Trusted Platform Module Swarm for High-Performance Server Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing trusted platform module (TPM) systems rely on a single point of trust, which can lead to security vulnerabilities and system failure if the TPM fails, especially in high-performance servers where redundancy is crucial, and replicating secrets across multiple TPMs poses security risks.
Innovation Solution
A TPM swarm is created by splitting the identity and private key into parts across multiple TPMs, using Shamir's Secret Sharing algorithm, ensuring that only a predetermined combination of TPMs can access the system, maintaining security even if one or more TPMs fail, and allowing the system to remain operational with a minimum number of available TPMs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single TPM is used as the root of trust, then the system is simpler to manage, but the system has a single point of failure and reduced reliability
Solution Approach 1:
The patent divides the single TPM root of trust into multiple TPMs (forming a TPM swarm). The private key is split into multiple parts and distributed across different TPMs. This segmentation eliminates the single point of failure while maintaining manageable complexity through automated key management protocols.
Solution Approach 2:
The patent combines multiple TPMs into a unified TPM swarm that functions as a collective root of trust. The individual TPMs work together through coordinated key operations, where a threshold number of TPMs must collaborate to perform cryptographic operations, thereby achieving high reliability while presenting a unified interface to the system.
2Reliability
If multiple TPMs are used for redundancy, then system reliability improves, but security risks increase due to replication of secrets
Solution Approach 1:
Instead of replicating complete secrets across multiple TPMs, the patent segments the private key into multiple distinct parts and distributes them across the TPM swarm. Each TPM holds only a fragment of the secret, making it computationally infeasible for attackers to compromise the system by targeting individual TPMs.
Solution Approach 2:
Each TPM in the swarm has a unique local quality - it holds a specific portion of the split private key corresponding to its identity. This local differentiation ensures that no two TPMs have the same secret material, thereby eliminating the security vulnerability associated with secret replication while maintaining redundancy.
3Object-affected harmful factors
If the private key is split across multiple TPMs, then security is enhanced and single point of failure is eliminated, but the system complexity increases
Solution Approach 1:
The TPM swarm system implements self-service mechanisms for key management. The system automatically handles key splitting, distribution, and reconstruction operations without requiring manual intervention. The TPMs themselves perform cryptographic operations to validate their identities and collaborate on key reconstruction, reducing the burden on external key management infrastructure.
Solution Approach 2:
The system incorporates feedback mechanisms where TPMs report their status and cryptographic capabilities to the system manager. This feedback enables automated decision-making about key operations, ensuring that the correct threshold of TPMs are available and functional before performing sensitive cryptographic operations, thereby managing complexity through intelligent control.
Data Source
AI summary
Provided is a method and system for protecting the integrity of a computing system. The system may initialize a plurality of trusted platform modules (TPMs) within the computing system. The system may read a unique identifier corresponding to each TPM of the plurality of TPMs to determine a system state. The system may write the system state to platform configuration registers (PCRs) of each of the plurality of TPMs. The system may load a sealed private owner key part into each TPM of the plurality of TPMs. The plurality of TPMs may determine if a predetermined number of unique identifiers have been processed by validating a value of the PCRs to meet an owner key policy. The plurality of TPMs may unseal the private owner key part in each TPM where the value of the PCRs meets the owner key policy.