Computer system apparatus and method for improved assurance of authentication

1. A method comprising the steps of:

initiating the operation of a computer system having trusted computing platform capabilities;

executing code stored accessibly to the computer system to transition the computer system first to a state of presenting a secure virtual machine;

said code, when executing on said computer system while in the secure virtual machine state, retrieving data stored in a platform configuration register and then locking the retrieved data against subsequent access by any virtual machine instantiation subsequently initiated;

said code, when executing on said computer system while in an insecure state, responding to a user request for initiation of authentication of a file by transitioning the computer system to a secure machine state, announcing to the user entry into the secure machine state, and deriving from the locked data keys for authentication of the file.

2. A method according to claim 1 wherein the step of retrieving data stored in a platform configuration register comprises retrieving a passphrase selected by a user who will subsequently seek authentication of a file and a random data string necessary to enable use of a trusted platform module.

3. A method according to claim 1 wherein the step of announcing to a user entry into the secure machine state comprises displaying on a display associated with the computer system a distinctive display.

4. A method according to claim 1 wherein the step of announcing to a user entry into the secure machine state comprises selectively energizing indicators on a keyboard associated with the computer system.

5. Apparatus comprising:

a computer system having a trusted platform module;

memory associated with said computer system for storing code accessibly to said computer system;

code stored in said memory and effective, on execution by said computer system, to cause said computer system on initiation of operation to transition first to a state presenting a secure virtual machine;

said code, when executing on said computer system while in the secure virtual machine state, retrieving data stored in a platform configuration register and then locking the retrieved data against subsequent access by any virtual machine instantiation subsequently initiated;

said code, when executing on said computer system while in an insecure state, responding to a user request for initiation of authentication of a file by transitioning the computer system to a secure machine state, announcing to the user entry into the secure machine state, and deriving from the locked data keys for authentication of the file.

6. Apparatus according to claim 5 wherein said code and said computer system, in retrieving data stored in a platform configuration register, retrieves a passphrase selected by a user who will subsequently seek authentication of a file and a random data string necessary to enable use of a trusted platform module.

7. Apparatus according to claim 5 wherein said code and said computer system, in announcing to a user entry into the secure machine state, displays on a display associated with the computer system a distinctive display.

8. Apparatus according to claim 5 wherein said code and said computer system, in announcing to a user entry into the secure machine state, selectively energizes indicators on a keyboard associated with the computer system.

9. Apparatus comprising:

a computer readable medium, and

code stored on said medium accessibly to a computer system having trusted computing platform capabilities and effective, when executing on said computer system, to cause the code and the computer system together to:

initiate the operation of the computer system;

transition the computer system first to a state of presenting a secure virtual machine;

said code, when executing on said computer system while in the secure virtual machine state, retrieving data stored in a platform configuration register and then locking the retrieved data against subsequent access by any virtual machine instantiation subsequently initiated;

said code, when executing on said computer system while in an insecure state, responding to a user request for initiation of authentication of a file by transitioning the computer system to a secure machine state, announcing to the user entry into the secure machine state, and deriving from the locked data keys for authentication of the file.

10. Apparatus according to claim 9 wherein the retrieving of data stored in a platform configuration register comprises retrieving a passphrase selected by a user who will subsequently seek authentication of a file and a random data string necessary to enable use of a trusted platform module.

11. A method according to claim 9 wherein the announcing to a user of entry into the secure machine state comprises displaying on a display associated with the computer system a distinctive display.

12. Apparatus according to claim 9 wherein the announcing to a user of entry into 2 the secure machine state comprises selectively energizing indicators on a keyboard 3 associated with the computer system.