Systems and methods using cryptography to protect secure computing environments
DCFirst Claim
1. A method utilizing a system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the processor to perform the method, the method comprising:
- receiving a load module and an associated specification;
verifying that the load module performs as specified by the specification;
determining that the load module does not include harmful functionality;
conditionally digitally signing the load module based at least in part on results of the verifying and determining steps; and
distributing, to a remote protected processing environment, a digital signature generated by the step of digitally signing the load module, the remote protected processing environment being operable to perform an authentication step on the digital signature using a public key, and to conditionally execute the load module based at least in part on a result of the authentication step,wherein the remote protected processing environment is resistant to tampering by an owner of an electronic appliance upon which the remote protected processing environment is running and is operable to maintain the public key as a secret from the owner of the electronic appliance.
2 Assignments
Litigations
0 Petitions
Accused Products
Abstract
Secure computation environments are protected from bogus or rogue load modules, executables and other data elements through use of digital signatures, seals and certificates issued by a verifying authority. A verifying authority—which may be a trusted independent third party—tests the load modules or other executables to verify that their corresponding specifications are accurate and complete, and then digitally signs the load module or other executable based on tamper resistance work factor classification. Secure computation environments with different tamper resistance work factors use different verification digital signature authentication techniques (e.g., different signature algorithms and/or signature verification keys)—allowing one tamper resistance work factor environment to protect itself against load modules from another, different tamper resistance work factor environment. Several dissimilar digital signature algorithms may be used to reduce vulnerability from algorithm compromise, and subsets of multiple digital signatures may be used to reduce the scope of any specific compromise.
41 Citations
11 Claims
-
1. A method utilizing a system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the processor to perform the method, the method comprising:
-
receiving a load module and an associated specification; verifying that the load module performs as specified by the specification; determining that the load module does not include harmful functionality; conditionally digitally signing the load module based at least in part on results of the verifying and determining steps; and distributing, to a remote protected processing environment, a digital signature generated by the step of digitally signing the load module, the remote protected processing environment being operable to perform an authentication step on the digital signature using a public key, and to conditionally execute the load module based at least in part on a result of the authentication step, wherein the remote protected processing environment is resistant to tampering by an owner of an electronic appliance upon which the remote protected processing environment is running and is operable to maintain the public key as a secret from the owner of the electronic appliance. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A non-transitory computer-readable medium comprising program code, the program code being operable, when executed by a computer system, to cause the computer system to perform steps comprising:
-
verifying that a load module performs as specified by a specification associated with the load module; determining that the load module does not include harmful functionality; and conditionally digitally signing the load module based at least in part on results of the verifying and determining steps distributing, to a remote protected processing environment, a digital signature generated by the step of digitally singing the load module; and securely distributing a cryptographic key to the remote protected processing environment, the cryptographic key being configured for use in authenticating the digital signature. - View Dependent Claims (9)
-
-
10. A system comprising a processor and a non-transitory computer-readable medium encoded with program instructions that, when executed by the processor,
cause the processor to perform a method comprising: -
receiving a load module and an associated specification; verifying that the load module performs as specified by the specification; determining that the load module does not include harmful functionality; and conditionally digitally signing the load module based at least in part on a result of the verifying and determining steps; distributing, to a remote protected processing environment, a digital signature generated by the digital signing step; and securely distributing a cryptographic key to the remote protected processing environment, the cryptographic key being configured for use in authenticating the digital signature. - View Dependent Claims (11)
-
Specification