초록 ▼

Methods, apparatus and machine readable medium are described for creating and using protected key blobs that require a particular portable token be present before use of the key or keys of the protected key blob is granted. Such protected key blobs may be used to establish a level of trust between a

Methods, apparatus and machine readable medium are described for creating and using protected key blobs that require a particular portable token be present before use of the key or keys of the protected key blob is granted. Such protected key blobs may be used to establish a level of trust between a local user and the computing device.

대표청구항 ▼

What is claimed is: 1. A method comprising requesting a fixed token to create a sealed key blob comprising both a first key pair and first usage authorization data, wherein knowledge of the first usage authorization data is required in order to use a private key of the first key pair, and requestin

What is claimed is: 1. A method comprising requesting a fixed token to create a sealed key blob comprising both a first key pair and first usage authorization data, wherein knowledge of the first usage authorization data is required in order to use a private key of the first key pair, and requesting a portable token to create a protected key blob, where the protected key blob comprises the sealed key blob and second usage authorization data, wherein knowledge of the second usage authorization data is required in order to obtain the sealed key blob from the protected key blob. 2. The method of claim 1 comprising encrypting the private key of the first key pair and the first usage authorization data with the fixed token and a public key of the fixed token, and creating the sealed key blob with the encrypted private key and the encrypted first usage authorization data. 3. The method of claim 2 comprising encrypting the sealed key blob and the second usage authorization data with the portable token and a public key of the portable token, and creating the protected key blob with the encrypted sealed key blob and the encrypted second usage authorization data. 4. The method of claim 3 comprising providing the portable token with a request for the sealed key blob of the protected key blob, the request providing proof of possessing the second usage authorization data, decrypting the encrypted sealed key blob and the encrypted second usage authorization data of the protected key blob with the portable token using a private key of the portable token, and receiving the sealed key blob from the portable token in response to the portable token determining that the proof of possessing the second usage authorization data was valid. 5. The method of claim 4 further comprising scrubbing the protected key blob and associated data from the portable token in response to determining that the proof of possessing the second usage authorization data was invalid. 6. The method of claim 5 further comprising deactivating the portable token in response to determining that the proof of possessing the second usage authorization data was invalid. 7. The method of claim 4 comprising providing the fixed token with a request to load the first key pair of the sealed key blob, the request providing proof of possessing the first usage authorization data, decrypting the encrypted private key and the encrypted first usage authorization data of the sealed key blob with the fixed token using a private key of the fixed token, and receiving a key handle to the first key pair of the sealed key blob in response to the fixed token determining that the proof of possessing the first usage authorization data was valid. 8. The method of claim 7 further comprising scrubbing the sealed key blob and associated data from the fixed token in response to determining that the proof of possessing the first usage authorization data was invalid. 9. The method of claim 8 further comprising deactivating the portable token in response to determining that the proof of possessing the first usage authorization data was invalid. 10. The method of claim 1 comprising requesting the portable token to return the sealed key blob from the protected key blob, providing the portable token with proof of possessing the second usage authorization data, and obtaining the sealed key blob from the portable token only if the proof of possessing the second usage authorization data was valid. 11. The method of claim 10 comprising requesting the fixed token to load the first key pair from the sealed key blob, and providing the fixed token with proof of possessing the first usage authorization data, and obtaining a key handle to the first key pair stored in the fixed token only if the proof of possessing the first usage authorization data was valid. 12. The method of claim 1 comprising directing a request to the portable token to return the sealed key blob from the protected key blob, the request comprising proof of possessing the second usage authorization data, and obtaining the sealed key blob from the portable token only if the portable token was present and the proof of possessing the second usage authorization data was valid. 13. The method of claim 12 comprising directing a request to the fixed token to load the first key pair from the sealed key blob, the request comprising proof of possessing the first usage authorization data, and obtaining a key handle to the first key pair stored in the fixed token only if the proof of possessing the first usage authorization data was valid and an environment associated with the request satisfies criteria specified by the sealed key blob. 14. A computing device, comprising a fixed token comprising a first processing unit and first protected storage, the first processing unit to load a first key pair of a sealed key blob into the first protected storage in response to determining that a first authentication code has a predetermined relationship to first usage authorization data of the sealed key blob, a portable token comprising a second processing unit and second protected storage, the second processing unit to return the sealed key blob from a protected key blob in response to determining that a second authentication code has a predetermined relationship to second usage authorization data of the protected key blob, a portable token interface that enables the portable token to be coupled to and removed from the computing device, a processor to provide the portable token with a request for the sealed key blob, wherein the request that comprises the protected key blob and the second authentication code, and to provide the fixed token with a request to load the first key pair, wherein the request comprises the sealed key blob and the first authentication code. 15. The computing device of claim 14 wherein the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and the processor is to determine that that a user associated with the portable token is present in response to receiving the first key handle. 16. The computing device of claim 14 wherein the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and the processor is to determine that a user associated with the portable token is present in response to successfully decrypting a secret using the first key pair identified by the first key handle. 17. The computing device of claim 14 wherein the first protected storage of the fixed token comprises registers for storing metrics of an environment, the processor is to provide the fixed token with a plurality of metrics of the environment, and the first processing is to load the first key pair into the first protected storage only if the metrics stored in the registers indicate that the environment satisfies criteria of the sealed key blob. 18. The computing device of claim 17 wherein the fixed token is to provide a first, key handle to the first key pair in response to successfully loading the first key pair, and the processor is to determine that the environment satisfies the criteria specified by the sealed key blob in response to receiving the first key handle. 19. The computing device of claim 17 wherein the fixed token is to provide a first key handle to the first key pair in response to successfully loading the first key pair, and the processor is to determine that the environment satisfies the criteria specified by the sealed key blob in response to successfully decrypting a secret using the first key pair identified by the first key handle. 20. The computing device of claim 17 wherein the first processing unit is to scrub the sealed key blob and any associated data from the fixed token in response to determining that the environment does not satisfy the criteria of the sealed key blob. 21. The computing device of claim 14 wherein the fixed token comprises a key pair used to create the sealed key blob, the first processing unit only loads the first key pair of the sealed key blob in response to a request received via a first session established for the key pair used to create the sealed key blob, and the processor is to establish the first session prior to providing the fixed token with the request to load the first key pair. 22. The computing device of claim 21 wherein the portable token comprises a key pair used to create the protected key blob, the second processing unit is to only load the first key pair of the sealed key blob in response to a request received via a second session established for the key pair used to create the protected key blob, and the processor is to establish the second session prior to providing the portable token with the request to for the sealed key blob.