TPM Emulator Code Authentication via Key Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Trusted Platform Modules (TPMs) require specific cryptographic algorithms and are inflexible, leading to increased security costs and administrative burdens, while existing solutions for validating execution code integrity are either insecure or too slow.
Innovation Solution
A method using tables of validation public keys and hash algorithms indexed by suspect code to authenticate and validate TPM emulator code before loading it into the execution space, ensuring secure and flexible support for various authentication and encryption algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If specific cryptographic algorithms and TPM hardware devices are used to enhance security, then security reliability is improved, but device complexity and administrative burden increase
Solution Approach 1:
The patent implements a universal TPM emulator that can execute multiple different TPM instances with various cryptographic algorithms (RSA, SHA-1, HMAC) within a single hardware device. The emulator code loaded into the programmable microcontroller enables the same physical TPM to provide services for different security requirements, eliminating the need for multiple specialized hardware devices and reducing administrative complexity while maintaining security reliability.
2Adaptability or versatility
If multiple TPM instances with different algorithms are supported, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent employs a dynamic approach where the TPM emulator can load and switch between different emulator codes corresponding to different TPM instances and cryptographic algorithms. The programmable microcontroller dynamically loads the appropriate emulator code based on the required TPM instance, allowing the system to adapt to various algorithm requirements (RSA, SHA-1, HMAC) without being statically configured, thereby improving versatility while managing device complexity.
3Adaptability or versatility
If code validation is performed outside shielded location before loading, then security flexibility is improved, but validation speed decreases
Solution Approach 1:
The patent implements preliminary validation of emulator code integrity by computing hash values and comparing them against stored reference values before the code is loaded into the shielded execution environment. This preliminary action allows the system to verify code authenticity outside the protected region, providing flexibility in validation processes while ensuring that only validated code enters the critical shielded location, thereby balancing validation flexibility with operational speed.
Data Source
AI summary
A system and method for authenticating suspect code includes steps of: receiving the suspect code for a first instance of a trusted platform module; loading the suspect code into a trusted platform module device operatively associated with a processor, wherein the suspect code is loaded outside of a shielded location within the trusted platform module device; retrieving a validation public key from a table and storing it in a register in the trusted platform module device, the validation public key indexed by the suspect code; and retrieving a hash algorithm from the table, the hash algorithm indexed by the suspect code. The hash algorithm is run to derive a first hash value; then, using the validation public key, the second hash value is decrypted to derive a second decrypted hash value. The two hash values are compared; and upon determining a match, the suspect code is loaded into the shielded location of the processor for execution by the processor.