Theft deterrence using trusted platform module authorization
View Patent ↗A method for theft deterrence of a computer system is disclosed. The computer system includes a trusted platform module (TPM) and storage medium. The method comprises providing a binding key in the TPM; and providing an encrypted symmetric key in the storage medium. The method further includes providing an unbind command to the TPM based upon an authorization to provide a decrypted symmetric key; and providing the decrypted symmetric key to the secure storage device to allow for use of the computer system. Accordingly, by utilizing a secure hard disk drive (HDD) that requires a decrypted key to function in conjunction with a TPM, a computer if stolen is virtually unusable by the thief. In so doing, the risk of theft of the computer is significantly reduced.
1. A method for theft deterrence of a computer system, the computer system having a trusted platform module (TPM) with a stored root key (SRK), and storage medium requiring a decrypted symmetric key to function in relation to the TPM, the method comprising:
providing a non-migratable binding key loadable by a basic input/output system (BIOS) in the TPM;
providing an encrypted symmetric key and an encrypted encryption key in the storage medium to provide a secure storage medium;
providing an unbind command from the BIOS to the TPM based upon an authorization to provide a decrypted symmetric key, wherein the unbind command includes the encrypted symmetric key and an authorization digest, wherein the authorization digest is derived from a password authorization prompt and is defined as using a particular payload for the unbind command during a particular instance; and
providing the decrypted symmetric key to the secure storage medium to enable use of the computer system.
2. The method of claim 1 wherein the BIOS prompts for binding key authorization.
3. A computer system comprising:
a input/output (I/O);
a processor coupled to the I/O:
a trusted platform module (TPM) with a stored root key (SRK), coupled to the I/O, the TPM including a non-migratable binding key loadable by a basic input/output system (BIOS);
the BIOS coupled to the I/O; and
a secure storage medium requiring a decrypted symmetric key to function in relation to the TOP and coupled to the I/O, the secure storage medium including an encrypted symmetric key blob, comprised of an encrypted symmetric key and an encrypted encryption key, decryptable by an unbind command provided from the BIOS to the TPM, wherein the unbind command include the encrypted symmetric key and an authorization digest, wherein the authorization digest is derived from a password authorization prompt and is defined as using a particular payload for the unbind command during a particular instance.
4. The computer system of claim 3 wherein the BIOS prompts for binding key authorization.
5. A computer readable medium containing program instructions for theft deterrence of a computer system, the computer system including a trusted platform module (TPM) with a stored root key (SRK), and storage medium requiring a decrypted symmetric key to function in relation to the TPM, the program instructions for:
providing a non-migratable binding key loadable by a basic input/output system (BIOS) in the TPM;
providing an encrypted symmetric key and an encrypted encryption key in the storage medium to provide a secure storage medium;
providing an unbind command from the BIOS to the TPM based upon an authorization to provide a decrypted symmetric key, wherein the unbind command includes the encrypted symmetric key and an authorization digest, wherein the authorization digest is derived from a password authorization prompt and is defined as using a particular payload for the unbind command during a particular instance; and
providing the decrypted symmetric key to the secure storage medium to enable use of the computer system.
6. The computer readable medium of claim 5 wherein the BIOS prompts for binding key authorization.