Method and system for establishing a trust framework based on smart key devices

• US 20050154875A1
• Filed: 01/08/2004
• Published: 07/14/2005
• Est. Priority Date: 01/08/2004
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Chao, Ching-Yun
• Granted Patent: US 7,711,951 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect

Abstract

A mechanism is provided for securing cryptographic functionality within a host system such that it may only be used when a system administrator physically allows it via a hardware security token. In addition, a hardware security unit is integrated into a data processing system, and the hardware security unit acts as a hardware certificate authority. The hardware security unit may be viewed as supporting a trust hierarchy or trust framework within a distributed data processing system. The hardware security unit can sign software that is installed on the machine that contains the hardware security unit. Server processes that use the signed software that is run on the machine can establish mutual trust relationships with the hardware security unit and amongst the other server processes based on their common trust of the hardware security unit.

Claims

1. A data processing system comprising:

a system unit including;

a processor for executing instructions in software modules; and

a first hardware security unit including;

means for storing a private key of a first asymmetric cryptographic key pair and a public key of a second asymmetric cryptographic key pair;

means for authenticating a software module; and

means for acting as a certificate authority to issue digital certificates to software modules; and

a first software module executable on the system unit including;

means for storing a private key of the second asymmetric cryptographic key pair and a public key of the first asymmetric cryptographic key pair; and

means for authenticating the hardware security unit.

2. The data processing system of claim 1 wherein the hardware security unit further comprises:

means for receiving a digital certificate corresponding to a private key possessed by a second hardware security unit that is not included in the system unit; and

means for storing the received digital certificate.

3. The data processing system of claim 1 further comprising:

a removable hardware device including;

means for storing a private key of a third asymmetric cryptographic key pair and a public key of the first asymmetric cryptographic key pair;

a first hardware interface for electrically engaging the system unit; and

means for authenticating the hardware security unit; and

the system unit further including;

a second hardware interface for electrically engaging a removable hardware device.

4. The data processing system of claim 3 wherein the hardware security unit further comprises:

means for enabling the hardware security unit to act as a certificate authority to issue digital certificates to software modules based on whether the removable hardware device remains electrically engaged with the system unit after the removable hardware device and the hardware security unit have been mutually authenticated.

5. The data processing system of claim 1 wherein the first software module further comprises:

means for authenticating a second software module that is executing in the data processing system.

6. The data processing system of claim 5 further comprising:

means for receiving a digital certificate for the second software module; and

means for verifying the received digital certificate as having been issued by the hardware security unit.

7. The data processing system of claim 5 further comprising:

means for receiving a digital certificate for the second software module;

means for retrieving a set of digital certificates from the hardware security unit; and

means for verifying the digital certificate for the second software module based on a certificate in the set of digital certificates from the hardware security unit.

8. The data processing system of claim 1 further comprising:

means for requiring a software module executable on the system unit to have been signed by the first hardware security unit before executing the software module.

9. The data processing system of claim 1 further comprising:

means for requiring all software modules executable on the system unit to have been signed by the first hardware security unit before execution.

10. The data processing system of claim 1 further comprising:

means for requiring all software modules executable on the system unit to be able to authenticate to the first hardware security unit before execution.

11. The data processing system of claim 1 further comprising:

a software smart key module that is signed by the first hardware security unit, wherein the first hardware security unit includes means for acting as a certificate authority.

12. The data processing system of claim 11 further comprising:

means for requiring software modules executable on the system unit to have been signed either by the software smart key module or by the first hardware security unit before execution.

13. The data processing system of claim 11 further comprising:

means for requiring all software modules executable on the system unit to be able to authenticate either to the software smart key module or to the first hardware security unit before execution.

14. The data processing system of claim 11 further comprising:

means for secondary software certificate authority modules to derive trust authority from the first hardware security unit in an inverted pyramid form of a trust hierarchy.

15. The data processing system of claim 11 further comprising:

means for allowing software certificate authority modules to sign subordinate software certificate authority modules.

16. The data processing system of claim 1 further comprising:

means for requiring all interacting software applications that are installed on the system unit to be able to mutually authenticate to one another.

17. The data processing system of claim 16 further comprising:

means for allowing interacting software applications to verify each other as signed by a trusted software certificate authority or by the first hardware security unit.

18. The data processing system of claim 1 further comprising:

means for asserting a digital certificate of a hardware security unit on a different system unit into a list of trusted certificate authorities in the first hardware security unit.

19. The data processing system of claim 1 further comprising:

means for asserting a digital certificate of a software certificate authority trusted on a different data processing system into a list of trusted certificate authorities in the first hardware security unit.

20. A method for performing cryptographic functions in a data processing system, the method comprising:

executing a software module on a system unit including a hardware security unit, wherein the hardware security unit contains a private key of a first asymmetric cryptographic key pair and a public key of a second asymmetric cryptographic key pair;

performing a mutual authentication operation between the hardware security unit and the software module, wherein the software module contains a private key of the second asymmetric cryptographic key pair and a public key of the first asymmetric cryptographic key pair; and

issuing digital certificates by the hardware security unit to software modules.

21. The method of claim 20 further comprising:

receiving at the hardware security unit a digital certificate corresponding to a private key possessed by a second hardware security unit that is not included in the system unit; and

storing the received digital certificate.

22. The method of claim 21 further comprising:

receiving a request from the software module to retrieve the received digital certificate; and

providing the received digital certificate to the software module.

23. The method of claim 20 further comprising:

electrically engaging a removable hardware device with the system unit, wherein the removable hardware device contains a private key of a third asymmetric cryptographic key pair and a public key of a fourth asymmetric cryptographic key pair, and wherein the hardware security unit contains a private key of the fourth asymmetric cryptographic key pair and a public key of the third asymmetric cryptographic key pair;

performing a mutual authentication operation between the removable hardware device and the hardware security unit.

24. The method of claim 23 further comprising:

in response to successfully performing the mutual authentication operation between the removable hardware device and the hardware security unit, enabling the hardware security unit to act as a certificate authority to issue digital certificates while the removable hardware device remains electrically engaged with the system unit.

25. The method of claim 23 further comprising:

in response to successfully performing the mutual authentication operation between the removable hardware device and the hardware security unit, enabling the hardware security unit to receive and store at the hardware security unit a digital certificate corresponding to a private key possessed by a second hardware security unit that is not included in the system unit.

26. The method of claim 20 further comprising:

authenticating, by the software module, a second software module that is executing in the data processing system.

27. The method of claim 26 further comprising:

receiving a digital certificate for the second software module; and

verifying the received digital certificate as having been issued by the hardware security unit.

28. The method of claim 26 further comprising:

receiving a digital certificate for the second software module;

retrieving a set of digital certificates from the hardware security unit; and

verifying the digital certificate for the second software module based on a certificate in the set of digital certificates from the hardware security unit.

29. The method of claim 20 further comprising:

requiring a software module executable on the system unit to have been signed by the hardware security unit before executing the software module.

30. The method of claim 20 further comprising:

requiring all software modules executable on the system unit to have been signed by the hardware security unit before execution.

31. The method of claim 20 further comprising:

requiring all software modules executable on the system unit to be able to authenticate to the hardware security unit before execution.

32. The method of claim 20 further comprising:

signing a software smart key module by the hardware security unit, wherein the hardware security unit includes means for acting as a certificate authority.

33. The method of claim 32 further comprising:

requiring software modules executable on the system unit to have been signed either by the software smart key module or by the hardware security unit before execution.

34. The method of claim 32 further comprising:

requiring all software modules executable on the system unit to be able to authenticate either to the software smart key module or to the hardware security unit before execution.

35. The method of claim 32 further comprising:

allowing secondary software certificate authority modules to derive trust authority from the hardware security unit in an inverted pyramid form of a trust hierarchy.

36. The method of claim 32 further comprising:

allowing software certificate authority modules to sign subordinate software certificate authority modules.

37. The method of claim 20 further comprising:

requiring all interacting software applications that are installed on the system unit to be able to mutually authenticate to one another.

38. The method of claim 37 further comprising:

allowing interacting software applications to verify each other as signed by a trusted software certificate authority or by the hardware security unit.

39. The method of claim 20 further comprising:

asserting a digital certificate of a hardware security unit on a different system unit into a list of trusted certificate authorities in the hardware security unit.

40. The method of claim 20 further comprising:

asserting a digital certificate of a software certificate authority trusted on a different data processing system into a list of trusted certificate authorities in the hardware security unit.

41. A computer program product on a computer readable medium for use in a data processing system for performing cryptographic functions, the computer program product comprising:

means for executing a software module on a system unit including a hardware security unit, wherein the hardware security unit contains a private key of a first asymmetric cryptographic key pair and a public key of a second asymmetric cryptographic key pair;

means for performing a mutual authentication operation between the hardware security unit and the software module, wherein the software module contains a private key of the second asymmetric cryptographic key pair and a public key of the first asymmetric cryptographic key pair; and

means for issuing digital certificates by the hardware security unit to software modules.

42. The computer program product of claim 41 further comprising:

means for receiving at the hardware security unit a digital certificate corresponding to a private key possessed by a second hardware security unit that is not included in the system unit; and

means for storing the received digital certificate.

43. The computer program product of claim 42 further comprising:

means for receiving a request from the software module to retrieve the received digital certificate; and

means for providing the received digital certificate to the software module.

44. The computer program product of claim 41 further comprising:

means for electrically engaging a removable hardware device with the system unit, wherein the removable hardware device contains a private key of a third asymmetric cryptographic key pair and a public key of a fourth asymmetric cryptographic key pair, and wherein the hardware security unit contains a private key of the fourth asymmetric cryptographic key pair and a public key of the third asymmetric cryptographic key pair;

means for performing a mutual authentication operation between the removable hardware device and the hardware security unit.

45. The computer program product of claim 44 further comprising:

means for enabling, in response to successfully performing the mutual authentication operation between the removable hardware device and the hardware security unit, the hardware security unit to act as a certificate authority to issue digital certificates while the removable hardware device remains electrically engaged with the system unit.

46. The computer program product of claim 44 further comprising:

means for enabling, in response to successfully performing the mutual authentication operation between the removable hardware device and the hardware security unit, the hardware security unit to receive and store at the hardware security unit a digital certificate corresponding to a private key possessed by a second hardware security unit that is not included in the system unit.

47. The computer program product of claim 41 further comprising:

means for authenticating, by the software module, a second software module that is executing in the data processing system.

48. The computer program product of claim 47 further comprising:

means for receiving a digital certificate for the second software module; and

means for verifying the received digital certificate as having been issued by the hardware security unit.

49. The computer program product of claim 47 further comprising:

means for receiving a digital certificate for the second software module;

means for retrieving a set of digital certificates from the hardware security unit; and

means for verifying the digital certificate for the second software module based on a certificate in the set of digital certificates from the hardware security unit.

50. The computer program product of claim 41 further comprising:

means for requiring a software module executable on the system unit to have been signed by the hardware security unit before executing the software module.

51. The computer program product of claim 41 further comprising:

means for requiring all software modules executable on the system unit to have been signed by the hardware security unit before execution.

52. The computer program product of claim 41 further comprising:

means for requiring all software modules executable on the system unit to be able to authenticate to the hardware security unit before execution.

53. The computer program product of claim 41 further comprising:

means for signing a software smart key module by the hardware security unit, wherein the hardware security unit includes means for acting as a certificate authority.

54. The computer program product of claim 53 further comprising:

means for requiring software modules executable on the system unit to have been signed either by the software smart key module or by the hardware security unit before execution.

55. The computer program product of claim 53 further comprising:

means for requiring all software modules executable on the system unit to be able to authenticate either to the software smart key module or to the hardware security unit before execution.

56. The computer program product of claim 53 further comprising:

means for allowing secondary software certificate authority modules to derive trust authority from the hardware security unit in an inverted pyramid form of a trust hierarchy.

57. The computer program product of claim 53 further comprising:

means for allowing software certificate authority modules to sign subordinate software certificate authority modules.

58. The computer program product of claim 41 further comprising:

means for requiring all interacting software applications that are installed on the system unit to be able to mutually authenticate to one another.

59. The computer program product of claim 58 further comprising:

means for allowing interacting software applications to verify each other as signed by a trusted software certificate authority or by the hardware security unit.

60. The computer program product of claim 41 further comprising:

means for asserting a digital certificate of a hardware security unit on a different system unit into a list of trusted certificate authorities in the hardware security unit.

61. The computer program product of claim 41 further comprising:

means for asserting a digital certificate of a software certificate authority trusted on a different data processing system into a list of trusted certificate authorities in the hardware security unit.