User-controlled management of TPM identities

1. A method for managing identities in a device comprising a trusted platform module, the method comprising

using an identity related command for performing identity related action;

creating a delegation agent;

creating a storage key for secure storage;

creating a delegation for the identity related command;

sealing said delegation using the created storage key to a trustworthy system state;

delivering the sealed delegation to the delegation agent, and

performing the above actions on the same trusted platform module.

2. The method according to claim 1 , comprising using a trusted platform module owner for the management, wherein said storage key and said delegation are generated by the trusted platform module owner.

3. The method according to claim 1 , comprising using a make identity command as said identity related command for making the identity.

4. The method according to claim 1 , comprising using an activate identity command as said identity related command for activating the identity.

5. The method according to claim 1 , said creation of delegation agent comprising

sending a delegate manage command from a trusted platform module owner to the trusted platform module,

sending a reply from the trusted platform module to the trusted platform module owner,

sending a creation of owner command from the trusted platform module owner to the trusted platform module,

creating the delegation agent in the trusted platform module, and

sending a reply from the trusted platform module to the trusted platform module owner.

6. A device comprising a trusted platform module comprising:

a first component of the device configured to use an identity related command for performing identity related action;

a second component of the device configured to create a delegation agent;

a third component of the device configured to create a storage key for secure storage;

a fourth component of the device configured to create a delegation for the identity related command;

a fifth component of the device configured to seal said delegation using the created storage key to a trustworthy system state; and

a sixth component of the device configured to deliver the sealed delegation to the delegation agent.

7. The method according to claim 1 , comprising

revoking a delegation by the trusted platform module owner;

determining other delegations which belong to a same family of delegations than said delegation to be revoked; and

revoking also the other delegations which belong to the same family than said delegation to be revoked.

8. The device comprising the trusted platform module according to claim 6 , an input/output component for communicating with a trusted platform module owner, wherein said storage key and said delegation are received from the trusted platform owner.

9. The device comprising the trusted platform module according to claim 6 , wherein said identity related command is a make identity command for making the identity.

10. The device comprising the trusted platform module according to claim 6 , wherein said identity related command is an activate identity command for activating the identity.

11. The device comprising the trusted platform module according to claim 6 comprising an execution engine, wherein said first component, second component, third component, fourth component and fifth component are implemented in said execution engine.

12. The device comprising the trusted platform module according to claim 8 , wherein said sixth component is implemented in said input/output component.

13. An electronic device comprising a trusted platform module comprising

a storage;

a first component for using an identity related command for performing identity related action;

a second component for creating a delegation agent;

a third component for creating a storage key for secure storage;

a fourth component for creating a delegation for the identity related command;

a fifth component for sealing said delegation using the created storage key to a trustworthy system state; and

a sixth component for delivering the sealed delegation to the delegation agent.

14. The electronic device according to claim 13 comprising a trusted platform module owner.

15. The electronic device according to claim 14 , wherein said trusted platform module owner comprises

a seventh component for generating a symmetric encryption key; and

an eighth component for initiating the creation of said delegation;

wherein said storage key and said delegation are transmitted from the trusted platform module owner to the trusted platform module.

16. The electronic device according to claim 13 , wherein it is a wireless communication device.

17. A system comprising

an electronic device;

a communication network; and

a remote device;

wherein the electronic device comprises a trusted platform module comprising

a storage;

a first component for using an identity related command for performing identity related action;

a second component for creating a delegation agent;

a third component for creating a storage key for secure storage;

a fourth component for creating a delegation for the identity related command;

a fifth component for sealing said delegation using the created storage key to a trustworthy system state; and

a sixth component for delivering the sealed delegation to the delegation agent.

18. A computer program product carrying program code for managing identities in a device comprising a trusted platform module, the program code comprising instructions for

using an identity related command for performing identity related action;

creating a delegation agent;

creating a storage key for secure storage;

creating a delegation for the identity related command;

sealing said delegation using the created storage key to a trustworthy system state; and

delivering the sealed delegation to the delegation agent.

19. A trusted platform module comprising

means for using an identity related command for performing identity related action;

means for creating a delegation agent;

means for creating a storage key for secure storage;

means for creating a delegation for the identity related command;

means for sealing said delegation using the created storage key to a trustworthy system state; and

means for delivering the sealed delegation to the delegation agent.