TPM Authentication for BIOS Cryptographic Offload
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic processors face security and governmental restrictions regarding symmetric key encryption and decryption, necessitating a solution that allows platform entities like BIOS to utilize Trusted Platform Module (TPM) cryptographic functions without violating these restrictions.
Innovation Solution
Implementing an authentication scheme to selectively enable TPM cryptographic functions for authorized platform entities, allowing secure digital signature verification, symmetric key management, and encryption/decryption operations while ensuring compliance with governmental regulations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a BIOS implements cryptographic functions directly, then cryptographic operations can be performed, but the BIOS code size increases and expensive protected storage is required
Solution Approach 1:
The patent extracts cryptographic functions from the BIOS and relocates them to a separate cryptographic co-processor (TPM). This allows the BIOS to perform cryptographic operations by delegating to the TPM, thereby reducing BIOS code size while maintaining cryptographic security. The TPM becomes an independent security module that handles all cryptographic operations externally.
Solution Approach 2:
The patent introduces an authentication scheme as an intermediary layer between the BIOS and the TPM. This authentication mechanism verifies the BIOS's right to use TPM functions before allowing access, enabling secure cryptographic operations without requiring the BIOS to contain cryptographic code or secrets directly.
2Reliability
If a BIOS implements cryptographic functions directly, then cryptographic operations can be performed, but expensive protected non-volatile storage is needed to store secrets
Solution Approach 1:
The patent extracts secret storage from the BIOS system and places it exclusively in the TPM's protected memory. This eliminates the need for expensive protected non-volatile storage in the BIOS, as all secrets (keys, passwords, cryptographic material) are stored and managed within the TPM's secure boundary.
Solution Approach 2:
The TPM provides self-service for secret management by generating, storing, and protecting all cryptographic secrets internally. The BIOS can utilize these secrets through authenticated access without needing its own secret storage infrastructure, thereby reducing overall system cost while maintaining security.
3Reliability
If TPM symmetric encryption functions are used, then secure data transfer can be achieved, but governmental import/export restrictions are violated
Solution Approach 1:
The patent introduces an authentication scheme as an intermediary control mechanism that mediates between the TPM's encryption capabilities and governmental restrictions. The authentication scheme verifies the BIOS's authorization to use TPM functions, and the TPM is configured to perform encryption operations internally without exporting symmetric keys, thereby maintaining data security while complying with regulatory restrictions.
Solution Approach 2:
The patent changes the operational parameters of the TPM by configuring it to perform symmetric encryption internally without key export capability. The TPM processes encryption/decryption operations with keys that remain confined within its secure boundary, changing the system from key-exportable to key-confined operation, thus achieving regulatory compliance while maintaining cryptographic functionality.
Data Source
AI summary
A computer platform is provided that comprises a processor and a cryptographic co-processor coupled to the processor. The computer platform further comprises a platform entity coupled to the processor. The platform entity establishes a secure relationship with the cryptographic co-processor that enables the platform entity to utilize cryptographic functions provided by the cryptographic co-processor.