Virtual Root of Trust for Non-ROT Component Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Information Handling Systems (IHSs) face challenges in validating devices without a hardware root of trust, as these devices lack cryptographic identity and secure key storage, hindering data protection and attestation processes.
Innovation Solution
Implementing a virtual root of trust abstraction layer that derives symmetric and asymmetric encryption keys from unique device identifiers, encrypts certificates, and stores them securely, providing cryptographic identity and validation for non-ROT devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If device validation depends on hardware root of trust, then security and cryptographic identity are improved, but device compatibility and cost are worsened because components without root of trust cannot be validated
Solution Approach 1:
The patent introduces a hardware component that acts as an intermediary between devices without root of trust and the validation system. This component stores cryptographic keys and certificates externally, enabling devices that lack built-in root of trust to still participate in secure validation through the intermediary's cryptographic infrastructure
Solution Approach 2:
The patent moves cryptographic functionality from the device dimension (internal root of trust) to the system dimension (external hardware component). By storing keys and certificates in a separate hardware component rather than requiring them to be embedded in each device, the system enables validation at a different architectural level
2Reliability
If hardware root of trust is built into each device, then cryptographic identity is improved, but device cost and complexity are worsened
Solution Approach 1:
The patent extracts the root of trust functionality from individual devices and consolidates it into a separate hardware component. This extraction allows devices to remain simpler while still benefiting from cryptographic validation through the external component that stores their keys and certificates
3Object-affected harmful factors
If hardware root of trust is built into each device, then security against unauthorized hardware is improved, but component cost is worsened
Solution Approach 1:
The patent creates a universal hardware component that can serve multiple devices without root of trust. This single component provides cryptographic validation for many different devices, reducing the need for each device to have expensive built-in security hardware while maintaining overall system security
Solution Approach 2:
The patent enables devices without root of trust to be validated by copying their cryptographic identity into the external hardware component. The component stores certificates and keys that represent the device's identity, allowing validation without requiring the device itself to have embedded security hardware
Data Source
AI summary
Methods and system are provided for virtualizing root of trust (ROT) to serve devices that do not have built-in ROT functionality. A component of a computer system may provide root of trust functionality for the computer system generally. That component may also provide virtualized ROT functionality for a non-ROT component by generating a symmetric encryption key and an asymmetric encryption key pair using a unique identifier of the non-ROT component. The virtual ROT functionality may handle storage of the encryption keys as well as an ID certificate for the non-ROT component. Furthermore, the virtual ROT functionality may be configured to write encrypted data to an internal memory of the non-ROT component, read and decrypt that data, and write back further encrypted data.