Patent ID: 8631507

Claim:
A method of verifying an encrypted blob of data passed to a sealed storage function in a trusted platform module (TPM) of a computing platform by a software component, comprising: receiving the encrypted blob of data from the software component; receiving a digital signature for each of a set of platform configuration register (PCR) identifier and PCR value pairs from the software component, wherein each received digital signature is provided by a service associated with the software component and each PCR identifier and PCR value pair represents a measurement of the computing environment; decrypting the encrypted blob of data using a TPM key to form a decrypted blob of data, the decrypted blob of data-comprising a secret and a verification key, wherein the verification key is provided by the service associated with the software component; for each received digital signature: determining whether each received digital signature verifies using the verification key and rejecting the decrypted blob of data if any received digital signature is not verified, and determining whether each received PCR value matches a current value stored in a corresponding PCR in the TPM and rejecting the decrypted blob of data if any corresponding pair of PCR values do not match; outputting the secret from the decrypted blob of data when the decrypted blob of data has not been rejected; and if at least one measurement of the computing platform has changed since the secret was sealed in the blob, obtaining a new signature from a certifying authority and submitting the new signature to the TPM to allow the software component access to the secret if the software component is entitled to access the secret without migrating the secret.