Method and apparatus for secure information transfer to support migration
A system and method are disclosed for providing and maintaining a high level of security during migration of data from one platform to another. The disclosed system combines user and equipment authentication with equipment environment authorization guaranteed by a security module such as supported by a trusted platform module (TPM) in parallel, for secure information transfer to support migration between platforms.
1. A method of secure information transfer to support migration, comprising:
certifying a public key infrastructure module of a first platform, the public key infrastructure module being certified using a trusted platform module of the first platform; and
migrating data of the first platform to a second platform; and
wherein the data is made useable in the second platform by directly establishing hardware based trust between a trusted platform module of the second platform and the trusted platform module of the first platform other than by transferring a key from the first platform at the migrating, and
where the public key infrastructure module is controlled in parallel with the trusted platform module of the first platform and the trusted platform module of the second platform.
2. The method according to claim 1 , wherein the public key infrastructure module of the first platform encrypts keys and a certificate based on the trusted platform module of the second platform, and sends said keys and said certificate to the second platform.
3. The method according to claim 2 , wherein said keys and said certificate are decrypted in the second platform.
4. The method according to claim 1 , wherein the public key infrastructure module and the trusted platform module of the first platform are implemented via a single chip.
5. The method according to claim 1 , wherein the public key infrastructure module and the trusted platform module of the first platform are each provided with a certificate in parallel from a trusted third party.
6. The method according to claim 5 , wherein the public key infrastructure module and the trusted platform module of the second platform are each provided with a certificate in parallel from the trusted third party.
7. The method according to claim 4 , wherein authentication of a user, an equipment and environment of the equipment, or any combination thereof in the first platform is performed via said chip.
8. The method according to claim 2 , wherein said certificate is issued by a manufacturer of the trusted platform module of the second platform.
9. The method according to claim 4 , wherein the public key infrastructure module of the first platform is implemented in a level of hierarchy identical to the trusted platform module of the first platform.
10. The method according to claim 5 , wherein said certificate is issued based on a hardware root of trust.
11. A non-statutory computer readable storage medium having a program stored therein to cause a computer to execute operations, comprising:
certifying a public key infrastructure module of a first platform, the public key infrastructure module being certified using a trusted platform module of the first platform; and
migrating data of the first platform to a second platform based on certification of a trusted platform module of the second platform using key data sent from a chip implemented with the first platform, and
where the public key infrastructure module is controlled in parallel with the trusted platform module of the first platform and the trusted platform module of the second platform, and
where the data is made useable in the second platform by directly establishing hardware based trust between the trusted platform module of the first platform and the trusted platform module of the second platform other than by transferring a key from the first platform at the migrating.
12. The computer readable medium according to claim 11 , wherein the public key infrastructure module of the first platform encrypts keys and a certificate based on the trusted platform module of the second platform, and sends said keys and said certificate to the second platform.
13. The computer readable medium according to claim 11 , wherein said keys are generated based on public key cryptography standards (PKCS).
14. An apparatus, comprising
a chip implemented with a public key infrastructure module and a trusted platform module of a first platform; and
a controller controlling the public key infrastructure module parallel with a trusted platform module of a first platform, and
where data of the first platform is migrated to a second platform and the data is made useable in the second platform by directly establishing hardware based trust between a trusted platform module of the second platform and the trusted platform module of the first platform other than by transferring a key from the first platform at migrating of the data, and
the public key infrastructure module is controlled in parallel with the trusted platform module of the first platform and the trusted platform module of the second platform.
15. The apparatus according to claim 14 , wherein the public key infrastructure module of the first platform encrypts keys and a certificate based on the trusted platform module of the second platform, and sends said keys and said certificate to the second platform.
16. A method, comprising:
verifying data of a first platform using a certificate issued based on a security module of the first platform; and
migrating the data from the security module of the first platform to a security module of a second platform, and
where the public key infrastructure module is controlled in parallel with the security module of the first platform and the security module of the second platform, and
where the data is made useable in the second platform by directly establishing hardware based trust between a security module of the second platform and the security module of the first platform other than by transferring a key from the first platform at the migrating.
17. The method according to claim 16 , wherein the security module of the first platform is a trusted platform module (TPM).
18. The method according to claim 17 , wherein the security module of the second platform is a trusted platform module (TPM).
19. The method according to claim 16 , wherein the data is authenticated based on a certificate of the security module of the second platform.
20. The method according to claim 18 , wherein the data is used based on a certificate authenticated by the trusted platform module of the second platform.