Method for migrating a base chip key from one computer system to another

• US 20020196946A1
• Filed: 06/22/2001
• Published: 12/26/2002
• Est. Priority Date: 06/22/2001
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Challener, David Carroll, Ovies, Hernando
• Granted Patent: US 6,944,300 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method for migrating a base chip key from a first computer system to a second computer system is disclosed. A first computer system includes a base chip key 1, and a second computer system includes a base chip key 2. Using a first certificate for the base chip key 1, a manufacturer of the second computer system generates a second certificate for the base chip key 1. Similarly, using a first certificate for the base chip key 2, a manufacturer of the first computer system generates a second certificate for the base chip key 2. A first data packet is then sent from the first computer system to the second computer system. The first data packet includes a first random number and all the data required to reproduce the base chip key 1 in the first computer system. The first data packet is also encrypted with the base chip key 1'"'"'s public key. In return, a second data packet is sent from the second computer system to the first computer system, and the second data packet includes the first random number and a second random number, signed by the base chip key 2. The base chip key 1 is then erased from the first computer system. Finally, the base chip key 2 in the second computer system is replaced by the base chip key 1.

Claims

1. A method for migrating a base chip key from a first computer system to a second computer system, wherein said first computer system includes a base chip key 1, and said second computer system includes a base chip key 2, said method comprising:

generating a second certificate for said base chip key 1 by a manufacturer of said second computer system using a first certificate for said base chip key 1, and generating a second certificate for said base chip key 2 by a manufacturer of said first computer system using a first certificate for said base chip key 2;

sending a first data packet from said first computer system to said second computer system, wherein said first data packet includes all data necessary to reproduce said base chip key 1 in said second computer system;

sending a second data packet from said second computer system to said first computer system acknowledging the receipt of a copy of said base chip key 1;

erasing said base chip key 1 from said first computer system; and

replacing said base chip key 2 in said second computer system with said base chip key 1.

2. The method of claim 1, wherein said first data packet includes a first random number.

3. The method of claim 1, wherein said first data packet is encrypted with said base chip key 1'"'"'s public key.

4. The method of claim 1, wherein said second data packet includes said first random number and a second random number.

5. The method of claim 1, wherein said second data packet is signed by said base chip key 2.

6. The method of claim 1, wherein said method further includes:

generating an identity key 1 in said first computer system, and generating an identity key 2 in said second computer system;

generating a certificate for said identity key 1, and generating a certificate for said identity key 2; and

generating a first certificate for said base chip key 1 using said identity key 1, and generating a first certificate for said base chip key 2 using said identity key 2.

8. The computer program product of claim 1, wherein said first data packet includes a first random number.

9. The computer program product of claim 1, wherein said first data packet is encrypted with said base chip key 1'"'"'s public key.

10. The computer program product of claim 1, wherein said second data packet includes said first random number and a second random number.

11. The computer program product of claim 1, wherein said second data packet is signed by said base chip key 2.

12. The computer program product of claim 1, wherein said computer program product further includes:

program code means for generating an identity key 1 in said first computer system, and generating an identity key 2 in said second computer system;

program code means for generating a certificate for said identity key 1, and generating a certificate for said identity key 2; and

program code means for generating a first certificate for said base chip key 1 using said identity key 1, and generating a first certificate for said base chip key 2 using said identity key 2.

7. A computer program product residing on a computer usable medium for migrating a base chip key from a first computer system to a second computer system, said computer program product comprising:

program code means for generating a second certificate for said base chip key 1 by a manufacturer of said second computer system using a first certificate for said base chip key 1, and generating a second certificate for said base chip key 2 by a manufacturer of said first computer system using a first certificate for said base chip key 2;

program code means for sending a first data packet from said first computer system to said second computer system, wherein said first data packet includes all data necessary to reproduce said base chip key 1 in said second computer system;

program code means for sending a second data packet from said second computer system to said first computer system acknowledging the receipt of a copy of said base chip key 1;

program code means for erasing said base chip key 1 from said first computer system; and

program code means for replacing said base chip key 2 in said second computer system with said base chip key 1.