TPM Storage Extension via UEFI Variables

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The available non-volatile storage in a Trusted Platform Module (TPM) is insufficient to store additional cryptographic data, such as digital certificates, leading to security risks when these data are stored on hard disk drives, which are not persistent and can become desynchronized.

Innovation Solution

Utilizing UEFI variables as additional storage space for TPM-related data, allowing cryptographic information to be stored externally within the TPM, thereby extending the storage capacity without requiring special hardware or software tools and maintaining standardized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If cryptographic data is stored in the TPM's non-volatile storage, then security is improved, but storage capacity is insufficient

Engineering Contradiction:

ImprovesecurityVSAvoidstorage capacity

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The storage system is segmented into two parts: the TPM's non-volatile storage for secure cryptographic operations and the hard disk drive for additional cryptographic data storage. This segmentation allows each storage medium to serve its optimal function while collectively providing sufficient storage capacity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The processor acts as an intermediary that manages cryptographic operations by retrieving cryptographic data from both the TPM's non-volatile storage and the hard disk drive, coordinating access between these two storage locations to enable secure operations with extended storage capacity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Quantity of substance

If additional cryptographic data is stored on hard disk drive, then storage capacity is increased, but data persistence and synchronization are compromised

Engineering Contradiction:

Improvestorage capacityVSAvoiddata persistence

Core Design Contradiction:

Quantity of substanceVSReliability

Solution Approach 1:

The system implements feedback mechanisms where the processor monitors and manages cryptographic data across both the TPM's non-volatile storage and the hard disk drive, ensuring that data is properly synchronized and the integrity of cryptographic operations is maintained through coordinated access patterns.

Inventive Principle:

Principle #23Feedback

3Quantity of substance

If TPM storage is extended using UEFI variables, then storage capacity is improved, but access standardization is required

Engineering Contradiction:

Improvestorage capacityVSAvoidaccess standardization

Core Design Contradiction:

Quantity of substanceVSEase of operation

Solution Approach 1:

The system utilizes UEFI variables as a universal interface that allows the processor to access cryptographic data stored in extended storage locations through standardized UEFI protocols, enabling multi-functional access patterns that maintain ease of operation while extending storage capacity beyond the TPM's internal limits.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentEP4488863A1Extended storage for a trusted platform module

Publication Date: 2025.01.08 DIEBOLD NIXDORF SYST GMBH

Figure 1
Figure 2A~2B
Figure 2C

AI summary

The present disclosure relates to a computer system (200) including a processor (202) configured to: carry out a cryptographic operation (204) using first cryptographic information (206) and second cryptographic information (208), wherein the first cryptographic information (206) is stored in a Trusted Platform Module (210), and wherein the processor (202) is configured to retrieve the second cryptographic information (208) from one or more UEFI variables (212).