TPM Secret Sealing via Multiple BLOBs for Secure Boot Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing trusted platform module (TPM) systems fail to provide access to sealed secrets when system updates occur, leading to the secret being locked and rendering the computing system unusable, even if the system is not compromised, due to mismatched condition values.
Innovation Solution
The secret is sealed into multiple binary large objects (BLOBs), each associated with different conditions, allowing access as long as one condition is met, and enabling updates to system conditions without rendering the secret unusable, by using multiple BLOBs to ensure the secret can be unsealed even if single condition values do not match.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the secret is sealed to a single condition value, then the system security is improved, but the system becomes unusable after legitimate updates cause condition value mismatches
Solution Approach 1:
The patent divides the single sealed secret into multiple sealed copies, each associated with different condition values. When the system undergoes legitimate updates that change the condition value, at least one sealed copy remains accessible, ensuring system usability while maintaining security through the sealed architecture.
Solution Approach 2:
The patent changes the parameter of condition values from a single fixed value to multiple varying values. Each sealed secret copy is bound to different condition values, allowing the system to adapt to legitimate updates while maintaining security. The TPM evaluates multiple condition values to determine accessibility.
2Ease of operation
If the secret is sealed to multiple conditions, then the system usability is improved during updates, but the device complexity increases
Solution Approach 1:
The TPM automatically manages multiple sealed secret copies and their associated condition values without requiring external intervention. The system self-evaluates multiple conditions and automatically selects an accessible sealed copy, reducing the operational burden on users despite the increased internal complexity.
Solution Approach 2:
The sealed secret mechanism serves multiple functions: it provides security through sealing, enables usability during updates through multiple condition values, and automates the selection process. The same TPM infrastructure handles both security enforcement and adaptive accessibility.
3Ease of operation
If the secret is resealed after updates, then the system usability is maintained, but the risk of compromising the sealing integrity increases
Solution Approach 1:
The patent performs preliminary sealing of secret copies to different condition values before updates occur. This preliminary action ensures that when updates change the system state, at least one pre-sealed copy remains accessible without requiring post-update resealing operations that could compromise integrity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Obtaining a sealed secret. The method includes decrypting one or more BLOBs at a computing system from among a plurality of different BLOBs. Each of the BLOBs in the plurality of BLOBs contains the secret. Each of the BLOBs in the plurality of BLOBs is sealed to a different condition from among a plurality of conditions. A given condition is a reflection of a system state where the system state is indicative of whether or not the system can be trusted to receive the secret. The method further includes evaluating one or more of the conditions to determine if at least one of the one or more conditions is met. The method further includes, if at least one of the one or more conditions is met, then providing the secret to an external entity.