Renewable and individualizable elements of a protected environment

• US 20050268115A1
• Filed: 07/28/2005
• Published: 12/01/2005
• Est. Priority Date: 04/30/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Barde, Sumedh N., Upadhyay, Chaitanya Dutt, Weiss, Rebecca Claire, Grigorovitch, Alexandre V., Kuhn, Reid Joseph
• Granted Patent: US 8,074,287 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/68 Special signature format, e.g. XML format
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Systems and methods for providing a protected computing environment comprising separating out a protected environment management component from a kernel of a computing device, providing identification information as a part of the protected environment management component, and providing individualization information as part of the protected environment management component.

Claims

1. A method for providing a protected computing environment comprising:

separating out a protected environment management component from a kernel of a computing device;

providing identification information as a part of the protected environment management component; and

providing individualization information as part of the protected environment management component.

2. The method for providing a protected computing environment of claim 1, in which the individualization information serves to bind the protected environment management component to a specific computing device.

3. The method for providing a protected computing environment of claim 1, in which the identification information is compared against a revocation list.

4. The method for providing a protected computing environment of claim 1, in which the protected environment management component comprises secret information.

5. The method for providing a protected computing environment of claim 1, in which the protected environment management component comprises a kernel secure flag.

6. The method for providing a protected computing environment of claim 1, in which the structure of the protected environment management component is obfuscated.

7. The method for providing a protected computing environment of claim 1, in which the code embodying the protected environment management component is obfuscated.

8. The method for providing a protected computing environment of claim 1, in which the protected environment management component interacts with the kernel of the computing device at least in part via secure communications.

9. The method for providing a protected computing environment of claim 8, in which the protected environment management component responds to requests for the state kernel secure flag.

10. A system of establishing a protected environment within a device comprising:

a means for validating a secure operating environment;

a means for indicating the security state of the secure operating environment;

a means for establishing a protected environment; and

a means for securely communicating between the secure operating environment and the protected environment.

11. The system of establishing a protected environment within a device of claim 10, further comprising a means for individualizing the system of establishing a protected environment within a device.

12. The system of establishing a protected environment within a device of claim 10, further comprising a means of revoking the system of establishing a protected environment within a device.

13. The system of establishing a protected environment within a device of claim 10, further comprising a means of renewing the system of establishing a protected environment within a device.

14. The system of establishing a protected environment within a computing device of claim 10, further comprising a means of ensuring that the secure operating environment activates the system of establishing a protected environment within a device.

15. The system of establishing a protected environment within a device of claim 10, wherein the means for validating a secure operating environment provides an indication of the security state of the secure operating environment.

16. The system of establishing a protected environment within a device of claim 10, wherein the means for establishing a protected environment is obfuscated.

17. The system of establishing a protected environment within a device of claim 10, wherein the means for establishing a protected environment is individualized.

18. The system of establishing a protected environment within a device of claim 10, wherein the means for establishing a protected environment includes identification information.

19. A system for providing a protected computing environment comprising:

a protected environment management component;

identification information for the protected environment management component; and

individualization information for the protected environment management component.

20. The system for providing a protected computing environment of claim 19, in which the protected environment management component is bound to a specific device.