利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

58 条记录 (耗时 0.027 秒)

    Transparent trust validation of an unknown platform
    41.
    发明授权
    Transparent trust validation of an unknown platform 有权
    对未知平台的透明信任验证

    公开(公告)号：US08127146B2

    公开(公告)日：2012-02-28

    申请号：US12241496

    申请日：2008-09-30

    申请人： Stefan Thom ,  Shon Eizenhoefer ,  Erik Holt ,  Yash Ashok Kumar Gandhi

    发明人： Stefan Thom ,  Shon Eizenhoefer ,  Erik Holt ,  Yash Ashok Kumar Gandhi

    IPC分类号： H04L9/00

    CPC分类号： G06F21/34 ,  G06F2221/2129

    摘要： A transparent trust validation of an unknown platform can be performed by communicationally coupling it to a trusted device, such as a portable peripheral device carried by a user, or one or more remote computing devices. Information from the unknown platform can be obtained by boot code copied to it from the trusted device and such information can be validated by the trusted device. The trusted device can then provide an encrypted version of decryption key to the boot code which can request the Trusted Platform Module (TPM) of the unknown platform to decrypt and return the decryption key. If the information originally obtained from the unknown platform and validated by the trusted device was authentic, the TPM will be able to provide the decryption key to the boot code, enabling it to decrypt an encrypted volume comprising applications, operating systems or other components.

    摘要翻译： 可以通过将其通信地耦合到诸如用户携带的便携式外围设备或一个或多个远程计算设备的可信设备来执行未知平台的透明信任验证。 来自未知平台的信息可以通过从可信设备复制到其中的引导代码获得，并且这样的信息可以由受信任的设备验证。 可信设备然后可以向引导代码提供解密密钥的加密版本，该引导代码可以请求未知平台的可信平台模块（TPM）来解密并返回解密密钥。 如果最初从未知平台获得并由可信设备验证的信息是真实的，则TPM将能够向引导代码提供解密密钥，使其能够解密包括应用，操作系统或其他组件的加密卷。

    HARDWARE SUPPORTED VIRTUALIZED CRYPTOGRAPHIC SERVICE
    42.
    发明申请
    HARDWARE SUPPORTED VIRTUALIZED CRYPTOGRAPHIC SERVICE 有权
    硬件支持的VIRTUALIZED CRYPTOGRAPHIC服务

    公开(公告)号：US20110246785A1

    公开(公告)日：2011-10-06

    申请号：US12750141

    申请日：2010-03-30

    申请人： David J. Linsley ,  Stefan Thom

    发明人： David J. Linsley ,  Stefan Thom

    IPC分类号： G06F21/00 ,  H04L9/00 ,  G06F12/14 ,  G06F9/455

    CPC分类号： G06F21/53 ,  G06F9/45558 ,  G06F21/57 ,  G06F21/602 ,  G06F21/72 ,  G06F2009/45587 ,  G06F2221/2149 ,  G06F2221/2153 ,  H04L63/061

    摘要： A Trusted Platform Module (TPM) can be utilized to provide hardware-based protection of cryptographic information utilized within a virtual computing environment. A virtualized cryptographic service can interface with the virtual environment and enumerate a set of keys that encryption mechanisms within the virtual environment can utilize to protect their keys. The keys provided by the virtualized cryptographic service can be further protected by the TPM-specific keys of the TPM on the computing device hosting the virtual environment. Access to the protected data within the virtual environment can, thereby, only be granted if the virtualized cryptographic service's keys have been protected by the TPM-specific keys of the TPM on the computing device that is currently hosting the virtual environment. The virtualized cryptographic service's keys can be protected by TPM-specific keys of TPMs on selected computing devices to enable the virtual environment to be hosted by other computing devices.

    摘要翻译： 可信平台模块（TPM）可用于为虚拟计算环境中使用的加密信息提供基于硬件的保护。 虚拟化加密服务可以与虚拟环境接口并枚举一组密钥，虚拟环境中的加密机制可以利用这些密钥来保护其密钥。 由虚拟化加密服务提供的密钥可以由托管虚拟环境的计算设备上的TPM专用密钥进一步保护。 因此，只有当虚拟化加密服务的密钥已被当前托管虚拟环境的计算设备上的TPM的TPM特定密钥保护时，才能访问虚拟环境中的受保护数据。 虚拟化加密服务的密钥可以由TPM在特定计算设备上的特定TPM密钥进行保护，以使虚拟环境由其他计算设备托管。

    TPM-BASED LICENSE ACTIVATION AND VALIDATION
    43.
    发明申请
    TPM-BASED LICENSE ACTIVATION AND VALIDATION 有权
    基于TPM的许可证激活和验证

    公开(公告)号：US20110167503A1

    公开(公告)日：2011-07-07

    申请号：US12652094

    申请日：2010-01-05

    申请人： Mikael Horal ,  Hakki Tunc Bostanci ,  Vandana Gunupudi ,  Ning Zhang ,  Scott Daniel Anderson ,  Stefan Thom ,  Erik Holt

    发明人： Mikael Horal ,  Hakki Tunc Bostanci ,  Vandana Gunupudi ,  Ning Zhang ,  Scott Daniel Anderson ,  Stefan Thom ,  Erik Holt

    IPC分类号： G06F21/22

    CPC分类号： G06F21/10 ,  G06F2221/0704

    摘要： A Trusted Activation License (TAL) can be comprised of a key unique to a Trusted Platform Module (TPM) and identifying information of the software applications bundled with the computing device having that TPM. To activate the software applications, the identifying information in the TAL can be compared against that of the software applications being activated, and the unique TPM key in the TAL can be compared against that of the TPM on the computing device on which the activation is taking place. Subsequent validations can be based on a protected association between the TAL and an Attestation Identity Key (AIK) that can be generated by the TPM as part of the activation step. Optionally, Platform Configuration Registers (PCRs) of the TPM can be periodically changed during validation to protect against useage of one TPM for validations on multiple computing devices.

    摘要翻译： 可信激活许可证（TAL）可以由可信平台模块（TPM）特有的密钥组成，并且识别与具有该TPM的计算设备捆绑的软件应用的信息。 为了激活软件应用程序，可以将TAL中的识别信息与正在激活的软件应用程序的识别信息进行比较，并将TAL中唯一的TPM密钥与激活正在进行的计算设备上的TPM密钥进行比较 地点。 随后的验证可以基于TAL和认证身份密钥（AIK）之间的保护关联，该密钥可以由TPM作为激活步骤的一部分生成。 可选地，可以在验证期间周期性地改变TPM的平台配置寄存器（PCR），以防止使用一个TPM来在多个计算设备上进行验证。

    SECURE STORAGE OF TEMPORARY SECRETS
    44.
    发明申请
    SECURE STORAGE OF TEMPORARY SECRETS 有权
    临时秘密的安全储存

    公开(公告)号：US20110087896A1

    公开(公告)日：2011-04-14

    申请号：US12577846

    申请日：2009-10-13

    申请人： Stefan Thom ,  Cristian Marius Ilac

    发明人： Stefan Thom ,  Cristian Marius Ilac

    IPC分类号： G06F12/14

    CPC分类号： G06F21/34 ,  G06F21/57 ,  G06F21/72 ,  G06F2221/2105 ,  G06F2221/2141 ,  G06F2221/2143

    摘要： Temporarily sensitive information can be stored in the non-volatile storage of a TPM, from which it can be securely, and irretrievably, deleted. Additionally, information stored in a TPM can secure information stored on communicationally disconnectable storage media such that, when communicationally disconnected, the information stored on such media is inaccessible. A whole volume encryption service key can be protected by a key stored in a TPM and, even if the protector remains accessible, the secure deletion of the key from the TPM prevents unauthorized disclosure of the whole volume encryption service key. Additionally, TPM stored data can be released only when a computing device is in a particular state, as determined by the PCRs. A hibernation image can be encrypted and the key stored with the TPM such that it is released to decrypt the image and restore active computing only if the state has not materially changed during hibernation.

    摘要翻译： 临时敏感信息可以存储在TPM的非易失性存储器中，从而可以安全地，不可避免地删除TPM。 此外，存储在TPM中的信息可以保护存储在可通信可断开的存储介质上的信息，使得当通信地断开时，存储在这样的介质上的信息是不可访问的。 可以通过存储在TPM中的密钥来保护整个卷加密服务密钥，并且即使保护器仍然可访问，TPM的密钥的安全删除防止未经授权的泄漏整个卷加密服务密钥。 另外，TPM存储的数据只有当计算设备处于特定状态时才被释放，如PCR所确定的。 休眠图像可以被加密，并且与TPM一起存储的密钥使得它被释放以解密图像，并且仅在休眠期间状态没有重大变化时恢复活动计算。

    Platform authentication via a transparent second factor
    46.
    发明申请
    Platform authentication via a transparent second factor 有权
    平台认证通过透明的第二个因素

    公开(公告)号：US20080148388A1

    公开(公告)日：2008-06-19

    申请号：US11586283

    申请日：2006-10-25

    申请人： David R. Wooten ,  Erik Holt ,  Stefan Thom ,  Tony Ureche ,  Dan Sledz ,  Douglas M. Maclver

    发明人： David R. Wooten ,  Erik Holt ,  Stefan Thom ,  Tony Ureche ,  Dan Sledz ,  Douglas M. Maclver

    IPC分类号： G06F21/00 ,  G06F12/14

    CPC分类号： G07F7/1008 ,  G06F21/34 ,  G06F21/575 ,  G06Q20/3415 ,  G06Q20/3563 ,  G06Q20/388 ,  G06Q20/40 ,  G06Q20/409

    摘要： Firmware of a system is configured to allow secondary devices, such as a smart card, to be used for authentication. In an example embodiment, the secondary device is a CCID smart card in compliance with the ISO 7816 specification. The smart card is inserted into a card reader coupled to the system prior to booting the system. The firmware comprises an emulator and driver configured to allow authentication information from the smart card to be utilized to allow execution of the boot process. In an example embodiment, the smart card comprises external keys for use with BITLOCKER™. The secondary device is compatible with systems implementing a BIOS and with systems implementing EFI. Authentication also can be accomplished via devices that do not provide data storage, such as a biometric device or the like.

    摘要翻译： 系统的固件被配置为允许诸如智能卡的辅助设备用于认证。 在示例实施例中，辅助设备是符合ISO 7816规范的CCID智能卡。 在引导系统之前，将智能卡插入耦合到系统的读卡器。 固件包括仿真器和驱动器，其被配置为允许来自智能卡的认证信息被用于允许执行引导过程。 在示例实施例中，智能卡包括用于与BITLOCKER TM一起使用的外部键。 辅助设备与实施BIOS的系统以及实施EFI的系统兼容。 认证也可以通过不提供数据存储的设备来实现，例如生物测定设备等。

    Systems and methods for securely booting a computer with a trusted processing module
    48.
    发明申请
    Systems and methods for securely booting a computer with a trusted processing module 有权
    使用可信处理模块安全地引导计算机的系统和方法

    公开(公告)号：US20060155988A1

    公开(公告)日：2006-07-13

    申请号：US11031161

    申请日：2005-01-07

    申请人： Jamie Hunter ,  Paul England ,  Russell Humphries ,  Stefan Thom ,  James Schwartz ,  Kenneth Ray ,  Jonathan Schwartz

    发明人： Jamie Hunter ,  Paul England ,  Russell Humphries ,  Stefan Thom ,  James Schwartz ,  Kenneth Ray ,  Jonathan Schwartz

    IPC分类号： H04L9/00

    CPC分类号： G06F21/575

    摘要： In a computer with a trusted platform module (TPM), an expected hash value of a boot component may be placed into a platform configuration register (PCR), which allows a TPM to unseal a secret. The secret may then be used to decrypt the boot component. The hash of the decrypted boot component may then be calculated and the result can be placed in a PCR. The PCRs may then be compared. If they do not, access to the an important secret for system operation can be revoked. Also, a first secret may be accessible only when a first plurality of PCR values are extant, while a second secret is accessible only after one or more of the first plurality of PCR values has been replaced with a new value, thereby necessarily revoking further access to the first secret in order to grant access to the second secret.

    摘要翻译： 在具有可信平台模块（TPM）的计算机中，引导组件的预期散列值可以被放置到平台配置寄存器（PCR）中，这允许TPM解密秘密。 然后可以使用秘密来解密引导组件。 然后可以计算解密的引导组件的散列，并将结果置于PCR中。 然后可以比较PCR。 如果不这样做，可以取消对系统运行的重要秘密的访问。 此外，只有当第一多个PCR值存在时，第一个秘密才可以访问，而第二个秘密只有在第一个多个PCR值中的一个或多个被新的值替换之后才可访问，从而必然取消进一步的访问 到第一个秘密，以授予访问第二个秘密。

    Network based management of protected data sets
    50.
    发明授权
    Network based management of protected data sets 有权
    基于网络的受保护数据集管理

    公开(公告)号：US08782423B2

    公开(公告)日：2014-07-15

    申请号：US13527439

    申请日：2012-06-19

    申请人： Mark F. Novak ,  Andrew John Layman ,  Magnus Nyström ,  Stefan Thom

    发明人： Mark F. Novak ,  Andrew John Layman ,  Magnus Nyström ,  Stefan Thom

    IPC分类号： G06F3/06

    CPC分类号： G06F3/0622 ,  G06F21/57 ,  G06F21/602

    摘要： A system that includes an account management module configured to maintain protected accounts. For instance, a particular protected account includes a protected data set that is not readable outside of the system, and perhaps not even readable outside of the account. The particular data set corresponds to a particular entity assigned to the particular account and that includes keys corresponding to the particular entity. A security processor uses at least some of the plurality of keys to perform cryptographic processes in response to one or more trusted execution environment commands received from the particular entity.

    摘要翻译： 包括配置为维护受保护的帐户的帐户管理模块的系统。 例如，特定受保护的帐户包括在系统之外不可读的受保护的数据集，甚至在帐户之外甚至不可读。 特定数据集对应于分配给特定帐户的特定实体，并且包括与特定实体相对应的密钥。 响应于从特定实体接收到的一个或多个可信执行环境命令，安全处理器使用多个密钥中的至少一些来执行密码处理。