Patent ID: 7802111

Claim:
A hardware-based method for limiting exposure of cryptographic keys protected by a trusted platform module (TPM), the hardware comprising: a processor; a cryptographic client executed in the processor; a hardware cryptographic module, in communication with the cryptographic client, and the cryptographic module including a cryptographic service performing the operations of: establishing, a session with the TPM on behalf of a cryptographic client; sending a request from the cryptographic client to the TPM to retrieve in plaintext a cryptographic key of the cryptographic client protected by the TPM; receiving the cryptographic key in plaintext from the TPM; performing a cryptographic operation requested by the cryptographic client using the cryptographic key; and sending results of the cryptographic operation to the cryptographic client; wherein the cryptographic module encapsulating the TPM and the cryptographic service; and wherein the cryptographic module is isolated from any private network connection.