Computer security system and method

A computer security system comprises a secure platform adapted to receive sensitive data from an agent. The secure platform is also adapted to cooperate with a trusted platform module (TPM) to encrypt the sensitive data via a TPM storage key associated with the agent.

BACKGROUND

Various types of sensitive information are generally stored on a computer system such as, but not limited to, passwords, personal information, authentication mechanisms and data, and various types of computer system access credentials. The sensitive information may be user-generated, software-generated, stored on the computer system at the factory, or otherwise generated and stored on the computer system. However, at least because there are generally multiple users and/or agents accessing or utilizing a particular computer system, the sensitive information and/or security information used to protect such information or authenticate a user and/or agent requesting access to the sensitive information generally remains susceptible to hacking and/or discovery by unapproved or unauthenticated entities. Thus, there is a need to securely store such types of sensitive information on the computer system.

DETAILED DESCRIPTION OF THE DRAWINGS

The preferred embodiments of the present invention and the advantages thereof are best understood by referring toFIGS. 1-5of the drawings, like numerals being used for like and corresponding parts of the various drawings.

FIG. 1is a diagram illustrating an embodiment of a computer security system10in accordance with the present invention. In the embodiment illustrated inFIG. 1, system10comprises a processor12communicatively coupled to a secure platform13. In the embodiment illustrated inFIG. 1, secure platform13comprises a basic input/output system (BIOS)14. However, it should be understood that other systems, applications, modules or engines may be used as a secure platform including, but not limited to, an operating system (O/S) or a security software application. In the embodiment illustrated inFIG. 1, processor12and secure platform13are also communicatively coupled to a trusted platform module (TPM)16.

In the embodiment illustrated inFIG. 1, BIOS14comprises a security module20and a memory22. Security module20may comprise software, hardware, a combination of software and hardware. In operation of at least one embodiment of the present invention, security module20cooperates with TPM16to provide secure storage of sensitive information such as, but not limited to, platform and/or device-specific sensitive information (e.g., passwords, codes, and/or other types of sensitive information of which security is desired). In the embodiment illustrated inFIG. 1, security module20comprises a registration module30, an authentication module32and an access module34. Registration module30is used to receive sensitive information or data, cooperate with TPM16to encrypt the sensitive information, and store the encrypted sensitive information, identified as encrypted sensitive data40, in memory22. Authentication module32is used to authenticate or otherwise verify the identity of a source providing sensitive information to be protected or requesting access to the sensitive information. Access module34is used to cooperate with TPM16to decrypt the encrypted sensitive data40and provide or otherwise enable access to the decrypted sensitive information by a requesting entity. The sensitive information to be protected may comprise any type of information such as, but not limited to, information associated with initiating and/or accessing secure computer resources, a hard drive lock password, network access authorization information, and/or software application initiation or access passwords.

In the embodiment illustrated inFIG. 1, memory22also comprises agent identification data42and a TPM storage key44. Agent identification data42comprises information associated with authenticating an identity of a trusted agent50. Trusted agent50may comprise a user accessing system10, a software application, such as a hard drive or disc encryption software application, or any other type of entity adapted to generate and/or provide sensitive information of which protection is desired and/or request access to secure or protected sensitive information. However, it should also be understood that sensitive information may be generated or otherwise provided by another entity (e.g., a password or code generated by BIOS14). Thus, in operation, authentication of trusted agent50may be performed using any type of secure authentication method such as, but not limited to, a series of handshake signals, query/response exchanges, or password verification.

TPM storage key44is used by TPM16to encrypt the sensitive information for which security protection is desired. TPM storage key44comprises information generated and/or interpretable by TPM16, such as an opaque binary large object (BLOB). In some embodiments of the present invention, TPM storage key44is associated with trusted agent50. For example, in a user-based embodiment, TPM storage key44is generated by TPM16based on authentication of a particular user (e.g., based on a TPM16password or access credential provided by the particular user). In other embodiments, TPM storage key44is associated with a particular software application or computer-based system such that TPM storage key44is generated by TPM16based on authentication of a particular software application or computer-based system. In yet other embodiments of the present invention, TPM storage key44is associated with secure platform13(e.g., BIOS14). In such an embodiment of the present invention, TPM storage key44is generated by TPM16based on authentication of secure platform13(e.g., via a TPM16password or credential provided by BIOS14).

FIGS. 2A and 2Bare diagrams illustrating an embodiment of authentication and registration operations using system10in accordance with the present invention. In some embodiments of the present invention, the authentication and registration operations are performed for trusted agent50(e.g., a user of system10or a software application). However, it should be understood that the authentication and registration operations may be performed for other types of computer resource applications or systems (e.g., authentication and registration of BIOS-generated sensitive information). Referring toFIG. 2A, in operation, authentication module32performs an authentication operation by requesting or otherwise acquiring agent identification data42and authentication data60from trusted agent50. For example, agent identification data42comprises information corresponding to an identity of trusted agent50such as, but not limited to, a username or device serial number. Authentication data60comprises information associated with at least accessing and/or utilizing TPM16and/or otherwise verifying an identity of the agent50attempting to access or otherwise utilize TPM16, such as, but not limited to, a TPM password or biometric. The authentication process may be performed for a single agent50or multiple agents50(i.e., such as multiple users in a shared computing environment and/or multiple software applications or systems).

In the embodiment illustrated inFIG. 2A, authentication module32verifies or otherwise authenticates the identity of agent50by verifying and/or otherwise authenticating agent identification data42and/or authentication data60associated with the trusted agent50(e.g., by comparing and/or correlating received agent identification data42and/or authentication data60with known or stored data and/or values). Authentication module32also performs at least a first stage of the registration operation. For example, in operation, authentication module32transmits authentication data60associated with agent50to TPM16, and requests generation by TPM16of TPM storage key44based on authentication data60. Registration module30receives and stores TPM storage key44(e.g., in memory22of BIOS14). However, it should also be understood that, after authentication of agent50by authentication module32, control of the registration operation may be passed from authentication module32to registration module30to request generation by TPM16of TPM storage key44. For example, in this embodiment, registration module30receives authentication data60associated with agent50from agent50and/or authentication module32and transmits authentication data60associated with agent50to TPM16, and requests generation by TPM16of TPM storage key44based on authentication data60.

Referring toFIG. 2B, registration module30performs a second stage of a registration operation to acquire sensitive data70. Sensitive data70comprises any type of information in which security is of a concern or which security is to be maintained such as, but not limited to, equipment or device passwords (e.g., a hard drive lock password) and access credentials (e.g., network and/or software application access credentials). However, it should also be understood that sensitive data70may be acquired from agent50during an earlier stage of the registration operation.

In the second stage of the registration operation, registration module30transmits TPM storage key44and sensitive data70to TPM16and requests TPM16to encrypt sensitive data70using TPM storage key44. For example, in some embodiments of the present invention, TPM storage key(s)44are not stored by TPM16to further prevent access to TPM storage key(s)44by hostile sources. TPM16encrypts sensitive data70using TPM storage key44, thereby forming encrypted sensitive data40, and transmits encrypted sensitive data40to registration module30. In some embodiments of the present invention, registration model30then stores, or causes to be stored, in memory22encrypted sensitive data40. However, in other embodiments of the present invention, encrypted sensitive data40may be transmitted to another entity for storage (e.g., agent50). In the embodiment illustrated inFIGS. 2A and 2B, the registration operation is described in terms of multiple stages; however, it should be understood that the registration operation ofFIGS. 2A and 2Bmay also be considered to be performed in a single stage.

FIG. 3is a diagram illustrating a sensitive information access operation using system10. In operation, during the access process, security module20requests or otherwise receives from agent50information for authenticating an identity of agent50requesting access to the sensitive information (e.g., at least when access to sensitive information is not temporal with a process in which the identity of agent has been previously authenticated or as otherwise designated by security policies). For example, in operation, authentication module32receives or otherwise acquires from agent50authentication data60and agent identification data42. Where agent50comprises a user of system10(e.g., a person), system10may be configured to request identification data42from the user or access stored identification data42and display available identification data42to the user to enable selection by the user (e.g., via an input/output device) of particular identification data42.

After authentication of agent50, security module20performs or otherwise requests decryption of encrypted sensitive data40. For example, in operation for some embodiments of the present invention, access module34identifies and/or otherwise retrieves TPM storage key44and encrypted sensitive data40corresponding to the agent50based on the agent identification data42. However, it should be understood that in other embodiments of the present invention, agent50may provide the encrypted sensitive data40to access module34during the access operation. Access module34transmits TPM storage key44, authentication data60and encrypted sensitive data40to TPM16and requests verification or authentication of authentication data60and decryption of encrypted sensitive data40. For example, in some embodiments of the present invention, TPM16is instructed or requested to verify authentication data60using TPM storage key44. In response to successful verification or authentication of authentication data60, TPM16decrypts encrypted sensitive data40using TPM storage key44and transmits the decrypted sensitive data70to access module34. Access module34may then transmit sensitive data70to particular devices or applications (e.g., agent50or another device, system or application) or otherwise use sensitive data70to perform or authorize a particular computer security function.

In the embodiment illustrated inFIGS. 2A,2B and3, system10is configured to protect sensitive data70provided or otherwise generated by agent50(e.g., a user, such as a person, a software application, or another type of computer system or application). However, it should also be understood that sensitive data70may be provided or otherwise generated by secure platform13(e.g., by BIOS14). For example, in some embodiments of the present invention, BIOS14may be configured to generate sensitive data70(e.g., in response to a request from agent50or another computer or software application/system). Further, in some embodiments of the present invention, secure platform13is configured or otherwise performs operations as agent50(e.g., secure platform13obtaining a TPM storage key44associated therewith and/or otherwise requesting encryption of sensitive information and/or access to encrypted sensitive information via TPM storage key44). In some embodiments of the present invention, BIOS14, for example, is configured to generate sensitive data70(e.g., based on a request by agent50or another computer or software application/system). In such an embodiment of the present invention, BIOS14also communicates with and otherwise authenticates its identity with TPM16based on identification data and/or authentication data associated with BIOS14. Thus, in this embodiment of the present invention, BIOS14authenticates its identity with TPM16(e.g., via handshake signals, query/response exchange(s), or another type of authentication method) and obtains from TPM16its own TPM storage key44. The TPM storage key44associated with BIOS14is used to encrypt the sensitive data70generated or otherwise provided by BIOS14via TPM16and is also used to decrypt the resulting encrypted sensitive data40. As discussed above, the encrypted sensitive data40may be stored in memory22of BIOS14or transmitted to a requesting entity (e.g., agent50or another computer software application or system).

FIG. 4is a flow diagram illustrating an embodiment of a computer security authentication and registration method using system10in accordance with the present invention. The method begins at block300, where authentication module32and registration module30are initiated. At block302, authentication module32requests agent identification data42. At block304, authentication module32receives agent identification data42. At block306, authentication module32requests authentication data60from agent50. At block308, authentication module32receives authentication data60from agent50.

At block318, TPM storage key44and agent identification data42are stored in memory22. At block320, registration module30requests sensitive data70from agent50. However, it should be understood that in some embodiments or applications of the present invention, a request for sensitive data70may be unnecessary. At block322, registration module30receives sensitive data70from agent50. At block324, registration module30transmits sensitive data70and TPM storage key44to TPM16. At block326, registration module30requests encryption by TPM16of sensitive data70using TPM storage key44. At block328, TPM16encrypts sensitive data70using TPM storage key44, thereby generating encrypted sensitive data40. At block330, registration module30receives encrypted sensitive data40from TPM16and transmits and/or stores the encrypted sensitive data40. For example, in some embodiments of the present invention, registration module30stores encrypted sensitive data40in memory22. In other embodiments of the present invention, registration module30transmits encrypted sensitive data40to agent50or another designated system or application.

FIG. 5is a flow diagram illustrating an embodiment of a computer security method for accessing protected information using system10in accordance with the present invention. The method begins at block400, where access module34requests or retrieves agent identification data42. For example, as described above, agent identification data42may be provided by agent50or retrieved from memory22for selection by agent50(e.g. a user of system10). At block402, access module34requests authentication data60from agent50. At block404, access module34receives authentication data60from agent50.

At block406, access module34retrieves TPM storage key44associated with agent50based on agent identification data46. At block408, access module34transmits TPM storage key44and authentication data60to TPM16. At block410, access module34requests verification or authentication of authentication data60by TPM16using TPM storage key44. However, it should be understood that authentication module32may be used to perform an authentication operation to verify or otherwise authenticate the identity of agent50.

At decisional block412, a determination is made whether authentication data60is verified based on TPM storage key44. If authentication data60is not verified or otherwise authenticated by TPM16, the method returns to block400. If authentication data60is verified or otherwise authenticated by TPM16, the method proceeds to block414, where access module34retrieves encrypted sensitive data40associated with or otherwise requested by agent50from memory22. It should be understood that encrypted sensitive data40may also be provided by agent50(e.g., if the encrypted sensitive data40is not stored in memory22of secure platform13). At block416, access module34retrieves TPM storage key44associated with agent50. At block418, access module34transmits encrypted sensitive data40and TPM storage key44associated with agent50to TPM16.

At block420, access module34requests decryption of encrypted sensitive data40by TPM16using TPM storage key44. At block422, TPM16decrypts encrypted sensitive data40using TPM storage key44. At block424, TPM16transmits, or access module34otherwise receives, decrypted sensitive data70. Access module34may then use decrypted sensitive data70to perform or otherwise access a secure computer application or operation or provide the decrypted sensitive data70to agent50.

In the embodiment depicted inFIGS. 4 and 5, sensitive data70is generated or otherwise provided by agent50. However, as described above, it should be understood that secure platform13(e.g., BIOS14or another type of trusted platform or system) may be used to generate and/or otherwise provide the sensitive data70. For example, and not by way of limitation, in a drive-lock application, BIOS14may be used to generate a drive-lock password as the sensitive data70. In this embodiment of the present invention, BIOS14may be used to cooperate with TPM16to encrypt the drive-lock password using a TPM storage key44associated with BIOS14. The encrypted password may then be forwarded to the drive-lock mechanism for storage. Thus, when access to the drive is requested, the drive-lock mechanism requests access to the drive-lock password by forwarding the encrypted drive-lock password to access module34, which, after authentication of the drive-lock mechanism, forwards the encrypted drive-lock password to TPM16with the TPM storage key44for decryption. After decryption, access module34forwards the decrypted drive-lock password to the drive-lock mechanism for unlocking the drive device. Thus, in this embodiment of the present invention, the decrypted drive-lock password is not stored on the system (e.g., only transiently available).

Thus, embodiments of the present invention enable secure storage of sensitive information using cryptographic properties of a trusted platform module (i.e., TPM16). In some embodiments of the present invention, the sensitive information is provided or otherwise generated by a user of the system (e.g., a person), a computer or software application system, or by a secure platform also used to store an encrypted form of the sensitive information (e.g., BIOS14).

It should be understood that in the methods described inFIGS. 4 and 5, certain functions may be omitted, combined, or accomplished in a sequence different than depicted inFIGS. 4 and 5. Also, it should be understood that the methods depicted inFIGS. 4 and 5may be altered to encompass any of the other features or aspects described elsewhere in the specification.