Method and apparatus for binding TPM keys to execution entities

• US 8,458,480 B2
• Filed: 01/28/2011
• Issued: 06/04/2013
• Est. Priority Date: 06/30/2005
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Iliev, Alexander, Scarlata, Vincent R., Rozas, Carlos V.
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US13/016,145
• Publication Number:
  US 20110191574A1
• Time in Patent Office: 858 Days
• Field of Search: None
• US Class Current: 713/176
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A method and apparatus for binding trusted platform module (TPM) keys to execution entities are described. In one embodiment, the method includes the receipt of an authorization request issued by an execution entity for authorization data. According to the authorization request, the execution entity may be measured to generate an entity digest value. Once the entity digest value is generated, a platform reference module may grant the authorization request if the entity digest value verifies that the execution entity is an owner of the key held by the TPM. Accordingly, in one embodiment, a platform reference module, rather than an execution entity, holds the authorization data required by a TPM to use a key owned by the execution entity and held within sealed storage by the TPM. Other embodiments are described and claimed.

Claims

1. A method comprising:

measuring an execution entity to generate a digest value, according to an authorization request issued by the execution entity for authorization data, wherein the digest value is for a trusted hardware entity to use a key protected within the trusted entity; and

granting the authorization request if it is verified via the digest value that the execution entity is an owner of the key,

wherein granting the authorization request is to ensure that the execution entity has exclusive access to the key.

2. The method of claim 1, wherein granting the authorization request further comprises:

transmitting the authorization data to the execution entity.

3. The method of claim 1, wherein granting the authorization request further comprises:

applying the authorization data to each command issued by the execution entity to the trusted hardware entity for use of the key to prohibit disclosure of the authorization data to the execution entity.

4. The method of claim 3, wherein applying the authorization data further comprises:

receiving command parameters from the execution entity;

applying the authorization data to the received command parameters to generate a command digest value;

transmitting the command digest value to the execution entity; and

issuing, by the execution entity, the command digest value to the trusted hardware entity for use of the key.

5. The method of claim 1, wherein granting comprises:

comparing the digest value of execution entity with a digest value of the owner of the key; and

verifying the execution entity as the owner of the key if the digest value of the execution entity matches the digest value of the owner of the key.

6. The method of claim 1, wherein the trusted hardware entity does not store all keys simultaneously.

7. The method of claim 1, wherein trusted hardware entity is a trusted platform module (TPM).

8. The method of claim 1, wherein measuring the execution entity to generate the digest value comprises computing a hash of a binary executable of the execution entity to generate the digest value.

9. An article of manufacture comprising a non-transitory machine-accessible storage medium having associated instructions that, when accessed, results in a machine performing a method comprising:

measuring an execution entity to generate a digest value, according to an authorization request issued by the execution entity for authorization data, wherein the digest value is for a trusted entity to use a key protected within the trusted entity; and

granting the authorization request if it is verified via the digest value that the execution entity is an owner of the key, wherein granting the authorization request is to ensure that the execution entity has exclusive access to the key.

10. The article of manufacture of claim 9, wherein granting the authorization request further results in the machine performing a method comprising:

transmitting the authorization data to the execution entity.

11. The article of manufacture of claim 9, wherein granting the authorization request further results in the machine performing a method comprising:

applying the authorization data to each command issued by the execution entity to the trusted entity for use of the key to prohibit disclosure of the authorization data to the execution entity.

12. The article of manufacture of claim 11, wherein applying the authorization data further results in the machine performing a method comprising:

receiving command parameters from the execution entity;

applying the authorization data to the received command parameters to generate a command digest value;

transmitting the command digest value to the execution entity; and

issuing, by the execution entity, the command digest value to the trusted entity for use of the key.

13. The article of manufacture of claim 9, wherein applying the authorization data further results in the machine performing a method comprising:

receiving command parameters from the execution entity;

applying the authorization data to the received command parameters to generate a command digest value;

transmitting the command digest value to the execution entity; and

issuing, by the execution entity, the command digest value to the trusted hardware entity for use of the key.

14. The article of manufacture of claim 9, wherein granting further results in the machine performing a method comprising:

comparing the digest value of execution entity with a digest value of the owner of the key; and

verifying the execution entity as the owner of the key if the digest value of the execution entity matches the digest value of the owner of the key.

15. The article of manufacture of claim 9, wherein the trusted hardware entity does not store all keys simultaneously.

16. The article of manufacture of claim 9, wherein measuring the execution entity to generate the digest value further results in the machine performing a method comprising computing a hash of a binary executable of the execution entity to generate the digest value.

17. A method comprising:

generating authorization data for a requested key according to a key generation request issued by an execution entity;

measuring the execution entity to generate an ownership digest value;

issuing a key creation command to a trusted entity including the authorization data, wherein the trusted entity is to require the authorization data for use of the requested key; and

providing a key credential to the execution entity to enable the execution entity to verify that the authorization data required by the trusted entity for use of the requested key is held by a platform reference module, wherein the execution entity to have exclusive access to the requested key.

18. The method of claim 17, wherein providing the key credential to the execution entity further comprises:

generating the key credential to include a digest of the platform reference module, a digest of trusted computing blocks of the platform reference module, and an authorization disclosure mechanism; and

signing the key credential with a certification key owned by the platform reference module.

19. The method of claim 17 further comprises:

storing the ownership digest value in combination with the authorization data within a key table held within sealed storage by the trusted entity,

wherein generating the authorization data for the requested is performed by the platform reference module.

20. The method of claim 17 further comprises:

receiving an authorization request issued by the execution entity for the authorization data required by the trusted entity to use the key held within sealed storage by the trusted entity;

measuring the execution entity to generate an entity digest value; and

granting the authorization request if is verified via the entity digest value that the execution entity is an owner of the key.

21. The method of claim 20, wherein granting the authorization request further comprises:

comparing the entity digest value with an owner digest value of an owner of the key; and

verifying the execution entity as the owner of the key if the entity digest value matches the owner digest value of the owner of the key.

22. The method of claim 17 further comprises:

restricting use of at least one parent key owned by the trusted entity until a trusted platform bootup state is detected; and

loading, for the trusted entity, one or more child keys of the parent key if platform metrics indicate detection of the trusted platform bootup state.

23. The method of claim 22, wherein restricting the use of the at least one parent key further comprises:

binding usage of the at least one parent key owned by the trusted entity to the trusted platform bootup state.

24. The method of claim 22, wherein loading the one or more child keys further comprises:

loading, by a parent certification key owned by the trusted platform service, a child certification key of the trusted entity; and

generating a credential for the child certification key by at least the parent certification key.

25. The method of claim 22, wherein loading the one or more child keys further comprises:

loading, by a parent storage key owned by the trusted entity, a data storage key of the trusted entity; and

unsealing, by the data storage key, a data table owned by the trusted entity.

26. The method of claim 22, wherein loading the one or more child keys further comprises:

loading a parent storage key and a signature key of the trusted entity;

loading, by the storage key, at least one child key of the trusted; and

certifying the at least one child key using the signature key.

27. A platform comprising:

a trusted entity including a processor and a non-volatile memory to provide storage of a key;

a trusted measurement agent to measure an execution entity to generate a digest value according to an authorization request issued by the execution entity for authorization data, wherein the digest value is for the trusted entity to use a key held within the non-volatile memory of the trusted entity; and

a platform reference module to grant an authorization request issued by the execution entity if it is verified via the digest value from the trusted measurement agent that the execution entity is an owner of the key, wherein granting the authorization request is to ensure that the execution entity has exclusive access to the key.

28. The platform of claim 27, wherein the trusted entity is operable to provide storage of a parent key owned by the platform reference module, wherein the trusted entity is operable to restrict use of the parent key to a trusted platform bootup state to provide the platform reference module exclusive access to load one or more child keys of the parent key during the trusted platform bootup state.

29. The platform of claim 27, wherein the platform reference module is operable to:

generate authorization data for a requested key according to a key generation request issued by the execution entity;

store a measurement of the execution entity as an owner digest value;

issue a key creation command for the requested key to the trusted entity including the authorization data, wherein the authorization data is required by the trusted entity for use of the requested key; and

provide a key credential to the execution entity to enable the execution entity to verify that the authorization data required by the trusted entity for use of the requested key is held by the platform reference module.

30. The platform of claim 27, further comprising:

a chipset coupled to the trusted entity;

a processor coupled to the chipset; and

a non-volatile memory coupled to the chipset, the non-volatile memory including;

a platform initialization module to bootstrap the platform to a trusted platform bootup state required by the trusted entity for use of a parent key owned by the platform reference module and held in a storage by the trusted entity to restrict the platform reference module to exclusive access to load one or more child keys of the parent key during the trusted platform bootup state.

31. The platform of claim 27, wherein the trusted entity further comprises:

a platform configuration register (PCR) to bind use of the parent key to the trusted platform bootup state according to one or more PCR BOOTENV values and a PCR POST_BOOT value,

wherein the platform initialization module to modify a platform POST_BOOT value to disable use of the parent key once platform bootup progresses beyond the trusted platform bootup state.