Attestation using both fixed token and portable token

• US 20040117625A1
• Filed: 12/16/2002
• Published: 06/17/2004
• Est. Priority Date: 12/16/2002
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Grawrock, David W.
• Granted Patent: US 7,318,235 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Methods, apparatus and machine readable medium are described for creating and using protected key blobs that require a particular portable token be present before use of the key or keys of the protected key blob is granted. Such protected key blobs may be used to establish a level of trust between a local user and the computing device.

Claims

1. A method comprising

requesting a fixed token to create a sealed key blob comprising a first key pair and first usage authorization data, knowledge of which is required in order to use a private key of the first key pair, and

requesting a portable token to create a protected key blob comprising the sealed key blob and second usage authorization data, knowledge of which is required in order to obtain the sealed key blob from the protected key blob.

2. The method of claim 1 comprising

encrypting the private key of the first key pair and the first usage authorization data with the fixed token and a public key of the fixed token, and

creating the sealed key blob with the encrypted private key and the encrypted first usage authorization data.

3. The method of claim 2 comprising

encrypting the sealed key blob and the second usage authorization data with the portable token and a public key of the portable token, and

creating the protected key blob with the encrypted sealed key blob and the encrypted second usage authorization data.

4. The method of claim 1 comprising

requesting the portable token to return the sealed key blob from the protected key blob,

providing the portable token with proof of possessing the second usage authorization data, and

obtaining the sealed key blob from the portable token only if the proof of possessing the second usage authorization data was valid.

5. The method of claim 4 comprising

requesting the fixed token to load the first key pair from the sealed key blob, and

providing the fixed token with proof of possessing the first usage authorization data, and

obtaining a key handle to the first key pair stored in the fixed token only if the proof of possessing the first usage authorization data was valid.

6. The method of claim 1 comprising

directing a request to the portable token to return the sealed key blob from the protected key blob, the request comprising proof of possessing the second usage authorization data, and

obtaining the sealed key blob from the portable token only if the portable token was present and the proof of possessing the second usage authorization data was valid.

7. The method of claim 6 comprising

directing a request to the fixed token to load the first key pair from the sealed key blob, the request comprising proof of possessing the first usage authorization data, and

obtaining a key handle to the first key pair stored in the fixed token only if the proof of possessing the first usage authorization data was valid and an environment associated with the request satisfies criteria specified by the sealed key blob.

8. The method of claim 3 comprising

providing the portable token with a request for the sealed key blob of the protected key blob, the request providing proof of possessing the second usage authorization data,

decrypting the encrypted sealed key blob and the encrypted second usage authorization data of the protected key blob with the portable token using a private key of the portable token, and

receiving the sealed key blob from the portable token in response to the portable token determining that the proof of possessing the second usage authorization data was valid.

9. The method of claim 8 further comprising

scrubbing the protected key blob and associated data from the portable token in response to determining that the proof of possessing the second usage authorization data was invalid.

10. The method of claim 9 further comprising deactivating the portable token in response to determining that the proof of possessing the second usage authorization data was invalid.

11. The method of claim 8 comprising

providing the fixed token with a request to load the first key pair of the sealed key blob, the request providing proof of possessing the first usage authorization data,

decrypting the encrypted private key and the encrypted first usage authorization data of the sealed key blob with the fixed token using a private key of the fixed token, and

receiving a key handle to the first key pair of the sealed key blob in response to the fixed token determining that the proof of possessing the first usage authorization data was valid.

12. The method of claim 11 further comprising

scrubbing the sealed key blob and associated data from the fixed token in response to determining that the proof of possessing the first usage authorization data was invalid.

13. The method of claim 12 further comprising deactivating the portable token in response to determining that the proof of possessing the first usage authorization data was invalid.

14. A machine-readable medium comprising a plurality of instructions that, in response to being executed, result in a processor

requesting a portable token to provide a sealed key blob from a protected key blob that comprises usage authorization data,

providing the portable token with an authentication code that is based upon usage authorization data that the processor has for the protected key blob, and

receiving the sealed key blob from the portable token only if the authentication code indicates that the usage authorization data of the processor has a predetermined relationship to the authorization data of the protected key blob.

15. The machine-readable medium of claim 14 wherein the sealed key blob comprises first usage authorization data and the plurality of instructions further result in the processor

requesting a fixed token to load a first key pair from the sealed key blob,

providing the fixed token with a first authentication code that is based upon first usage authorization data that the processor has for the sealed key blob, and

receiving a first key handle for the first key pair only if the first authentication code indicates that the first usage authorization data of the processor has a predetermined relationship to the first authorization data of the sealed key blob.

16. The machine-readable medium of claim 15 wherein the plurality of instructions further result in the processor

generating the first authentication code based upon a first HMAC calculation which uses a first shared secret that is based upon the first usage authorization data the processor has for the sealed key blob.

generating the authentication code based upon a second HMAC calculation which uses a second shared secret that is based upon the usage authorization data the processor has for the protected key blob.

17. The machine-readable medium of claim 15 wherein the plurality of instructions further result in the processor

generating the authentication code based upon a first HMAC calculation which uses a first shared secret that is based upon the first usage authorization data the processor has for the sealed key blob and first rolling nonces associated with the fixed token.

generating the authentication code based upon a second HMAC calculation which uses a second shared secret that is based upon the usage authorization data the processor has for the protected key blob and second rolling nonces associated with the portable token.

18. The machine-readable medium of claim 15 wherein the plurality of instructions further result in the processor

determining that a user associated with the portable token is present in response to receiving the first key handle.

19. The machine-readable medium of claim 15 wherein the plurality of instructions further result in the processor

determining that a user associated with the portable token is present in response to successfully decrypting a secret using the first key pair identified by the first key handle.

20. The machine-readable medium of claim 14 wherein the sealed key blob comprises first usage authorization data and the plurality of instructions further result in the processor

providing the fixed token with at least one metric of an environment,

requesting a fixed token to load a first key pair from the sealed key blob,

providing the fixed token with a first authentication code that is based upon first usage authorization data that the processor has for the sealed key blob, and

receiving a first key handle for the first key pair only if the first authentication code indicates that the first usage authorization data of the processor has a predetermined relationship to the first authorization data of the sealed key blob and the at least one metric indicates that the environment satisfies criteria specified by the sealed key blob.

21. The machine-readable medium of claim 20 wherein the plurality of instructions further result in the processor

determining that the environment satisfies the criteria specified by the sealed key blob in response to receiving the first key handle.

22. The machine-readable medium of claim 20 wherein the plurality of instructions further result in the processor

determining that the environment satisfies the criteria specified by the sealed key blob in response to successfully decrypting a secret using the first key pair identified by the first key handle.

23. A computing device, comprising

a fixed token comprising a first processing unit and first protected storage, the first processing unit to load a first key pair of a sealed key blob into the first protected storage in response to determining that a first authentication code has a predetermined relationship to first usage authorization data of the sealed key blob,

a portable token comprising a second processing unit and second protected storage, the second processing unit to return the sealed key blob from a protected key blob in response to determining that a second authentication code has a predetermined relationship to second usage authorization data of the protected key blob,

a portable token interface that enables the portable token to be coupled to and removed from the computing device,

a processor to provide the portable token with a request for the sealed key blob that comprises the protected key blob and the second authentication code and to provide the fixed token with a request to load the first key pair that comprises the sealed key blob and the first authentication code.

24. The computing device of claim 23 wherein

the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and

the processor is to determine that that a user associated with the portable token is present in response to receiving the first key handle.

25. The computing device of claim 23 wherein

the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and

the processor is to determine that a user associated with the portable token is present in response to successfully decrypting a secret using the first key pair identified by the first key handle.

26. The computing device of claim 23 wherein

the first protected storage of the fixed token comprises registers for storing metrics of an environment,

the processor is to provide the fixed token with a plurality of metrics of the environment, and

the first processing is to load the first key pair into the first protected storage only if the metrics stored in the registers indicate that the environment satisfies criteria of the sealed key blob.

27. The computing device of claim 26 wherein

the fixed token is to provide a first, key handle to the first key pair in response to successfully loading the first key pair, and

the processor is to determine that the environment satisfies the criteria specified by the sealed key blob in response to receiving the first key handle.

28. The computing device of claim 26 wherein

the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and

the processor is to determine that the environment satisfies the criteria specified by the sealed key blob in response to successfully decrypting a secret using the first key pair identified by the first key handle.

29. The computing device of claim 26 wherein

the first processing unit is to scrub the sealed key blob and any associated data from the fixed token in response to determining that the environment does not satisfy the criteria of the sealed key blob.

30. The computing device of claim 23 wherein

the fixed token comprises a key pair used to create the sealed key blob,

the first processing unit only loads the first key pair of the sealed key blob in response to a request received via a first session established for the key pair used to create the sealed key blob, and

the processor is to establish the first session prior to providing the fixed token with the request to load the first key pair.

31. The computing device of claim 30 wherein

the portable token comprises a key pair used to create the protected key blob,

the second processing unit is to only load the first key pair of the sealed key blob in response to a request received via a second session established for the key pair used to create the protected key blob, and

the processor is to establish the second session prior to providing the portable token with the request to for the sealed key blob.