Data protection keys
One embodiment provides a client device. The client device includes a Trusted Platform Module (TPM). The TPM includes a secure controller to extend a secure hash digest with at least a portion of a data stream or a hash of the at least a portion of the data stream. Another embodiment provides a server system. The server system includes verifier logic. The verifier logic is to verify that an attestation identity key (AIK) public key associated with a received Trusted Platform Module (TPM) quote corresponds to an authenticated client device.
1. A client device, comprising:
a processor;
a communication interface configured to establish a communication link with a server system;
a non-transitory computer readable medium having one or more instructions stored thereon, which, when executed by said processor, cause said client device to carry out the following operations:
establishing said communication link with said server system; and
transmitting, via said communication link, a data stream to said server system; and
a Trusted Platform Module (TPM) comprising:
a secure controller to perform extending operations to generate an accumulated hash digest, said extending operations comprising:
concatenating a current hash digest with a received hash value or at least a portion of said data stream to generate a concatenated hash digest; and
hashing said concatenated hash digest to generate said accumulated hash digest;
a first private attestation identity key (AIK) to authenticate said client device;
a second private AIK being used to generate a TPM quote based on said accumulated hash digest to be transmitted to said server system by using said second private AIK to sign said accumulated hash digest; and
a public AIK to be transmitted to said remote server, said public AIK being associated with said second private AIK, wherein said public AIK is signed using said first private AIK to certify that the first private AIK and said second private AIK are contained in the TPM.
2. The client device of claim 1 , further comprising computer readable instructions to effect generating said TPM quote.
3. The client device of claim 2 , further comprising computer readable instructions to effect generating said TPM quote using said second private AIK, the second private AIK being related to an identity of the client device.
4. The client device of claim 1 , wherein the received hash value corresponds to an accumulation of a plurality of secure hash digests related to a plurality of portions of the data stream.
5. A method comprising:
establishing a communication link with a server system;
transmitting, via said communication link, a data stream to said server system;
in said TPM, performing:
extending operations to generate an accumulated hash digest, said extending operations comprising:
concatenating a current hash digest with a received hash value or at least a portion of said data stream to generate a concatenated hash digest; and
hashing said concatenated hash digest to generate said accumulated hash digest;
authenticating said client device with a first private attestation identity key (AIK);
signing said accumulated hash digest with a second private AIK to generate a TPM quote based on said accumulated hash digest to be transmitted to said server system;
transmitting a public AIK to said remote server, said public AIK being associated with said second private AIK, wherein said public AIK is signed using said first private AIK to certify that the first private AIK and said second private AIK are contained in the TPM.
6. The method of claim 5 , wherein the TPM quote is generated using said second private AIK, the second private AIK being related to an identity of an associated client device.
7. The method of claim 5 , wherein the received hash value corresponds to an accumulation of a plurality of secure hash digests related to a plurality of portions of the data stream.