Method and system for secure external TPM password generation and use

Abstract

Aspects of the present invention include a method and system for generating a secure access code at a remote device in communication with a computer system having a secure storage device; conveying the secure access code to the system secure storage device; receiving the secure access code at the system secure storage device with unique data characteristics associated with remote device; and, securely providing content to the remote device.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts a typical computer architecture of a data processing system.

FIG. 2 represents a typical reference architecture for a data processing system, in a different configuration than that of FIG. 1, with Trusted Building Block components of a trusted platform architecture, in which the present invention may be implemented.

FIG. 3 depicts the building blocks for a TPM, such as that of FIG. 2, supporting root of trust for storage (RTS) functionality.

FIG. 4 depicts a TPM-based system that includes biometric capability, in accordance with a preferred embodiment of the present invention.

FIG. 5 depicts a particular preferred arrangement process of generating and utilizing a commons shared secret of the present invention.

Claims

1. A method comprising: generating a secure access code at a remote device in communication with a secure storage device;conveying the secure access code to the system secure storage device; andreceiving the secure access code at the system secure storage device with unique data characteristics associated with a remote device.

2. The method of claim 1, wherein the secure storage device comprises a trusted platform module (TPM).

3. The method of claim 1 wherein the secure access code is not known by a user.

4. The method of claim 1, wherein the secure access code is a high entropy password, keycode, random number, or alphanumeric complex.

5. The method of claim 1, wherein the secure access code is provided from a separate device.

6. The method of claim 5, wherein the separate device comprises any of a biometric processor, smart card, flash disk or similar plug-in device.

7. The method of claim 1, wherein the secure storage device is resident and in interoperable communication with a central processing unit of the system wherein the device contains a random authorization secret (RAS).

8. The method of claim 7, wherein the RAS is attached to a public key on the secure storage device.

9. The method of claim 1, further comprising initiating an object-specific authorization protocol (OSAP)session on the secure storage device.

10. The method of claim 9, further comprising saving at least one OSAP nonce.

11. The method of claim 10, further comprising generating a second template at the remote device in response to unique data characteristics received at the remote device.

12. The method of claim 11, further comprising the remote device generating a random secret and transmitting the secret to the secure storage device of the system.

13. The method of claim 12, wherein the secret is securely stored or transmitted in association with the second template.

14. The method of claim 13, further comprising the system transmitting the shared secret from a remote device to the secure storage device.

15. The method of claim 14, wherein the secure storage device authenticates the unique data characteristics with an identifying template of the system associated with the unique data characteristics and transmits secure content to remote device.

16. The method of claim 15, wherein the remote device is capable of receiving real-time input.

17. The method of claim 15, wherein the remote device is capable of reading biometric data.

18. The method of claim 17, wherein the biometric data is one of fingerprint data, iris data, retinal data, temperature data, facial data, vein patterns or similar other biometric-based data.

19. The method of claim 17, wherein the secure storage device is a companion chip situated interoperably with the central processing unit of the system.

20. The method of claim 19, wherein the secure generation and storage on a third device provides an increased level of protection against unapproved snooping of the secure access code.

21. The method of claim 20, wherein the creation of secure access code includes TPM-CreateWrapKey, TPM_Seal and commands that create secure entities for later use.

22. The method of claim 21, wherein the authorization of the secure access code includes TPM-Unseal, TPM-Sign, TPM-Unbind, TPM-LoadKey and many other TPM commands that require the authorization for entity usage.

23. The method of claim 22, wherein the authorization protocol is provided by the TPM commands include those that require owner operation authorization.

24. The method of claim 23, wherein the authorization values can be changed by TPM_ChangeAuth that change authorization values.