TPM One-Time Password Delegation via Version Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional password-based protection mechanisms, including one-time passwords, can be compromised or tampered with, especially in computing environments where security processes are vulnerable to alteration or tampering.
Innovation Solution
A Trusted Platform Module (TPM) generates keys that can only be used on the computing device, allowing for delegation of access with a version-controlled authentication value, enabling a one-time password mechanism that increments version numbers for secure access and policy enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based protection mechanisms are used, then access control is provided, but the protection can be compromised if passwords are discovered or the computing environment is tampered with
Solution Approach 1:
The patent extracts the password generation and verification process from the vulnerable computing environment by using a TPM device. The TPM generates passwords locally and stores them in its secure memory, separating the password management function from the main system that could be compromised. This extraction ensures that even if the computing environment is tampered with, the passwords remain protected within the TPM.
Solution Approach 2:
The TPM acts as an intermediary between the user and the protected resource. Instead of directly using passwords in the vulnerable computing environment, the TPM mediates authentication by generating passwords on-demand and verifying them securely. This intermediary role isolates the password management from potential attacks on the main system.
2Reliability
If one-time passwords are used, then password reuse is prevented, but the mechanism may still be insufficient if the computing environment is compromised
Solution Approach 1:
The patent extracts the one-time password generation from the vulnerable computing environment and places it within the TPM. The TPM generates each password locally using its secure random number generator and stores it temporarily in its protected memory. This extraction ensures that even if the computing environment is compromised, the one-time passwords remain secure within the TPM's isolated security boundary.
Solution Approach 2:
The patent implements prior cushioning by pre-establishing the TPM as a secure element before any potential compromise occurs. The TPM's hardware-based security measures are in place beforehand to protect against environment tampering. The delegated authentication mechanism with version control is set up in advance to ensure that even if the environment is compromised later, the one-time passwords remain protected.
3Adaptability or versatility
If delegation of keys is implemented, then controlled access is enabled, but system complexity increases
Solution Approach 1:
The patent segments the authentication process into distinct components: key generation, delegation creation, version control, and verification. Each component is implemented as a separate function within the TPM, allowing for modular management. The delegated authentication values are segmented by version numbers, enabling independent control and tracking of each delegation instance without managing the entire key system as a monolithic complex structure.
Data Source
AI summary
A Trusted Platform Module (TPM) can be utilized to implement One Time Password (OTP) mechanisms. One or more delegation blobs can be created by the TPM and the delegation authentication values of the delegation blobs can be based on the version number of the delegation blobs. A data blob with a protected secret can comprise a pointer to the delegation table of the TPM. The version number can be provided to an authority from which an OTP (a delegation authentication value) can be received. The OTP can be utilized to gain access to the secret and an authentication value of the key blob, which can be utilized to increase the version number of all associated delegation blobs. Policy limitations can be associated with the delegation blobs and can be enforced by policy enforcement mechanisms that can reference the TPM tick counter to enforce temporal policy restrictions.