Method and apparatus for using a secret in a distributed computing system

• US 20030046542A1
• Filed: 09/04/2001
• Published: 03/06/2003
• Est. Priority Date: 09/04/2001
• Status: Active Grant

• Current Assignee: Lionra Technologies Limited (Atlantic IP Services Limited)
• Original Assignee: Hewlett-Packard Company (HP Inc.)
• Inventors: Proudler, Graeme John, Chen, Liqun
• Granted Patent: US 7,779,267 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

There are many times when a secret needs to be used in a distributed computing system—these are often held in security tokens, such as smart cards. It may be desirable for another device, such as a computer platform to act in place of the security token as the repository of a secret, particularly for operations within a distributed computing system. Within the distributed computing system there is located a trusted entity, physically and logically resistant to unauthorized modification—this may be a trusted device located within a specific computing platform. This contains validation information which can be communicated to the security token. The security token then carries out a validation process on this validation information—if successful, the security token then provides a secret to the trusted device for use within the distributed computing system. The trusted device may be required to use this secret only for a specified period of time, or for a specific purpose or task.

Claims

1. Computing system comprising:

a token reader;

a trusted device which is physically and logically protected from unauthorised modification, the trusted device having therein a device memory, and a device interface adapted for communication with the token reader; and

a security token having therein a token processor and a token memory;

wherein validation information is stored in the device memory and a secret is stored in the token memory, and whereby on provision of validation information from the device memory to the token memory, and satisfactory completion of a validation process by the token processor, the security token is adapted to provide the secret to the device memory.

2. Computing system as claimed in claim 1, wherein on receipt of the secret the trusted device is adapted to act as a proxy for the security token.

3. Computing system as claimed in claim 1, wherein the trusted device is permitted to use the secret only within specified use parameters.

4. Computing system as claimed in claim 3, wherein said specified use parameters comprise a specified time.

5. Computing system as claimed in claim 3, wherein said specified use parameters comprise a specified purpose.

6. Computing system as claimed in claim 3, wherein said specified use parameters are specified by the security token.

7. Computing system as claimed in claim 3, wherein the trusted device is adapted to delete the secret once the specified use parameters can no longer be achieved.

8. Computing system as claimed in claim 1, wherein the validation information comprises an identity of the trusted device, and wherein the validation process comprises authentication of the identity.

9. Computing system as claimed in claim 1, wherein the trusted device comprises a device processor.

10. Computing system as claimed in claim 9, wherein the computing apparatus comprises a computing environment having a main processor and a main memory, both adapted to communicate with the trusted device, and wherein the device processor runs a process to obtain an integrity metric of the computing environment, the validation information comprising the integrity metric.

11. Computing system as claimed in claim 1, wherein the security token has a private key.

12. Computing system as claimed in claim 11, wherein the secret is the private key.

13. Computing system as claimed in claim 11, wherein the security token is adapted to generate a session key pair and and a certificate certifying the session key pair with the private key, and wherein the secret is the session key pair.

14. Computing system as cloned in claim 13, wherein the certificate indicates use parameters for which the session key pair is valid.

15. Computing system as claimed in claim 2, wherein the trusted device is adapted to act as a proxy for a plurality of security tokens.

16. Computing system as claimed in claim 1, further comprising a trusted communication charnel between the trusted device and the security token.

17. Computing system as claimed in claim 16, wherein said trusted communication channel is an isolated hardware path.

18. Computing system as claimed in claim 16, wherein said trusted communication channel is achieved by encryption of communications.

19. Computing system as claimed in claim 1, wherein the security token is a smart card, and the token reader is a smart card reader.

20. Computing system as claimed in claim 1, wherein the computing apparatus is a computing platform having a main processor ad a main memory, wherein the trusted device is mounted on a common assembly with the main processor and the main memory and is adapted to communicate with both, and wherein the trusted device comprises a device processor.

29. A method as claimed in claim 2B, wherein said deletion occurs after elapse of a specified tine.

31. A method as claimed in claim 29, wherein said deletion occurs if a process involving use of the secret does not execute in an expected manner.

21. A method of using in a distributed computing system a secret stored on a security token, the method comprising:

the security token obtaining validation information from a trusted entity within the distributed computing system, the trusted entity being logically and physically protected from unauthorised modification;

the security token executing a validation process on the validation information, wherein if said validation process is successful;

the security token provides the secret to the trusted entity for use win the distributed computing system.

22. A method as claimed in claim 21, further comprising:

on receipt of the secret, the trusted entity acting as a proxy for the security token.

23. A method as claimed in claim 21, wherein the trusted entity is permitted by the security token to use the secret only within specified use parameters.

24. A method as claimed in claim 23, wherein the specified use parameters comprise a specified time.

25. A method as claimed in claim 23, wherein the specified use parameters comprise a specified purpose.

26. A method as claimed in claim 21, wherein the trusted entity is a trusted device physically and logically protected from unauthorised modification and the secret is provided to the trusted device memory.

27. A method as claimed in claim 21, wherein the trusted entity is a trusted process logically protected from unauthorised modification and located within hardware physically protected from unauthorised modification.

28. A method as claimed in claim 26, further comprising deletion of the secret from the trusted device memory.

30. A method as claimed in claim 28, wherein said deletion occurs after completion of a specified task.

32. A method as claimed in claim 21, wherein the validation information comprises an identity of the trusted entity, and the validation process comprises authentication of the identity.

33. A method as claimed in claim 21, wherein the validation information comprises a measurement of integrity of a competing environment within which the trusted entity is located.

34. A method as claimed in claim 21, wherein provision of the secret comprises generation of a session key pair and a certificate certifying the session key pair with a private key, and provision of the session key pair to the trusted entity as the secret.

35. A method as claimed in claim 34, wherein the certificate indicates a duration or a purpose for which the session key pair is valid.

36. A computing apparatus adapted for temporary use of a received secret, comprising:

a computing environment comprising a main processor and a main memory;

a trusted entity physically and logically protected from unauthorised modification, the trusted device being adapted to determine an integrity metric of the computing environment; and

a token reader in communication with the trusted entity;

wherein the trusted entity is adapted to communicate with a security token through the token reader, to provide the integrity metric to the security token, to receive a secret from the security token, and to use the secret as prescribed by the security token.

37. Computing apparatus as claimed in claim 36, wherein the token reader is a smart card reader.

38. Computing apparatus as claimed in claim 36, wherein the trusted entity is a trusted device physically and logically protected from unauthorised modification and the secret is provided to the trusted device memory.

39. Computing apparatus as claimed in claim 36, wherein the trusted entity is a trusted process logically protected from unauthorised modification and located within hardware physically protected from unauthorised modification.

40. Computing system comprising:

a first trusted entity which is physically and logically protected from unauthorised modification;

a second trusted entity which is physically and logically protected from unauthorised modification;

a communications channel between the first trusted entity and the second trusted entity;

wherein validation information is held by the first trusted entity and a secret is held by the second trusted entity, and whereby on provision of validation information from the first trusted entity to the second trusted entity, and satisfactory completion of a validation process by the second trusted entity, the second trusted entity is adapted to provide the secret to the first trusted entity.

41. A computing system as claimed in claim 40 wherein the first trusted entity is adapted to act as proxy for the first trusted entity.

42. A computing system as claimed in claim 40 wherein one or both of the first trusted entity and the second trusted entity is a trusted device physically and logically protected from unauthorised modification and the secret is provided to the trusted device memory.

43. A computing system as claimed in claim 40 wherein one or both of the first trusted entity and the second trusted entity is a trusted process logically protected from unauthorised modification and located within hardware physically protected from unauthorised modification.

44. A computing system as claimed in claim 40 wherein the second trusted entity is permitted to use the secret only in accordance with use parameters specified by the first trusted entity.

45. A computing system as claimed in claim 40 wherein said validation information comprises an identity of the first trusted entity.

46. A computing system as claimed in claim 40, wherein said secret comprises a private key of the second trusted entity.

47. A computing system as claimed in claim 40, wherein said secret comprises a session key pair generated from a private key of the second trusted entity.

48. A method of using a secret in a distributed computer system, the method comprising:

a first trusted entity within the distributed computing system providing validation information to a second trusted entity within the distributed computing system, each said trusted entity being logically and physically protected from unauthorised modification;

the second trusted entity executing a validation process on the validation information, wherein if sad validation process is successful;

the second trusted entity provides the secret to the first trusted entity for use within the distributed computing system.