Computing Entities, Platforms And Methods Operable To Perform Operations Selectively Using Different Cryptographic Algorithms

• US 20160042186A1
• Filed: 03/06/2015
• Published: 02/11/2016
• Est. Priority Date: 11/30/2009
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Ali, Valiuddin Y., Proudler, Graeme John
• Granted Patent: US 9,710,658 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 2209/127 Trusted platform modules [TPM]
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Described herein is a computing platform incorporating a trusted entity, which is controllable to perform cryptographic operations using selected ones of a plurality of cryptographic algorithms and associated parameters, the entity being programmed to record mode of operation information, which is characterised by the algorithms and associated parameters that are selected to perform an operation.

Claims

1. A computing platform incorporating a trusted entity, which is controllable to perform cryptographic operations using selected ones of a plurality of cryptographic algorithms and associated parameters, the entity being programmed to record mode of operation information, which is characterised by the algorithms and associated parameters that are selected to perform an operation.

2. A computing platform according to claim 1, wherein the mode of operation information comprises an indicator, the value of which the trusted entity is programmed to modify each time a mode of operation of the entity changes as a result of a change in selected algorithms and associated parameters.

3. A computing platform according to claim 1, wherein the mode of operation information comprises an indicator, the value of which the trusted entity is programmed to modify each time the mode of operation changes from a trusted mode to a non-trusted mode.

4. A computing platform according to claim 1, wherein the mode of operation information comprises an indicator, the value of which the trusted entity is programmed to modify to indicate whether the mode of operation of the entity is a trusted mode of operation.

5. A computing platform according to claim 1, comprising a mode list listing a plurality of modes, at least one of which is characterised by one or more cryptographic algorithms and respective parameters.

6. A computing platform according to claim 5, wherein the mode of operation of the trusted entity is determined at least in part by which cryptographic algorithms and respective parameters are selected, and by which mode the cryptographic algorithms and respective parameters are listed against.

7. A computing platform according to claim 1, wherein the trusted entity is programmed to store data resulting from the cryptographic operation sealed against mode of operation information representing a compatible mode of operation under which the data can be revealed and/or used.

8. A computing platform according to claim 7, wherein the trusted entity is programmed to release and/or use the stored data only if the mode of operation, determined by the mode of operation information, is compatible with the mode of operation information that was sealed against the stored data.

9. A computing platform according to claim 8, wherein the mode of operation is compatible if the mode of operation of the trusted entity:

a. is a trusted mode of operation;

b. has not changed since the data was stored; and

/or

c. has not been un-trusted in a current boot cycle of the platform.

10. A computing platform according to claim 1, comprising a reporting function, which is programmed to report requested mode of operation information to a user of the platform.

11. A computing platform according to claim 1, wherein the trusted entity is programmed to permit locking by an authenticated party of the trusted entity into only trusted modes of operation.

12. A computing platform according to claim 1, wherein the trusted entity comprises a trusted hardware component.

13. A computing platform according to claim 12, wherein the mode of operation information is stored on the trusted hardware component.

14. A hardware trusted component arranged to store a plurality of cryptographic algorithms and associated parameters and being programmed to record mode of operation information, which is characterised by the algorithms and associated parameters that are selected to perform an operation.

15. A hardware trusted component according to claim 14, arranged to store a mode list listing a plurality of modes, at least one of which is characterised by one or more cryptographic algorithms and respective parameters.

16. A computer program product comprising instructions recorded thereon to perform cryptographic operations using selected ones of a plurality of cryptographic algorithms and associated parameters and to record mode of operation information, which is characterised by the algorithms and associated parameters that are selected to perform an operation.

17. A method of operating a computing platform incorporating a trusted entity, which is controllable to perform cryptographic operations using selected ones of a plurality of cryptographic algorithms and associated parameters, including the step of recording mode of operation information, which is characterised by the algorithms and associated parameters that are selected to perform an operation.