US7318235B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
Attestation using both fixed token and portable token
Assignee: Intel Corp
•
Filing: 2002-12-16
•
Granted: 2008-01-08
•
Expires: 2022-12-16
Abstract
Abstract Methods, apparatus and machine readable medium are described for creating and using protected key blobs that require a particular portable token be present before use of the key or keys of the protected key blob is granted. Such protected key blobs may be used to establish a level of trust between a local user and the computing device.
Inventors
- 👤 David W. Grawrock
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 09:11
CPC Classifications
G; G06; G06F; G06F1/00; G06F21/00; G06F21/30; G06F21/31; G06F21/34; G06Q; G06Q20/00; G06Q20/30; G06Q20/36; G06Q20/367; H; H04; H04L; H04L9/00; H04L9/08; H04L9/0816; H04L9/0819; H04L9/0827; H04L9/0861; H04L9/0877; H04L9/32; H04L9/3234
Claims Analysis
Total Claims: 24
Claim 1
Independent Claim
95 words
A method comprising requesting a fixed token to create a sealed key blob comprising both a first key pair and first usage authorization data, wherein knowledge of the first usage authorization data is required in order to use a private key of the first key pair, and requesting a portable token to create a protected key blob, where the protected key blob comprises the sealed key blob and second usage authorization data, wherein knowledge of the second usage authorization data is required in order to obtain the sealed key blob from the protected key blob.
Claim 2
Independent Claim
95 words
A method comprising requesting a fixed token to create a sealed key blob comprising both a first key pair and first usage authorization data, wherein knowledge of the first usage authorization data is required in order to use a private key of the first key pair, and requesting a portable token to create a protected key blob, where the protected key blob comprises the sealed key blob and second usage authorization data, wherein knowledge of the second usage authorization data is required in order to obtain the sealed key blob from the protected key blob.
Claim 3
Dependent Claim
51 words
The method of claim 1 comprising encrypting the private key of the first key pair and the first usage authorization data with the fixed token and a public key of the fixed token, and creating the sealed key blob with the encrypted private key and the encrypted first usage authorization data.
Claim 4
Dependent Claim
48 words
The method of claim 2 comprising encrypting the sealed key blob and the second usage authorization data with the portable token and a public key of the portable token, and creating the protected key blob with the encrypted sealed key blob and the encrypted second usage authorization data.
Claim 5
Dependent Claim
93 words
The method of claim 3 comprising providing the portable token with a request for the sealed key blob of the protected key blob, the request providing proof of possessing the second usage authorization data, decrypting the encrypted sealed key blob and the encrypted second usage authorization data of the protected key blob with the portable token using a private key of the portable token, and receiving the sealed key blob from the portable token in response to the portable token determining that the proof of possessing the second usage authorization data was valid.
Claim 6
Dependent Claim
35 words
The method of claim 4 further comprising scrubbing the protected key blob and associated data from the portable token in response to determining that the proof of possessing the second usage authorization data was invalid.
Claim 7
Dependent Claim
27 words
The method of claim 5 further comprising deactivating the portable token in response to determining that the proof of possessing the second usage authorization data was invalid.
Claim 8
Dependent Claim
98 words
The method of claim 4 comprising providing the fixed token with a request to load the first key pair of the sealed key blob, the request providing proof of possessing the first usage authorization data, decrypting the encrypted private key and the encrypted first usage authorization data of the sealed key blob with the fixed token using a private key of the fixed token, and receiving a key handle to the first key pair of the sealed key blob in response to the fixed token determining that the proof of possessing the first usage authorization data was valid.
Claim 9
Dependent Claim
35 words
The method of claim 7 further comprising scrubbing the sealed key blob and associated data from the fixed token in response to determining that the proof of possessing the first usage authorization data was invalid.
Claim 10
Dependent Claim
27 words
The method of claim 8 further comprising deactivating the portable token in response to determining that the proof of possessing the first usage authorization data was invalid.
Claim 11
Dependent Claim
57 words
The method of claim 1 comprising requesting the portable token to return the sealed key blob from the protected key blob, providing the portable token with proof of possessing the second usage authorization data, and obtaining the sealed key blob from the portable token only if the proof of possessing the second usage authorization data was valid.
Claim 12
Dependent Claim
63 words
The method of claim 10 comprising requesting the fixed token to load the first key pair from the sealed key blob, and providing the fixed token with proof of possessing the first usage authorization data, and obtaining a key handle to the first key pair stored in the fixed token only if the proof of possessing the first usage authorization data was valid.
Claim 13
Dependent Claim
64 words
The method of claim 1 comprising directing a request to the portable token to return the sealed key blob from the protected key blob, the request comprising proof of possessing the second usage authorization data, and obtaining the sealed key blob from the portable token only if the portable token was present and the proof of possessing the second usage authorization data was valid.
Claim 14
Dependent Claim
78 words
The method of claim 12 comprising directing a request to the fixed token to load the first key pair from the sealed key blob, the request comprising proof of possessing the first usage authorization data, and obtaining a key handle to the first key pair stored in the fixed token only if the proof of possessing the first usage authorization data was valid and an environment associated with the request satisfies criteria specified by the sealed key blob.
Claim 15
Dependent Claim
185 words
A computing device, comprising a fixed token comprising a first processing unit and first protected storage, the first processing unit to load a first key pair of a sealed key blob into the first protected storage in response to determining that a first authentication code has a predetermined relationship to first usage authorization data of the sealed key blob, a portable token comprising a second processing unit and second protected storage, the second processing unit to return the sealed key blob from a protected key blob in response to determining that a second authentication code has a predetermined relationship to second usage authorization data of the protected key blob, a portable token interface that enables the portable token to be coupled to and removed from the computing device, a processor to provide the portable token with a request for the sealed key blob, wherein the request that comprises the protected key blob and the second authentication code, and to provide the fixed token with a request to load the first key pair, wherein the request comprises the sealed key blob and the first authentication code.
Claim 16
Dependent Claim
185 words
A computing device, comprising a fixed token comprising a first processing unit and first protected storage, the first processing unit to load a first key pair of a sealed key blob into the first protected storage in response to determining that a first authentication code has a predetermined relationship to first usage authorization data of the sealed key blob, a portable token comprising a second processing unit and second protected storage, the second processing unit to return the sealed key blob from a protected key blob in response to determining that a second authentication code has a predetermined relationship to second usage authorization data of the protected key blob, a portable token interface that enables the portable token to be coupled to and removed from the computing device, a processor to provide the portable token with a request for the sealed key blob, wherein the request that comprises the protected key blob and the second authentication code, and to provide the fixed token with a request to load the first key pair, wherein the request comprises the sealed key blob and the first authentication code.
Claim 17
Dependent Claim
56 words
The computing device of claim 14 wherein the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and the processor is to determine that that a user associated with the portable token is present in response to receiving the first key handle.
Claim 18
Dependent Claim
65 words
The computing device of claim 14 wherein the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and the processor is to determine that a user associated with the portable token is present in response to successfully decrypting a secret using the first key pair identified by the first key handle.
Claim 19
Dependent Claim
74 words
The computing device of claim 14 wherein the first protected storage of the fixed token comprises registers for storing metrics of an environment, the processor is to provide the fixed token with a plurality of metrics of the environment, and the first processing is to load the first key pair into the first protected storage only if the metrics stored in the registers indicate that the environment satisfies criteria of the sealed key blob.
Claim 20
Dependent Claim
57 words
The computing device of claim 17 wherein the fixed token is to provide a first, key handle to the first key pair in response to successfully loading the first key pair, and the processor is to determine that the environment satisfies the criteria specified by the sealed key blob in response to receiving the first key handle.
Claim 21
Dependent Claim
67 words
The computing device of claim 17 wherein the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and the processor is to determine that the environment satisfies the criteria specified by the sealed key blob in response to successfully decrypting a secret using the first key pair identified by the first key handle.
Claim 22
Dependent Claim
43 words
The computing device of claim 17 wherein the first processing unit is to scrub the sealed key blob and any associated data from the fixed token in response to determining that the environment does not satisfy the criteria of the sealed key blob.
Claim 23
Dependent Claim
82 words
The computing device of claim 14 wherein the fixed token comprises a key pair used to create the sealed key blob, the first processing unit only loads the first key pair of the sealed key blob in response to a request received via a first session established for the key pair used to create the sealed key blob, and the processor is to establish the first session prior to providing the fixed token with the request to load the first key pair.
Claim 24
Dependent Claim
84 words
The computing device of claim 21 wherein the portable token comprises a key pair used to create the protected key blob, the second processing unit is to only load the first key pair of the sealed key blob in response to a request received via a second session established for the key pair used to create the protected key blob, and the processor is to establish the second session prior to providing the portable token with the request to for the sealed key blob.
References Cited (Backward Citations)
US3699532A
Cited
US3996449A
Cited
US4162536A
Cited
US4037214A
Cited
US4278837A
Cited
US4276594A
Cited
US4207609A
Cited
US4319233A
Cited
US4307447A
Cited
US4529870A
Cited
US4319323A
Cited
US4419724A
Cited
US4366537A
Cited
US4403283A
Cited
US4430709A
Cited
US4621318A
Cited
US4521852A
Cited
US4571672A
Cited
US4975836A
Cited
US4802084A
Cited
US4759064A
Cited
US4795893A
Cited
US4843541A
Cited
FR2620248B1
Cited
US5007082A
Cited
US4974159A
Cited
US5079737A
Cited
US5187802A
Cited
US5361375A
Cited
US6499123B1
Cited
US5504922A
Cited
US5022077A
Cited
US5295251A
Cited
US5459867A
Cited
US5075842A
Cited
EP0473913A3
Cited
US5582717A
Cited
US5230069A
Cited
US5317705A
Cited
US5255379A
Cited
US6378068B1
Cited
DE4217444A1
Cited
US5319760A
Cited
US5287363A
Cited
US5455909A
Cited
US5386552A
Cited
US5890189A
Cited
US5574936A
Cited
US5421006A
Cited
US5237616A
Cited
US5293424A
Cited
EP0600112A1
Cited
US5668971A
Cited
EP0602867A1
Cited
US5506975A
Cited
FR2700430B1
Cited
US5752046A
Cited
US5469557A
Cited
US5479509A
Cited
US5628023A
Cited
US5628022A
Cited
US5680547A
Cited
US5555385A
Cited
FR2714780B1
Cited
US5825880A
Cited
US5459869A
Cited
US5604805A
Cited
WO1995024696A3
Cited
US5796845A
Cited
US5805712A
Cited
EP0965902A2
Cited
FR2752122B1
Cited
US5978481A
Cited
US5473692A
Cited
US5568552A
Cited
US5706469A
Cited
US5956408A
Cited
US6058478A
Cited
US6741991B2
Cited
US5606617A
Cited
US5564040A
Cited
US6269392B1
Cited
US5560013A
Cited
US5555414A
Cited
US5615263A
Cited
US5764969A
Cited
US5727061A
Cited
US5717903A
Cited
FR2742618B1
Cited
US5684948A
Cited
US5633929A
Cited
US6093213A
Cited
US5737760A
Cited
US5872994A
Cited
US5790668A
Cited
US6092095A
Cited
US5657445A
Cited
WO1997029567A1
Cited
US6249872B1
Cited
US5835594A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2011-01-07 | 2011-07-09 | 2012-01-08 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2015-01-07 | 2015-07-09 | 2016-01-08 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2019-01-07 | 2019-07-09 | 2020-01-08 | $7700.00 | Window Closed / Lapsed |