TPM-Bound HDD Encryption for Theft Deterrence
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems lack effective deterrents against theft, as stolen devices can often be made usable by unauthorized users with minimal effort, making theft profitable.
Innovation Solution
Implementing a system that utilizes a Trusted Platform Module (TPM) and a secure hard disk drive (HDD) requiring a decrypted symmetric key for operation, which is made unavailable to thieves by using an encrypted key bound to the TPM and stored securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional storage systems are used without encryption binding, then the computer system is easy to operate and access, but the system is vulnerable to theft and unauthorized use
Solution Approach 1:
The system performs preliminary encryption of the symmetric key and binds it to the TPM during system setup. This preliminary action ensures that even if the physical system is stolen, the encrypted data remains inaccessible without the original TPM, thus preventing unauthorized use while maintaining ease of operation for authorized users
Solution Approach 2:
The TPM acts as an intermediary between the encrypted symmetric key and the decryption process. It mediates the security requirement by holding the binding key that can only decrypt the symmetric key when presented with valid authorization, thus resolving the contradiction between security and ease of operation
2Reliability
If encryption keys are stored in secure locations, then security is improved, but the complexity of key management increases
Solution Approach 1:
The system extracts the security function into a dedicated TPM hardware module, separating the key management complexity from the main system. The TPM independently handles key generation, storage, and decryption operations, reducing the overall system complexity while maintaining high security standards
Solution Approach 2:
The TPM performs self-service by automatically managing the binding key and decryption process. It autonomously verifies authorization and performs decryption without requiring external key management infrastructure, thus improving security while minimizing the complexity burden on the system administrator
Data Source
AI summary
A method for theft deterrence of a computer system is disclosed. The computer system includes a trusted platform module (TPM) and storage medium. The method comprises providing a binding key in the TPM; and providing an encrypted symmetric key in the storage medium. The method further includes providing an unbind command to the TPM based upon an authorization to provide a decrypted symmetric key; and providing the decrypted symmetric key to the secure storage device to allow for use of the computer system. Accordingly, by utilizing a secure hard disk drive (HDD) that requires a decrypted key to function in conjunction with a TPM, a computer if stolen is virtually unusable by the thief. In so doing, the risk of theft of the computer is significantly reduced.