Back to results
US 11,030,280 B2Granted
Hardware based identities for software modules
AssigneeMicrosoft Technology Licensing, LLC
InventorsEustace Ngwa Asanghanwa, Arjmand Samuel
Life of this patent
Estimating the term…
Abstract
Creating a certificate for a software module. A method includes obtaining a public key for a software module. The method includes obtaining a public key for a software module implemented on a hardware device. The method further includes creating a certificate using the public key by signing the public key using a hardware protected key and hardware protected compute elements. The hardware protected key is protected by a protected portion of the hardware device, and not accessible outside of the protected portion of the hardware device.
Claims15
A computer system comprising:
- one or more processors;
- and
- one or more computer-readable media having stored thereon instructions for executing a computer process comprising:
- obtaining a public key for a first software module implemented on a hardware device, the first software module comprising a Module Management Agent (MMA) software module;
- and
- providing the public key to a hardware secure module (HSM) of the hardware device;
- receiving a signature from the HSM, the signature being based on the public key and further based on a hardware protected key for the MMA software module, wherein the hardware protected key for the MMA software module is stored within the HSM at a location inaccessible to read entities external to the HSM;
- creating a certificate for the first software module using the public key, the signature, and the hardware protected key for the MMA software module;
- obtaining a different public key for a second software module;
- and
- using the certificate as a verifiable identify for the first software module when the first software module is communicating with the second software module.
8 more elements
A method comprising:
- obtaining a public key for a first software module implemented on a hardware device, the first software module including a Module Management Agent (MMA) software module;
- providing the public key to a hardware secure module (HSM) of the hardware device;
- receiving a signature from the HSM, the signature being based on the public key and further based on a hardware protected key for the MMA software module, wherein the hardware protected key for the MMA is stored within the HSM at a location inaccessible to read entities external to the HSM;
- creating a certificate for the first software module using the public key, the signature, and the hardware protected key for the MMA software module;
- obtaining a different public key for a second software module;
- and
- using the certificate as a verifiable identify for the first software module when the first software module is communicating with the second software module.
4 more elements
A hardware device comprising:
- a hardware secure module (HSM);
- a hardware protected secret store, wherein the hardware protected secret store comprises a hardware protected key, and wherein the hardware protected secret store is stored within the hardware secure module (HSM) at a location inaccessible to read entities external to the HSM;
- and
- hardware protected compute elements in the HSM comprising secure storage and secure processors, wherein the hardware protected compute elements are configured to execute a computer processing comprising:
- obtaining a public key for a first software module implemented on the hardware device, the first software module comprising a Module Management Agent (MMA) software module, wherein the hardware protected key is a hardware protected key for the MMA;
- providing the public key to the hardware secure module (HSM) of the hardware device;
- receiving a signature from the HSM, the signature being based on the public key and further based on the hardware protected key for the MMA;
- and
- creating a first certificate for the first software module using the public key, the signature, and the hardware protected key for the MMA software module;
- obtaining a different public key for a second software module;
- and
- using the first certificate as a verifiable identify for the first software module when the first software module is communicating with the second software module.
9 more elements
Dependencies are inferred from the claim text.