System and method for limiting exposure of cryptographic keys protected by a trusted platform module
A cryptographic module for limiting exposure of cryptographic keys protected by a trusted platform module (TPM) is provided. The cryptographic module includes logic for establishing a session with the TPM on behalf of a cryptographic client and logic for sending a request from the cryptographic client to the TPM to retrieve in plaintext a cryptographic key of the cryptographic client. Logic for receiving the cryptographic key in plaintext from the TPM are also included in cryptographic module. Further, cryptographic module includes logic for performing a cryptographic operation requested by the cryptographic client using the cryptographic key, and logic for sending the results of the cryptographic operation to the cryptographic client. A hardware-based method and system for limiting exposure of cryptographic keys also are described.
1. A hardware-based method for limiting exposure of cryptographic keys protected by a trusted platform module (TPM), the hardware comprising:
a processor;
a cryptographic client executed in the processor;
a hardware cryptographic module, in communication with the cryptographic client, and the cryptographic module including a cryptographic service performing the operations of:
establishing, a session with the TPM on behalf of a cryptographic client;
sending a request from the cryptographic client to the TPM to retrieve in plaintext a cryptographic key of the cryptographic client protected by the TPM;
receiving the cryptographic key in plaintext from the TPM;
performing a cryptographic operation requested by the cryptographic client using the cryptographic key; and
sending results of the cryptographic operation to the cryptographic client;
wherein the cryptographic module encapsulating the TPM and the cryptographic service; and wherein the cryptographic module is isolated from any private network connection.
2. The hardware-based method of claim 1 , wherein an application programming interface (API) based on Public Key Cryptographic Standard (PKCS) 11 allows the cryptographic client to communicate with the cryptographic module.
3. The hardware-based method of claim 1 , wherein the method operation of establishing the session with the TPM on behalf of the cryptographic client includes,
authenticating the cryptographic client; and
sending authorization data for the cryptographic client to the TPM.
4. The hardware-based method of claim 3 , wherein the method operation of sending the authorization data for the cryptographic client to the TPM includes,
mapping cryptographic module identity and authentication information of the cryptographic client to TPM identity and authorization data of the cryptographic client.
5. The hardware-based method of claim 4 , wherein the method operation of mapping the cryptographic module identity and authentication information includes,
computing the TPM identity and authorization data from the cryptographic module identity and authentication information using an algorithm; and
providing a capability to configure the mapping using a secure administrative path.
6. The hardware-based method of claim 3 , wherein the method operation of authenticating the cryptographic client includes,
receiving information regarding which platform configuration registers are relevant to the cryptographic client.
7. The hardware-based method of claim 3 , wherein the method operation of authenticating the cryptographic client includes,
receiving authentication information from the cryptographic client.
8. The hardware-based method of claim 1 , wherein the method operation of sending the request includes,
sending to the TPM information regarding which platform configuration registers are relevant to the cryptographic client; and
requesting the TPM to unseal or unbind the cryptographic key.
9. The hardware-based method of claim 1 , further comprising:
maintaining cryptographic application programming interface object attributes for the cryptographic key protected by the TPM.
10. The hardware-based method of claim 1 , further comprising:
creating the cryptographic key; and
sending the created cryptographic key to the TPM to be protected.
11. A hardware cryptographic module including a cryptographic service for limiting exposure of cryptographic keys protected by a trusted platform module (TPM), comprising:
logic for establishing a session with the TPM on behalf of a cryptographic client;
logic for sending a request from the cryptographic client to the TPM to retrieve in plaintext a cryptographic key of the cryptographic client protected by the TPM;
logic for receiving the cryptographic key in plaintext from the TPM;
logic for performing a cryptographic operation requested by the cryptographic client using the cryptographic key; and
logic for sending results of the cryptographic operation to the cryptographic client;
wherein the cryptographic module encapsulates the TPM and the cryptographic service; and wherein the cryptographic module is isolated from any private network connection.
12. The cryptographic module of claim 11 , wherein an application programming interface (API) based on Public Key Cryptographic Standard (PKCS) 11 allows the cryptographic client to communicate with the cryptographic module.
13. The cryptographic module of claim 11 , wherein the logic for establishing the session with the TPM on behalf of the cryptographic client includes,
logic for authenticating the cryptographic client; and
logic for sending authorization data for the cryptographic client to the TPM.
14. The cryptographic module of claim 13 , wherein the logic for sending the authorization data for the cryptographic client to the TPM includes,
logic for mapping cryptographic module identity and authentication information of the cryptographic client to TPM identity and authorization data of the cryptographic client.
15. The cryptographic module of claim 14 , wherein the logic for mapping the cryptographic module identity and authentication information includes,
logic for computing the TPM identity and authorization data from the cryptographic module identity and authentication information using an algorithm; and
logic for providing a capability to configure the mapping using a secure administrative path.
16. The cryptographic module of claim 13 , wherein the logic for authenticating the cryptographic client includes,
logic for receiving information regarding which platform configuration registers are relevant to the cryptographic client.
17. The cryptographic module of claim 13 , wherein the logic for authenticating the cryptographic client includes,
logic for receiving authentication information from the cryptographic client.
18. The cryptographic module of claim 11 , wherein the logic for sending the request includes,
logic for sending to the TPM information regarding which platform configuration registers are relevant to the cryptographic client; and
logic for requesting the TPM to unseal or unbind the cryptographic key.
19. The cryptographic module of claim 11 , further comprising:
logic for creating the cryptographic key; and
logic for sending the created cryptographic key to the TPM to be protected.
20. A system for limiting exposure of cryptographic keys protected by a trusted platform module (TPM), comprising:
a processor;
a cryptographic client executed in the processor;
a hardware cryptographic module in communication with the cryptographic client, the cryptographic module including a cryptographic service, the cryptographic service including:
logic for establishing a session with the TPM on behalf of the cryptographic client, logic for sending a request from the cryptographic client to the TPM to retrieve in plaintext a cryptographic key of the cryptographic client protected by the TPM,
logic for receiving the cryptographic key in plaintext from the TPM,
logic for performing a cryptographic operation requested by the cryptographic client using the cryptographic key, and
logic for sending results of the cryptographic operation to the cryptographic client; and
the TPM in communication with the cryptographic module, wherein the cryptographic module encapsulates the TPM and the cryptographic service; and wherein the cryptographic module is isolated from any private network connection.
21. The system of claim 20 , wherein an application programming interface (API) based on Public Key Cryptographic Standard (PKCS) 11 allows the cryptographic client to communicate with the cryptographic module.
22. The system of claim 20 , wherein the logic for establishing the session with the TPM on behalf of the cryptographic client includes,
logic for authenticating the cryptographic client; and
logic for sending authorization data for the cryptographic client to the TPM.
23. The system of claim 22 , wherein the logic for sending the authorization data for the cryptographic client to the TPM includes, logic for mapping cryptographic module identity and authentication information of the cryptographic client to TPM identity and authorization data of the cryptographic client.
24. The system of claim 23 , wherein the logic for mapping the cryptographic module identity and authentication information includes,
logic for computing the TPM identity and authorization data from the cryptographic module identity and authentication information using an algorithm; and
logic for providing a capability to configure the mapping using a secure administrative path.
25. The system of claim 22 , wherein the logic for authenticating the cryptographic client includes,
logic for receiving information regarding which platform configuration registers are relevant to the cryptographic client.
26. The system of claim 22 , wherein the logic for authenticating the cryptographic client includes,
logic for receiving authentication information from the cryptographic client.
27. The system of claim 20 , wherein the logic for sending the request includes,
logic for sending to the TPM information regarding which platform configuration registers are relevant to the cryptographic client; and
logic for requesting the TPM to unseal or unbind the cryptographic key.
28. The system of claim 20 , wherein the cryptographic service further includes,
logic for creating the cryptographic key; and
logic for sending the created cryptographic key to the TPM to be protected.