Dynamic Authorization for Secure Secret Information Release
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems with trusted platform modules (TPM), existing authorization models become invalid due to software state changes after operating system initialization, especially with multithreaded processing and frequent software updates, making it difficult to securely access secret information.
Innovation Solution
A method where a server signs a distinct authorization for each client based on the software state and a unique client identifier, allowing clients to access secret information stored in a cryptographic processor, with the ability to request new authorizations when software state changes occur, and using incremental event logs to validate updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secret information is sealed to platform configuration registers (PCRs) that reflect software state, then security is improved by ensuring access only when software is in a trusted state, but the authorization becomes invalid when software state changes due to updates or multithreaded processing
Solution Approach 1:
The patent transitions from static authorizations sealed to PCRs to dynamic authorizations based on event logs that continuously reflect software execution. The event log is updated as software runs, and authorizations are validated against this dynamic log rather than static PCR values, allowing the system to adapt to changing software states while maintaining security.
Solution Approach 2:
The patent performs preliminary validation of the event log against a whitelist of approved software before issuing authorizations. This preliminary action ensures that only authorized software can obtain access to secret information, maintaining security while allowing legitimate software updates and changes.
2Ease of operation
If authorizations are distributed centrally to clients for long-term use, then ease of operation is improved, but reliability deteriorates when software state changes after operating system initialization
Solution Approach 1:
The patent implements a feedback mechanism where clients periodically present their event logs to the server for validation. The server checks the event log against the whitelist and updates or revokes authorizations based on the current software state. This continuous feedback loop maintains authorization validity while allowing clients to operate autonomously between validations.
Solution Approach 2:
The system uses periodic validation of event logs against the whitelist rather than requiring continuous server connection. Authorizations are issued for limited periods and must be refreshed when software state changes, balancing ease of operation with maintained security and validity.
3Measurement precision
If platform configuration register values are continuously updated to reflect running software, then measurement precision is improved for tracking software state, but device complexity increases due to multithreaded processing and frequent updates
Solution Approach 1:
The patent extracts the software state tracking function from the TPM hardware into a software-based event log maintained in system memory. This separates the measurement function from the cryptographic security functions of the TPM, reducing hardware complexity while maintaining precise tracking of software state through the event log.
Solution Approach 2:
The event log acts as an intermediary between the complex multithreaded software environment and the authorization system. Instead of directly tracking all PCR changes from multithreaded operations, the event log provides a simplified, sequential record of software execution that can be validated against the whitelist, reducing the complexity of state tracking while maintaining precision.
Data Source
AI summary
A method, apparatus, computer system, and computer program product for releasing secret information. A client on a computer system performing an attestation to a server on another computer system. The client receives an authorization that authorizes releasing the secret information. The client releases the secret information from a co-processor on the computer system using the authorization received from the server.