TPM-Based Cloud Device Enrollment Without Plaintext Key Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure device enrollment processes for cloud services, particularly for managed devices, lack robust security measures, as they often involve exposing private keys in plain text, which compromises privacy and trust establishment, and manufacturers' generated endorsement keys cannot be traced back to a specific attester platform.
Innovation Solution
Utilizing a Trusted Platform Module (TPM) to establish trust between devices and cloud services by bypassing plain text exposure of endorsement keys, employing a mobile device management (MDM) agent to create an owner hierarchy, and using mutual Transport Layer Security (mTLS) for secure communication, ensuring that cryptographic operations are performed within the TPM without direct access to private keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If private keys are exposed in plain text during device enrollment, then device enrollment process is simplified, but security and privacy are compromised
Solution Approach 1:
The patent introduces a Mobile Device Management (MDM) agent as an intermediary component that mediates between the device enrollment process and the private keys. The MDM agent creates an owner hierarchy and manages key operations without exposing private keys in plain text, thus maintaining security while enabling enrollment. The MDM agent acts as a trusted intermediary that facilitates the enrollment process without compromising security.
2Adaptability or versatility
If endorsement keys are used for device identification, then device identification is enabled, but the keys cannot be traced back to specific attester platforms
Solution Approach 1:
The patent segments the device identification system into multiple components: the endorsement key for anonymous identification, the device certificate for verified identity, and the MDM-managed owner hierarchy for traceability. This segmentation allows the endorsement key to provide identification capability while the separate certificate and hierarchy structures maintain traceability information without exposing the endorsement key itself.
3Speed
If cryptographic operations are performed outside TPM, then processing speed is improved, but security is compromised
Solution Approach 1:
The patent extracts the private key management functions from the TPM hardware and places them in the software-based MDM agent's owner hierarchy. This allows cryptographic operations to be performed in software for faster processing while the TPM remains involved for attestation purposes. The MDM agent manages keys in a way that maintains security without requiring constant TPM involvement for every operation.
Data Source
AI summary
A method for secure enrollment of a device in a cloud service includes establishing trust between a trusted platform module (TPM) of a device and a cloud service by bypassing a plain text exposure of an endorsement key (EK) of the TPM. The method also includes establishing secure communication between a cloud service agent of the device and the cloud service by using mutual Transport Layer Security (mTLS) to present a device certificate from the cloud service agent to the cloud service.