110 is authenticated by DO-PD 120 and the result of block 1037 is "Y", while if HRND#1 is not equal to HRND#2, the result of block 1037 is "N".

[0372] If the result of block 1037 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1038 .

[0373] If the result of block 1037 is "Y", then TPP-' PD 110 is authenticated by DO-PD 120 and unlocking proceeds to block 1039 where DO-PD 120 unlocks the DO-PD using P.

[0374] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0375] Eighth embodiment

[0376] Eighth embodiment of the exclusive self-hosting method Fig.11 1101 and 1102, wherein flowchart 1101 includes steps for locking DO-PD 120 in blocks 1111-1119, and wherein flowchart 1102 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 1101 in blocks 1121-1138. Except as explicitly noted, the eighth embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiments.

[0377] As shown in blocks 122, 123, and 124, the DO-PD 120 may be locked according to the steps of flowchart 1101 as follows:

[0378] In block 1111 , TPP-PD 110 creates a TPP key pair using P as a TPP private key and a TPP public key, creates a symmetric TPP key pair as a symmetric TPP private key and a symmetric TPP public key, and provides the TPP public key and the symmetric TPP public key to DO-PD 120 .

[0379] In box 1112, after DO 20 is joined with DO-PD 120, DO-PD 120 uses P to create symmetric PD key pair #1 as symmetric PD private key #1 and symmetric PD public key #1, creates symmetric PD key pair #2 as symmetric PD private key #2 and symmetric PD public key #2, and creates a PD key pair as a PD private key and a PD public key.

[0380] In block 1113 , DO-PD 120 uses P to create SSK#1 using the symmetric PD private key #1 and the symmetric TPP public key.

[0381] In block 1114, DO-PD 120 uses P to create SSK #2 using the symmetric PD private key #2 and the symmetric TPP public key.

[0382] In block 1115, DO-PD 120 uses P to hash SSK#1 into HSSK#1 and SSK#2 into HSSK#2.

[0383] In block 1116, DO-PD 120 uses P to encrypt symmetric PD public key #1 and symmetric PD public key #2 to message #1 using the TPP public key.

[0384] In block 1117 , DO-PD 120 uses P to store the password creation time in time # 1 .

[0385] In block 1118, DO-PD 120 uses P to encrypt time #1, PD private key, and PD public key into message #2 using the TPP public key.

[0386] In block 1119 , DO-PD 120 uses P to store HSSK#1, HSSK#2, Message#1, Message#2, and Time#1 in DO-PD 120 .

[0387] In block 1120 , DO-PD 120 uses P to destroy symmetric PD key pair #1, symmetric PD key pair #2, SSK #1, SSK #2, and the PD private key.

[0388] After executing block 1120, the DO-PD 120 is locked according to the eighth embodiment exclusive self-hosting method.

[0389] As indicated by blocks 125 , 126 , 127 , and 128 , the DO-PD 120 that was locked according to the steps of flowchart 1101 may be unlocked according to the steps of flowchart 1102 , as follows.

[0390] In block 1122 , as indicated in block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0391] In block 1123 , the TPP-′ PD 110 uses P to place the PD in managed mode and releases message # 2 to the DO-PD 120 , as indicated in block 125 .

[0392] In block 1124, TPP-'PD 110 decrypts Message #2 using P using the TPP private key to reveal Time #1 renamed to TIME #2, the PD private key, and the PD public key.

[0393] In block 1125 , TPP-′ PD 110 encrypts time # 2 into message # 3 using the P PD public key and releases message # 3 and the PD private key to DO-PD 120 .

[0394] In block 1126, DO-PD 120 decrypts message #3 using P using the PD private key to disclose time #2.

[0395] Block 1127 then performs a test whereby DO-PD 120 authenticates TPP-' PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential time #1 from block 1117 and the challenge credential time #2 from block 1126. If the correct key was used in determining the credentials, then in block 1127, time #1 and time #2 are the same. Therefore, in block 1127, DO-PD 120 uses P to compare time #1 to time #2. If time #1 is equal to time #2, then TPP-' PD 110 is authenticated by DO-PD 120 and the result of block 1127 is "Y", while if time #1 is not equal to time #2, the result of block 1127 is "N".

[0396] If the result of block 1127 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1128 .

[0397] If the result of block 1127 is “Y”, then TPP-PD 110 is authenticated by DO-PD 120 and unlocking proceeds to block 1129 where DO-PD 120 releases message #1 to TPP-PD 112 using P.

[0398] In block 1130, TPP-PD uses P to decrypt message #1 using the TPP private key to reveal symmetric PD public key #1 and symmetric PD public key #2.

[0399] In block 1131, TPP-'PD 110 uses P to create SSK#3 using the symmetric TPP private key and the symmetric PD public key #1.

[0400] In block 1132, TPP-'PD 110 hashes SSK#3 into HSSK#3 using P.

[0401] Then, box 1133 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential HSSK#1 from box 1119 and the challenge credential HSSK#3 from box 1132. If the correct key was used when determining the credentials, then in box 1133, HSSK#1 and HSSK#3 are the same. Therefore, in box 1133, TPP-'PD 110 uses P to compare HSSK#1 with HSSK#3. If HSSK#1 is equal to HSSK#3, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 1133 is "Y", and if HSSK#1 is not equal to HSSK#3, the authentication fails and the result of box 1133 is "N".

[0402] If the result of block 1133 is “N”, then authentication has failed and execution of unlocking of DO-PD 120 stops at block 1134 .

[0403] If the result of block 1133 is “Y”, then DO-PD 120 is authenticated by TPP-PD 110 and unlocking proceeds to block 1135 where TPP-PD 112 creates SSK#4 using P using the symmetric TPP private key and symmetric PD public key #2 and releases SSK#4 to DO-PD 120.

[0404] In block 1136, DO-PD 120 hashes SSK#4 into HSSK#4 using P.

[0405] Then, block 1137 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential HSSK#2 from block 1119 and the challenge credential HSSK#4 from block 1136. If the correct key was used in determining the credentials, then in block 1137, HSSK#2 and HSSK#4 are the same. Therefore, in block 1137, DO-PD 120 uses P to compare HSSK#2 and HSSK#4. If HSSK#2 is equal to HSSK#4, TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 1137 is "Y", while if HSSK#2 is not equal to HSSK#4, the result of block 1137 is "N".

[0406] If the result of block 1137 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1139 .

[0407] If the result of block 1137 is "Y", then TPP-' PD 110 is authenticated by DO-PD 120 and unlocking proceeds to block 1138 where DO-PD 120 unlocks the DO-PD using P.

[0408] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0409] Ninth embodiment

[0410] Ninth embodiment exclusive self-hosting method Fig.121201 and 1202, wherein flowchart 1201 includes steps for locking DO-PD 120 in blocks 1211-1221, and wherein flowchart 1202 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 1201 in blocks 1222-1236. Except as explicitly noted, the ninth embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiments.

[0411] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 1201 as follows.

[0412] In block 1211 , the TPP-PD creates a symmetric TPP key pair using P as a symmetric TPP public key and a symmetric TPP private key, and provides the symmetric TPP public key to the DO-PD 120 .

[0413] In block 1212, after DO 20 is bonded with DO-PD 120, DO-PD 120 creates a symmetric PD key pair using P as a symmetric PD private key and a symmetric PD public key.

[0414] In block 1213, DO-PD 120 uses P to compute SSK#1 using the symmetric TPP public key and the symmetric PD private key.

[0415] In block 1214 , DO-PD 120 uses P to create a random number RND#1.

[0416] In block 1215, DO-PD 120 uses P to encrypt RND#1 into Message#1 using SSK#1.

[0417] In block 1216 , DO-PD 120 generates a random number using P and stores the random number as an escrow password.

[0418] In block 1217, DO-PD 120 uses P to encrypt the escrow password into Message #2 using SSK #1.

[0419] In block 1218, DO-PD 120 uses P to copy Message #2 to Message #2 copy.

[0420] In block 1219, DO-PD 120 uses P to encrypt RND#1 and a copy of Message#2 into Message#3 using SSK#1.

[0421] In block 1220, DO-PD 120 uses P to delete the symmetric PD private key, SSK, RND#1, and the escrow password.

[0422] In block 1221 , DO-PD 120 uses P to save Message # 1 and Message # 2 in DO-PD 120 .

[0423] After executing block 1221 , the DO-PD 120 is locked according to the ninth embodiment exclusive self-hosting method.

[0424] As shown in blocks 125, 126, 127 and 128, the DO-PD 120 that was locked according to the steps of flowchart 1201 may be unlocked according to the steps of flowchart 1202, as follows.

[0425] In block 1222 , as indicated in block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0426] In block 1223 , the TPP-PD 110 creates a special random number SPLRND# using P and releases it to the DO-PD 120 .

[0427] In block 1224 , if the SPLRND# is formatted in the predetermined format, the DO-PD 120 verifies the SPLRND# using P and places the DO-PD 120 in managed mode as indicated by block 125 .

[0428] In block 1225 , DO-PD 120 releases the symmetric TPP public key, the symmetric PD public key, and message # 3 to TPP-PD 112 using P.

[0429] In block 1226, TPP-'PD 110 uses P to calculate a shared secret key SSK#2 using the symmetric PD public key and the symmetric TPP private key. Note that if the correct keys are used, SSK#1 and SSK#2 are the same.

[0430] In block 1227, TPP-'PD 110 decrypts Message #3 using P using SSK #2 to reveal RND #1 and a copy of Message #2.

[0431] In block 1228, TPP-' PD 110 sends SSK#2 to DO-PD 120 using P.

[0432] In block 1229, DO-PD 120 decrypts Message #1 using P using SSK #2 to reveal RND #2.

[0433] In block 1230 , DO-PD 120 sends RND# 2 to TPP-′ PD 110 using P.

[0434] Then, box 1231 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential RND#1 from box 1227 and the challenge credential RND#2 from box 1230. If the correct key was used when determining the credentials, then in box 1231, RND#1 and RND#2 are the same. Therefore, in box 1231, TPP-'PD110 uses P to compare RND#1 with RND#2. If RND#1 is equal to RND#2, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 1231 is "Y", if RND#1 is not equal to RND#2, the authentication fails and the result of box 1231 is "N".

[0435] If the result of block 1231 is “N”, then authentication has failed and execution of unlocking of DO-PD 120 stops at block 1232 .

[0436] If the result of block 1231 is “Y”, then DO-PD 120 is authenticated by TPP-′ PD 110 and unlocking proceeds to block 1233 where TPP-PD 112 sends a copy of Message #2 to DO-PD 120 using P.

[0437] Block 1234 then performs a test whereby DO-PD 120 authenticates TPP-' PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential message #2 from block 1217 with the challenge credential message #2 copy from block 1231. If the correct key was used in determining the credential, then in block 1137, Message #2 and the message #2 copy are identical. Therefore, in block 1137, DO-PD 120 uses P to compare Message #2 with the message #2 copy. If Message #2 is equal to the message #2 copy, then TPP-' PD 110 is authenticated by DO-PD 120 and the result of block 1137 is "Y", whereas if Message #2 is not equal to the message #2 copy, then the result of block 1137 is "N".

[0438] If the result of block 1234 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 1235 .

[0439] If the result of block 1234 is “Y”, then the TPP-′ PD 110 is authenticated by the DO-PD 120 , and the DO-PD is unlocked at block 1236 .

[0440] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0441] Tenth embodiment

[0442] The tenth embodiment of the exclusive self-hosting method is Fig.13 1301 and 1302, wherein flowchart 1301 includes steps for locking DO-PD 120 in blocks 1311-1319, and wherein flowchart 1302 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 1301 in blocks 1321-1333. Except as explicitly noted, the tenth embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiment.

[0443] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 1301 as follows.

[0444] In block 1311 , the TPP-PD 110 creates a TPP key pair using P as a TPP private key and a TPP public key, and provides the TPP public key to the DO-PD 120 .

[0445] In block 1312 , after DO 20 is coupled to DO-PD 120 , DO-PD 120 creates PD key pair #1 using P as PD private key #1 and PD public key #1, and creates PD key pair #2 as PD private key #2 and PD public key #2.

[0446] In block 1313 , DO-PD 120 creates a random number RND#1.

[0447] In block 1314, DO-PD 120 uses P to encrypt RND#1 into Message#1 using PD Public Key#1.

[0448] In block 1315 , DO-PD 120 creates a random number and stores the random number as Escrow Password #1.

[0449] In block 1316, DO-PD 120 uses P to encrypt escrow password #1 into message #2 using PD public key #2.

[0450] In block 1317, DO-PD 120 uses P to encrypt RND#1, Escrow Password#1, Message#2, PD Private Key#1, and PD Private Key#2 into Message#3 using the TPP public key.

[0451] In block 1318 , DO-PD 120 uses P to delete PD Private Key #1, PD Private Key #2, RND #1, and Escrow Password #1.

[0452] In block 1319 , DO-PD 120 uses P to save Message # 1 , Message # 2 , and Message # 3 in DO-PD 120 .

[0453] After executing block 1319, the DO-PD 120 is locked according to the tenth embodiment exclusive self-hosting method.

[0454] As indicated by blocks 125, 126, 127, and 128, the DO-PD 120 that was locked according to the steps of flowchart 1301 may be unlocked according to the steps of flowchart 1302, as follows.

[0455] In block 1321 , as indicated in block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0456] In block 1322 , TPP-PD 110 places the PD in managed mode using P, and DO-PD 120 releases message # 3 to TPP-PD 112 , as indicated in block 125 .

[0457] In block 1323, TPP-'PD 110 decrypts Message #3 using P using the TPP private key to reveal RND #1, Escrow Password #1, Message #2, PD Private Key #1, and PD Private Key #2.

[0458] In block 1324 , TPP-′ PD 110 sends PD Private Key # 1 to DO-PD 120 using P.

[0459] In block 1325, DO-PD 120 decrypts Message #1 using P using PD Private Key #1 to reveal RND #1 which is stored as RND #2.

[0460] In block 1326 , DO-PD 120 sends RND# 2 to TPP-′ PD 110 using P.

[0461] Then, box 1327 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential RND#1 from box 1323 and the challenge credential RND#2 from box 1326. If the correct key was used when determining the credentials, then in box 1231, RND#1 and RND#2 are the same. Therefore, in box 1327, TPP-'PD110 uses P to compare RND#1 with RND#2. If RND#1 is equal to RND#2, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 1327 is "Y", and if RND#1 is not equal to RND#2, the authentication fails and the result of box 1327 is "N".

[0462] If the result of block 1327 is “N”, then authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1328 .

[0463] If the result of block 1327 is “Y”, then DO-PD 120 is authenticated by TPP-′ PD 110 and unlocking proceeds to block 1329 where TPP-PD sends PD Private Key #2 and Escrow Password #1 to DO-PD 120 using P.

[0464] In block 1330, DO-PD 120 decrypts Message #2 using P using PD Private Key #2 to reveal Escrow Password #1 which is renamed Escrow Password #2.

[0465] Then, block 1331 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential escrow password #1 from block 1329 and the challenge credential escrow password #2 from block 1330. If the correct key was used when determining the credentials, then in block 1331, escrow password #1 and escrow password #2 are the same. Therefore, in block 1331, DO-PD 120 uses P to compare escrow password #1 with escrow password #2. If escrow password #1 is equal to escrow password #2, then TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 1331 is "Y", while if escrow password #1 is not equal to escrow password #2, the result of block 1331 is "N".

[0466] If the result of block 1331 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 1332 .

[0467] If the result of block 1331 is “Y”, then the TPP-′ PD 110 is authenticated by the DO-PD 120 , and the DO-PD is unlocked at block 1333 .

[0468] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0469] Eleventh Embodiment

[0470] 11th embodiment exclusive self-hosting method Fig.141401 and 1402, wherein flowchart 1401 includes steps for locking DO-PD 120 in blocks 1411-1417, and wherein flowchart 1402 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 1401 in blocks 1419-1432. Except as explicitly noted, the eleventh embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiment.

[0471] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 1401 as follows.

[0472] In block 1411 , the TPP-PD creates a TPP key pair using P as a TPP private key and a TPP public key, and provides the TPP public key to the DO-PD 120 .

[0473] In block 1412, after DO 20 interfaces with DO-PD 120, DO-PD 120 creates a PD key pair using P as a PD private key and a PD public key.

[0474] In block 1413, DO-PD 120 creates a random number using P as escrow password #1.

[0475] In block 1414, DO-PD 120 uses P to encrypt Escrow Password #1 into Message #1 using the PD public key.

[0476] In block 1415, DO-PD 120 uses P to encrypt the escrow password #1 and the PD private key into message #2 using the TPP public key.

[0477] In block 1416 , DO-PD 120 deletes the PD key pair and escrow password #1.

[0478] In block 1417 , DO-PD 120 saves Message # 1 and Message # 2 in DO-PD 120 .

[0479] After executing block 1417, the DO-PD 120 is locked according to the eleventh embodiment exclusive self-hosting method.

[0480] As indicated by blocks 125, 126, 127, and 128, the DO-PD 120 locked according to the steps of flowchart 1401 may be unlocked according to the steps of flowchart 1402, as follows.

[0481] In block 1419 , as indicated at block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0482] In block 1420 , TPP-′ PD 110 uses P,TPP 10 to create a special random number SPLRND#1 which is submitted to DO-PD 120 .

[0483] In block 1421 , if SPLRND# 1 is formatted in a predetermined format, DO-PD 120 verifies SPLRND# 1 and places DO-PD 120 in managed mode as indicated in block 125 .

[0484] In block 1422, DO-PD 120 encrypts SPLRND #1 and Message #2 into Message #3 using the TPP public key.

[0485] In block 1423 , the TPP-′ PD 110 receives message # 3 from the DO-PD 120 .

[0486] In block 1424, TPP-'PD 110 decrypts Message #3 using the TPP private key to reveal SPLRND #1 and Message #2 renamed SPLRND #2.

[0487] Then, box 1425 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential SPLRND#1 from box 1420 and the challenge credential SPLRND#2 from box 1424. If the correct key was used when determining the credentials, then in box 1425, SPLRND#1 and SPLRND#2 are the same. Therefore, in box 1425, TPP-'PD 110 uses P to compare SPLRND#1 with SPLRND#2. If SPLRND#1 is equal to SPLRND#2, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 1425 is "Y", and if SPLRND#1 is not equal to SPLRND#2, the authentication fails and the result of box 1425 is "N".

[0488] If the result of block 1425 is “N”, then authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1426 .

[0489] If the result of block 1425 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110, and unlocking proceeds to block 1427 where TPP-PD 112 decrypts Message #2 to reveal Escrow Password #1 and the PD Private Key.

[0490] In block 1428 , TPP-PD 112 sends the PD private key and escrow password # 1 to DO-PD 120 .

[0491] In block 1429, DO-PD 120 decrypts Message #1 using the PD private key to reveal Escrow Password #1 renamed Escrow Password #2.

[0492] Then, block 1430 performs a test whereby DO-PD 120 authenticates TPP-'PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential escrow password #1 from block 1428 and the challenge credential escrow password #2 from block 1429. If the correct key was used when determining the credentials, then in block 1331, escrow password #1 and escrow password #2. Therefore, in block 1430, DO-PD 120 uses P to compare escrow password #1 with escrow password #2. If escrow password #1 is equal to escrow password #2, then TPP-'PD 110 is authenticated by DO-PD 120 and the result of block 1430 is "Y", while if escrow password #1 is not equal to escrow password #2, the result of block 1430 is "N".

[0493] If the result of block 1430 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 1431 .

[0494] If the result of block 1430 is “Y”, then the TPP-′ PD 110 is authenticated by the DO-PD 120 , and the DO-PD is unlocked at block 1432 .

[0495] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0496] Twelfth Embodiment

[0497] Twelfth embodiment exclusive self-hosting method Fig.15 1501 and 1502, wherein flowchart 1501 includes steps for locking DO-PD 120 in blocks 1511-1516, and wherein flowchart 1502 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 1501 in blocks 1518-1530. Except as explicitly noted, the thirteenth embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiment.

[0498] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 1501 as follows.

[0499] In block 1511 , the TPP-PD creates a TPP key pair using P as a TPP private key and a TPP public key, and provides the TPP public key to the DO-PD 120 .

[0500] In block 1512 , after DO 20 interfaces with DO-PD 120 , DO-PD 120 uses P to create a random number that is stored as an escrow password.

[0501] In block 1513 , DO-PD 120 uses P to hash the escrow password into EPasscodeHash#1.

[0502] In block 1514, DO-PD 120 uses P to encrypt EPasscodeHash#1 into Message#1 using the TPP public key.

[0503] In block 1515 , DO-PD 120 uses P to save EPasscodeHash# 1 and Message# 1 in DO-PD 120 .

[0504] In block 1516 , DO-PD 120 uses P to delete the escrow password.

[0505] After executing block 1516, the DO-PD 120 is locked according to the twelfth embodiment exclusive self-hosting method.

[0506] As indicated by blocks 125, 126, 127, and 128, the DO-PD 120 that was locked according to the steps of flowchart 1501 may be unlocked according to the steps of flowchart 1502, as follows.

[0507] In block 1518 , as indicated at block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0508] In block 1519 , the TPP-PD 110 creates a special random number SPLRND#1 using P and releases it to the DO-PD 120 .

[0509] In block 1520 , if SPLRND# 1 is one of the predetermined random number pool, DO-PD 120 verifies SPLRND# 1 using P and places DO-PD 120 in managed mode as indicated in block 125 .

[0510] In block 1521, DO-PD 120 uses P to encrypt SPLRND#1 and Message#1 into Message#2 using the TPP public key.

[0511] In block 1522 , DO-PD 120 releases the TPP public key and message # 2 to TPP-PD 112 using P.

[0512] In block 1523, TPP-PD 112 decrypts Message #2 using P using the TPP private key to reveal SPLRND #1 and Message #1 renamed SPLRND #2.

[0513] Then, block 1524 performs a test whereby the TPP-PD 112 authenticates the DO-PD 120. Specifically, the TPP-PD 112 uses P to compare the resident credential SPLRND#1 from block 1519 and the challenge credential SPLRND#2 from block 1523. If the correct key was used when determining the credentials, then in block 1524, SPLRND#1 and SPLRND#2 are the same. Therefore, in block 1524, the TPP-PD 110 uses P to compare SPLRND#1 with SPLRND#2. If SPLRND#1 is equal to SPLRND#2, the DO-PD 120 is authenticated by the TPP-PD 110 and the result of block 1524 is "Y", while if SPLRND#1 is not equal to SPLRND#2, the authentication fails and the result of block 1524 is "N".

[0514] If the result of block 1524 is “N”, then authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1525 .

[0515] If the result of block 1524 is "Y", then DO-PD 120 is authenticated by TPP-' PD 110 and unlocking proceeds to block 1526 where TPP-PD 112 decrypts Message #1 using the TPP private key to reveal EPasscodeHash #1 renamed to EPasscodeHash #2.

[0516] In block 1527 , TPP-PD 112 sends EPasscodeHash#2 to DO-PD 120 using P.

[0517] Then, block 1528 performs a test whereby DO-PD 120 authenticates TPP-' PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential EPasscodeHash#1 from block 1515 and the challenge credential EPasscodeHash#2 from block 1527. If the correct key was used in determining the credentials, then in block 1528, EPasscodeHash#1 is equal to EPasscodeHash#2. Therefore, in block 1528, DO-PD 120 uses P to compare EPasscodeHash#1 to EPasscodeHash#2. If EPasscodeHash#1 is equal to EPasscodeHash#2, then TPP-' PD 110 is authenticated by DO-PD 120 and the result of block 1528 is "Y", while if EPasscodeHash#1 is not equal to EPasscodeHash#2, the result of block 1528 is "N".

[0518] If the result of block 1528 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1529 .

[0519] If the result of block 1528 is “Y”, then the TPP-′ PD 110 is authenticated to the DO-PD 120 , and the DO-PD is unlocked at block 1530 .

[0520] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0521] Thirteenth Embodiment

[0522] Thirteenth embodiment exclusive self-hosting method Fig.16 1601 and 1602, wherein flowchart 1601 includes steps for locking DO-PD 120 in blocks 1611-1614, and wherein flowchart 1602 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 1601 in blocks 1603 and 1615-1625. Except as explicitly noted, the thirteenth embodiment exclusive self-hosting method is generally similar to the exclusive self-hosting method of the previous embodiment.

[0523] As indicated by blocks 122, 123, and 124, DO-PD 120 may be locked according to the steps of flowchart 1601 as follows.

[0524] In block 1611 , the TPP-PD 110 creates a TPP key pair using P as a TPP private key and a TPP public key, and provides the TPP public key to the DO-PD 120 .

[0525] In block 1612 , after DO 20 interfaces with DO-PD 120 , DO-PD 120 uses P to create a random number that is stored as an escrow password.

[0526] In block 1613, DO-PD 120 uses P to encrypt the escrow password into message #1 using the TPP public key.

[0527] In block 1614 , DO-PD 120 uses P to delete the escrow password.

[0528] After executing block 1614, the DO-PD 120 is locked according to the thirteenth embodiment exclusive self-hosting method.

[0529] As indicated by blocks 125, 126, 127, and 128, the DO-PD 120 that was locked according to the steps of flowchart 1601 may be unlocked according to the steps of flowchart 1602, as follows.

[0530] In block 1603 , as indicated in block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0531] In block 1615 , the TPP-′ PD 110 creates a random number RND#1 from the subset of random numbers using P and releases RND#1 to the DO-PD 120 .

[0532] In block 1616 , DO-PD 120 uses P to verify that RND# 1 is a member of the subset and places the PD in managed mode, as indicated in block 125 .

[0533] In block 1617, DO-PD 120 uses P to encrypt RND #1 and Message #1 into Message #2 using the TPP public key.

[0534] In block 1618 , DO-PD 120 releases the TPP public key and message # 2 to TPP-PD 112 using P.

[0535] In block 1619, TPP-PD 112 decrypts Message #2 using P using the TPP private key to reveal RND #1 renamed to RND #2 and Message #1 renamed to Message #4.

[0536] Then, box 1620 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-'PD 110 uses P to compare the resident credential RND#1 from box 1615 and the challenge credential RND#2 from box 1619. If the correct key was used when determining the credentials, then in box 1620, RND#1 and RND#2 are the same. Therefore, in box 1620, TPP-'PD 110 uses P to compare RND#1 with RND#2. If RND#1 is equal to RND#2, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 1620 is "Y", and if RND#1 is not equal to RND#2, the authentication fails and the result of box 1620 is "N".

[0537] If the result of block 1621 is “N”, then authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1525 .

[0538] If the result of block 1622 is “Y”, then DO-PD 120 is authenticated by TPP-′ PD 110 and unlocking proceeds to block 1526 where TPP-PD 112 sends message #4 to DO-PD 120 using P.

[0539] Block 1623 then performs a test whereby DO-PD 120 authenticates TPP-' PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare resident credential message #1 from block 1613 and challenge credential message #4 from block 1622. If the correct key was used in determining the credentials, then in block 1623, message #1 is equal to message #4. Therefore, in block 1623, DO-PD 120 uses P to compare message #1 to message #4. If message #1 is equal to message #4, then TPP-' PD 110 is authenticated by DO-PD 120 and the result of block 1623 is "Y", whereas if message #1 is not equal to message #4, the result of block 1623 is "N".

[0540] If the result of block 1623 is “N”, then the step of authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1624 .

[0541] If the result of block 1623 is “Y”, then the TPP-′ PD 110 is authenticated by the DO-PD 120 , and the DO-PD is unlocked at block 1625 .

[0542] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0543] Fourteenth Embodiment

[0544] Fourteenth embodiment exclusive self-hosting method in Fig.17 1701 and 1702, wherein flowchart 1701 includes steps for locking DO-PD 120 in block 1711, and wherein flowchart 1702 includes steps for subsequently unlocking the DO-PD locked according to the steps of flowchart 1701 in blocks 1703 and 1712-1723. Except as explicitly noted, the fourteenth embodiment exclusive self-hosting method is generally similar to the aforementioned embodiment exclusive self-hosting method.

[0545] As indicated by blocks 122 and 124, DO-PD 120 may be locked according to the steps of flowchart 1701 as follows.

[0546] In block 1711 , the TPP-PD 110 creates a TPP key pair using P as a TPP private key and a TPP public key, and provides the TPP public key to the DO-PD 120 .

[0547] In block 1712 , after DO 20 interfaces with DO-PD 120 , DO-PD 120 uses P to save the TPP public key.

[0548] After executing block 1712, the DO-PD 120 is locked according to the seventh embodiment exclusive self-hosting method. This embodiment differs from embodiments 1 to 13 in that the credential is generated during the unlocking of the DO-PD 120.

[0549] As shown in blocks 125, 126, 127 and 128, the DO-PD 120 that was locked according to the steps of flowchart 1701 may be unlocked according to the steps of flowchart 1002 as follows:

[0550] In block 1713 , as indicated at block 113 , the TPP-′ PD 110 receives the authenticated unlock request.

[0551] In block 1714 , the TPP-′ PD 110 creates a random number RND#1 from a small subset of random numbers using P and releases it to the DO-PD 120 .

[0552] In block 1715 , after DO 20 interfaces with DO-PD 120 as indicated in block 122 , DO-PD 120 authenticates RND# 1 using P and places the PD in managed mode as indicated in block 125 .

[0553] In block 1716 , DO-PD 120 uses P to create a random number RND#2.

[0554] In block 1717 , DO-PD 120 uses P to encrypt RND#1 and RND#2 into Message#1 using the TPP public key.

[0555] In block 1718 , DO-PD 120 releases message # 1 to TPP-PD 112 using P.

[0556] In block 1719, TPP-PD 112 decrypts Message #1 using the TPP private key to reveal RND #1, RND #2 which is renamed to RND #3, and RND #4.

[0557] Then, box 1720 performs a test whereby TPP-'PD 110 authenticates DO-PD 120. Specifically, TPP-PD 112 uses P to compare the resident credential RND#1 from box 1712 and the challenge credential RND#3 from box 1717. If the correct key was used when determining the credentials, then in box 1718, RND#1 and RND#3 are the same. Therefore, in box 1720, TPP-'PD 110 uses P to compare RND#1 with RND#3. If RND#1 is equal to RND#3, DO-PD 120 is authenticated by TPP-'PD 110 and the result of box 1720 is "Y", and if RND#1 is not equal to RND#3, the authentication fails and the result of box 1720 is "N".

[0558] If the result of block 1720 is “N”, then authentication has failed and execution of unlocking of the DO-PD 120 stops at block 1721 .

[0559] If the result of block 1720 is “Y”, then DO-PD 120 is authenticated by TPP-PD 110 and unlocking of DO-PD 120 proceeds to block 1722 where TPP-PD 112 sends RND#4 to DO-PD 120 using P.

[0560] Then, block 1723 performs a test whereby DO-PD 120 authenticates TPP-' PD 110 as a trusted, authentic provider of DO-PD 120. Specifically, DO-PD 120 uses P to compare the resident credential RND#2 from block 1714 and the challenge credential RND#4 from block 1718. If the correct key was used in determining the credentials, then in block 1723, RND#2 is equal to RND#4. Therefore, in block 1723, DO-PD 120 uses P to compare RND#2 to RND#4. If RND#2 is equal to RND#4, then TPP-' PD 110 is authenticated by DO-PD 120 and the result of block 1723 is "Y", while if RND#2 is not equal to RND#4, the result of block 1721 is "N".

[0561] If the result of block 1723 is “N”, then the step of authentication has failed and execution of unlocking of DO-PD 120 stops at block 1724 .

[0562] If the result of block 1723 is “Y”, then the TPP-′ PD 110 is authenticated by the DO-PD 120 , and the DO-PD is unlocked at block 1725 .

[0563] With the DO-PD 120 unlocked, the GA can now access the DO-PD according to the authorization of the device.

[0564] One embodiment of each method described herein is in the form of a computer program executed on a processing system. Therefore, as will be appreciated by those skilled in the art, embodiments of the present invention may be embodied as methods, devices such as special purpose devices, devices such as data processing systems, or carrier media such as computer program products. The carrier medium carries one or more computer readable code segments for controlling the processing system to implement the method. Therefore, various aspects of the present invention may take the form of methods, complete hardware embodiments, complete software embodiments, or embodiments combining software and hardware aspects. In addition, the present invention may take the form of a carrier medium (e.g., a computer program product on a computer readable storage medium) carrying a computer readable program code segment contained in the medium. Any suitable computer readable medium including a magnetic storage device such as a floppy disk or a hard disk or an optical storage device such as a CD-ROM may be used.

[0565] It should be understood that, in one embodiment, the steps of the method discussed are performed by an appropriate processor (or processors) of a processing system (i.e., a computer) executing instructions (code segments) stored in a memory. It should also be understood that the present invention is not limited to any particular implementation or programming technique, and that the present invention may be implemented using any suitable technique for implementing the functions described herein. The present invention is not limited to any particular programming language or operating system.

[0566] Throughout the specification, references to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present invention. Therefore, the phrases "in one embodiment" or "in an embodiment" appearing in various places in this specification do not necessarily all refer to the same embodiment. In addition, in one or more embodiments, the particular features, structures, or characteristics may be combined in any suitable manner, which will be apparent to one of ordinary skill in the art of the present disclosure.

[0567] It should be understood that the present invention includes all different combinations embodied herein. Throughout the specification, the term "comprising" shall be a synonym of "including", "consisting of" or "characterized by", is inclusive or open, and does not exclude additional, unlisted elements or method steps. "Comprising" is a special term that means that the named elements are essential, but other elements can be added and still form a construction within the scope of the statement. "Comprising" allows the inclusion of unspecified ingredients (even a large number of ingredients).

[0568] Similarly, it should be understood that in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes combined in a single embodiment, figure, or description thereof for the purpose of simplifying the disclosure and facilitating the understanding of one or more of the various inventive aspects. However, the disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than those expressly recited in each claim. On the contrary, as reflected in the following claims, the inventive aspects lie in less than all the features of a single aforementioned disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into the detailed description, and each claim exists independently as a separate embodiment of the present invention.

[0569] Thus, while there have been described what are considered to be preferred embodiments of the present invention, it will be appreciated by those skilled in the art that other and further modifications may be made thereto without departing from the spirit of the present invention, and it is intended that all such changes and modifications be claimed as falling within the scope of the present invention. For example, any formula given above is merely representative of a procedure that may be used. Functions may be added, deleted, or combined from the block diagrams, and operations may be interchanged between functional blocks. Steps may be added or deleted for methods described within the scope of the present invention.

Claims

1. A method for enabling a TPP having a third party provider TPP domain to access a device owner's program domain DO-PD, the method comprising: mutually authenticating the TPP domain and the locked DO-PD using two or more exclusive self-hosted credentials; The locked DO-PD is unlocked after the mutual authentication of the TPP domain and the locked DO-PD.

2. The method according to claim 1, wherein: The TPP domain includes two subdomains, the two subdomains including TPP-PD and TPP-'PD, wherein the TPP-PD is a subdomain of the DO-PD and the TPP-'PD is a subdomain not within the DO-PD, wherein the two or more exclusive self-hosted credentials are generated, disclosed, or stored in the locked DO-PD or the TPP-PD.

3. The method according to claim 1, wherein: The mutual authentication includes: a first authentication of the TPP domain by the DO-PD resulting from a first message exchange between the TPP domain and the DO-PD; and A second authentication of the DO-PD by the TPP domain resulting from a second message exchange between the TPP domain and the DO-PD.

4. The method according to claim 3, wherein: The TPP domain is a first TPP domain, wherein the mutual interaction of the TPP domain and the DO-PD further comprises: a first authentication of the first TPP domain by the DO-PD including a first message exchange between the first TPP domain and the DO-PD; a second authentication of the second TPP domain by the DO-PD including a second message exchange between the second TPP domain and the DO-PD; and A third authentication of the DO-PD by the TPP domain includes a third message exchange between the first TPP domain or the second TPP domain and the DO-PD.

5. The method according to claim 3, wherein: The two or more exclusive self-hosted credentials include a DO-PD resident credential and a TPP domain resident credential; wherein the first message exchange includes disclosing or generating a DO-PD challenge credential within the DO-PD, and a first authentication authenticates the TPP domain through the DO-PD when the DO-PD resident credential is equal to the DO-PD challenge credential received from an encrypted exchange of the DO-PD resident credential between the DO-PD and the TPP domain; Wherein, the second message exchange includes disclosing or generating a TPP domain challenge credential within the DO-PD, and when the TPP domain resident credential is equal to the TPP domain challenge credential received from an encrypted exchange of the TPP domain resident credential between the DO-PD and the TPP domain, the second authentication authenticates the DO-PD through the TPP domain.

6. The method according to claim 5, wherein: The encrypted exchange of the second message exchange includes encrypting the TPP domain resident credential and decrypting the encrypted TPP domain resident credential into the TPP domain challenge credential.

7. The method according to claim 5, wherein: The encrypted exchange of the first message exchange includes encrypting the DO-PD resident credentials and decrypting the encrypted DO-PD resident credentials into the DO-PD challenge credentials.

8. The method of claim 1 , further comprising receiving a request to unlock the DO-PD in the DO-PD; in, After the receiving step, DO-PD resident credentials are stored or generated in the DO-PD, or, after the receiving step, TPP domain resident credentials are stored or generated in the TPP domain.

9. The method according to claim 1, wherein: At least one of the two or more exclusive self-hosted credentials is a password, a hashed password, a random number, a device ID of the electronic device credential, a shared secret key between the DO-PD and the TPP domain, an encrypted password, an encrypted random number, an encrypted device ID of the electronic device credential, an encrypted shared secret key between the DO-PD and the TPP domain, a hashed random number, a hashed device ID of the electronic device credential, or a hashed shared secret key between the DO-PD and the TPP domain.

10. The method according to claim 1, wherein: The DO-PD is a horizontal program domain.

11. The method according to claim 1, wherein: The DO-PD is within an electronic device.

12. The method according to claim 11, wherein: The electronic device is a smartphone or a computer or a tablet.

13. The method according to claim 1, wherein: The DO-PD is a vertical program domain.

14. The method according to claim 1, wherein: The DO-PD comprises a database, a word processor, a spreadsheet or a mobile safe.

15. The method according to claim 1, wherein: The TPP domain has a TPP key pair, the TPP key pair comprising a TPP private key and a TPP public key, wherein the mutually authenticating the TPP domain and the locked DO-PD using the two or more exclusive self-hosted credentials comprises: Receiving the TPP public key in the DO-PD; Creating a TPP domain resident credential in the TPP domain; Creating a DO-PD resident credential in the DO-PD; encrypting an exchange of the TPP domain-resident credentials between the locked DO-PD and the TPP domain using the TPP key pair; storing the exchanged TPP domain resident credentials in the locked DO-PD as TPP domain challenge credentials; authenticating the DO-PD to the TPP domain when the TPP domain residency credentials are equal to the TPP domain challenge credentials; encrypting and exchanging the DO-PD resident credentials between the locked DO-PD and the TPP domain using the TPP key pair; storing the exchanged DO-PD resident credentials as the DO-PD challenge credentials; and When the DO-PD residency credentials are equal to the DO-PD challenge credentials, the TPP domain is authenticated to the DO-PD.

16. The method according to claim 15, wherein: Encrypting and exchanging the TPP domain resident credentials between the locked DO-PD and the TPP domain comprises: sending the TPP domain resident credentials to the locked DO-PD, encrypting the TPP domain resident credentials in the locked DO-PD using the TPP public key, and sending the encrypted TPP domain resident credentials to the TPP domain; and Among them, the encrypted exchange of the DO-PD resident credentials between the locked DO-PD and the TPP domain includes: using the TPP public key to encrypt the DO-PD domain resident credentials in the DO-PD to form an encrypted DO-PD domain resident credentials, sending the encrypted DO-PD domain resident credentials to the TPP domain, and using the TPP private key to decrypt the encrypted DO-PD domain resident credentials in the TPP domain to form a DO-PD challenge credential.

17. The method according to claim 1, wherein: The TPP domain includes a subdomain TPP-PD of the DO-PD and a second subdomain TPP-'PD not within the DO-PD, wherein the TPP domain has a TPP key pair, the TPP key pair includes a TPP private key and a TPP public key, wherein the mutual authentication of the TPP domain and the locked DO-PD using the two or more exclusive self-hosted credentials includes: Receiving the TPP public key in the DO-PD; Create a TPP domain resident credential in the TPP-'PD; Creating a DO-PD resident credential in the DO-PD; Sending the TPP domain resident credential to the locked DO-PD; encrypting the TPP domain resident credential in the locked DO-PD using the TPP public key to form an encrypted TPP domain resident credential; Sending the encrypted TPP domain residency credential to the TPP domain; decrypting the encrypted TPP domain resident credential in the TPP domain using the TPP private key to form a TPP domain challenge credential; authenticating the DO-PD to the TPP domain when the TPP domain residency credentials are equal to the TPP domain challenge credentials; encrypting the DO-PD resident credentials in the DO-PD using the TPP public key to form an encrypted DO-PD resident credentials; Sending the encrypted DO-PD residency credentials to the TPP domain; decrypting the encrypted DO-PD resident credential in the TPP domain using the TPP private key to form a DO-PD challenge credential; and When the DO-PD residency credentials are equal to the DO-PD challenge credentials, the TPP domain is authenticated to the locked DO-PD.

18. The method according to claim 1, wherein: The TPP domain has a TPP key pair, the TPP key pair includes a TPP private key and a TPP public key, wherein the DO-PD has a PD key pair, the PD key pair includes a PD private key and a PD public key, wherein the mutually authenticating the TPP domain and the locked DO-PD using the two or more exclusive self-hosted credentials includes: Receiving the TPP public key in the DO-PD; Creating a TPP domain resident credential in the TPP domain; Creating a DO-PD resident credential in the DO-PD; encrypting and exchanging the TPP domain resident credentials between the locked DO-PD and the TPP domain using the TPP key pair or the PD key pair; storing the exchanged TPP domain resident credentials in the locked DO-PD as TPP domain challenge credentials; authenticating the DO-PD to the TPP domain when the TPP domain residency credentials are equal to the TPP domain challenge credentials; encrypting and exchanging the DO-PD resident credentials between the locked DO-PD and the TPP domain using the TPP key pair or the PD key pair; storing the exchanged DO-PD resident credentials as the DO-PD challenge credentials; and When the DO-PD residency credentials are equal to the DO-PD challenge credentials, the TPP domain is authenticated to the DO-PD.

19. An apparatus for allowing a third party TP to access a locked device, the apparatus comprising: A device owner's program domain DO-PD and a third party provider TPP domain, wherein the DO-PD has a DO-PD memory and a DO-PD processor, and the TPP domain has a TPP memory and a TPP processor, wherein the DO-PD processor and the TPP processor are configured as: mutually authenticating the TPP domain and the locked DO-PD using two or more exclusive self-hosted credentials; The locked DO-PD is unlocked after mutually authenticating the TPP domain and the locked DO-PD.

20. The device according to claim 19, wherein The TPP domain includes two subdomains, the two subdomains including TPP-PD and TPP-'PD, wherein the TPP-PD is a subdomain of the DO-PD and the TPP-'PD is a subdomain not within the DO-PD, wherein the DO-PD processor and the TPP processor are also configured to generate, disclose, or store the two or more exclusive self-hosted credentials in the locked DO-PD or the TPP-PD.

21. The device according to claim 19, wherein The DO-PD processor and the TPP processor are further configured to perform mutual authentication using the first authentication and the second authentication, wherein: A first authentication authenticates the TPP domain through the DO-PD according to a first message exchange between the TPP domain and the locked DO-PD; and According to a second message exchange between the TPP domain and the locked DO-PD, a second authentication authenticates the DO-PD through the TPP domain.

22. The device according to claim 21, wherein The TPP is a first TPP, wherein the DO-PD processor and the TPP processor are further configured to mutually authenticate a third authentication of the second TPP domain using the DO-PD, wherein: A first authentication of the first TPP domain by the DO-PD includes a first message exchange between the first TPP domain and the DO-PD; A second authentication of the second TPP domain by the DO-PD includes a second message exchange between the second TPP domain and the DO-PD; and The third authentication of the DO-PD by the TPP domain includes a third message exchange between the first TPP domain or the second TPP domain and the DO-PD.

23. The device according to claim 21, wherein The two or more exclusive self-hosted credentials include a DO-PD resident credential and a TPP domain resident credential; wherein the first message exchange includes disclosing or generating a DO-PD challenge credential within the DO-PD, and a first authentication authenticates the TPP domain through the DO-PD when the DO-PD resident credential is equal to the DO-PD challenge credential received from an encrypted exchange of the DO-PD resident credential between the DO-PD and the TPP domain; Wherein, the second message exchange includes disclosing or generating a TPP domain challenge credential within the DO-PD, and when the TPP domain resident credential is equal to the TPP domain challenge credential received from an encrypted exchange of the TPP domain resident credential between the DO-PD and the TPP domain, the second authentication authenticates the DO-PD through the TPP domain.

24. The device according to claim 23, wherein: The encrypted exchange of the second message exchange includes encrypting the TPP domain resident credential and decrypting the encrypted TPP domain resident credential into the TPP domain challenge credential.

25. The device according to claim 23, wherein: The encrypted exchange of the first message exchange includes encrypting the DO-PD resident credentials and decrypting the encrypted DO-PD resident credentials into the DO-PD challenge credentials.

26. The apparatus of claim 19, the DO-PD processor and the TPP processor further configured to receive a request to unlock the DO-PD in the DO-PD; in, After the receiving step, DO-PD resident credentials are stored or generated in the DO-PD, or, after the receiving step, TPP domain resident credentials are stored or generated in the TPP domain.

27. The device according to claim 19, wherein At least one of the two or more exclusive self-hosted credentials is a password, a hashed password, a random number, a device ID of the electronic device credential, a shared secret key between the DO-PD and the TPP domain, an encrypted password, an encrypted random number, an encrypted device ID of the electronic device credential, an encrypted shared secret key between the DO-PD and the TPP domain, a hashed random number, a hashed device ID of the electronic device credential, or a hashed shared secret key between the DO-PD and the TPP domain.

28. The device according to claim 19, wherein The DO-PD is a horizontal program domain.

29. The device according to claim 19, wherein The DO-PD is within an electronic device.

30. The device according to claim 29, wherein: The electronic device is a smartphone or a computer or a tablet.

31. The device according to claim 19, wherein: The DO-PD is a vertical program domain.

32. The apparatus of claim 19, wherein: The DO-PD comprises a database, a word processor, a spreadsheet or a mobile safe.

33. The apparatus of claim 19, wherein: The TPP domain has a TPP key pair, the TPP key pair comprising a TPP private key and a TPP public key, wherein the DO-PD processor and the TPP processor are configured to perform mutual authentication by being programmed to perform the following operations: Receiving the TPP public key in the DO-PD; Creating a TPP domain resident credential in the TPP domain; Creating a DO-PD resident credential in the DO-PD; encrypting and exchanging the TPP domain resident credentials between the locked DO-PD and the TPP domain using the TPP key pair; storing the exchanged TPP domain resident credentials in the locked DO-PD as TPP domain challenge credentials; authenticating the DO-PD to the TPP domain when the TPP domain residency credentials are equal to the TPP domain challenge credentials; encrypting and exchanging the DO-PD resident credentials between the locked DO-PD and the TPP domain using the TPP key pair; storing the exchanged DO-PD resident credentials as the DO-PD challenge credentials; and When the DO-PD residency credentials are equal to the DO-PD challenge credentials, the TPP domain is authenticated to the DO-PD.

34. The device according to claim 33, wherein The DO-PD processor and the TPP processor are configured to encrypt and exchange the TPP domain resident credentials between the locked DO-PD and the TPP domain, including being configured to: send the TPP domain resident credentials to the locked DO-PD, encrypt the TPP domain resident credentials in the locked DO-PD using the TPP public key, and send the encrypted TPP domain resident credentials to the TPP domain; as well as Wherein, the DO-PD processor and the TPP processor are configured to encrypt and exchange the DO-PD resident credentials between the locked DO-PD and the TPP domain, including being configured to: encrypt the DO-PD domain resident credentials in the DO-PD using the TPP public key to form an encrypted DO-PD domain resident credentials, send the encrypted DO-PD domain resident credentials to the TPP domain, and decrypt the encrypted DO-PD domain resident credentials in the TPP domain using the TPP private key to form a DO-PD challenge credential.

35. The apparatus of claim 19, wherein: The TPP domain includes a subdomain TPP-PD of the DO-PD and a second subdomain TPP-'PD not within the DO-PD, wherein the TPP domain has a key pair, the key pair including a TPP private key and a TPP public key, wherein the DO-PD processor and the TPP processor are configured to perform mutual authentication by being programmed to perform the following operations: Receiving the TPP public key in the DO-PD; Create a TPP domain resident credential in the TPP-'PD; Creating a DO-PD resident credential in the DO-PD; Sending the TPP domain resident credential to the locked DO-PD; encrypting the TPP domain resident credential in the locked DO-PD using the TPP public key to form an encrypted TPP domain resident credential; Sending the encrypted TPP domain residency credential to the TPP domain; decrypting the encrypted TPP domain resident credential in the TPP domain using the TPP private key to form a TPP domain challenge credential; authenticating the DO-PD to the TPP domain when the TPP domain residency credentials are equal to the TPP domain challenge credentials; encrypting the DO-PD resident credentials in the DO-PD using the TPP public key to form an encrypted DO-PD resident credentials; Sending the encrypted DO-PD residency credentials to the TPP domain; decrypting the encrypted DO-PD resident credential in the TPP domain using the TPP private key to form a DO-PD challenge credential; and When the DO-PD residency credentials are equal to the DO-PD challenge credentials, the TPP domain is authenticated to the locked DO-PD.

36. The apparatus of claim 19, wherein: The TPP domain has a key pair, the key pair comprising a TPP private key and a TPP public key, wherein the DO-PD has a PD key pair, the PD key pair comprising a PD private key and a PD public key, wherein the DO-PD processor and the TPP processor are configured to perform mutual authentication by being programmed to perform the following operations: Receiving the TPP public key in the DO-PD; Creating a TPP domain resident credential in the TPP domain; Creating a DO-PD resident credential in the DO-PD; encrypting and exchanging the TPP domain resident credentials between the locked DO-PD and the TPP domain using the TPP key pair or the PD key pair; storing the exchanged TPP domain resident credentials in the locked DO-PD as TPP domain challenge credentials; authenticating the DO-PD to the TPP domain when the TPP domain residency credentials are equal to the TPP domain challenge credentials; encrypting and exchanging the DO-PD resident credentials between the locked DO-PD and the TPP domain using the TPP key pair or the PD key pair; storing the exchanged DO-PD resident credentials as the DO-PD challenge credentials; and When the DO-PD residency credentials are equal to the DO-PD challenge credentials, the TPP domain is authenticated to the DO-PD.

Images