Trusted platform module swarm

A method for protecting the integrity of a server using a trusted platform module (TPM) swarm, the method comprising:

• initializing a plurality of trusted platform modules (TPMs) within a server, wherein the plurality of TPMs are physically connected to a processor of the server;
• reading a unique identifier corresponding to each TPM of the plurality of TPMs to determine a system state;
• writing the system state to platform configuration registers (PCRs) of each TPM of the plurality of TPMs;
• loading a sealed private owner key part into each TPM;
• determining, by the plurality of TPMs, if a predetermined number of unique identifiers have been processed by validating a value of the PCRs to meet an owner key policy;
• unsealing the private owner key part in each TPM where the value of the PCRs meets the owner key policy;
• reconstructing, in response to the owner key policy being met, the private owner key from the private owner key part in each TPM;
• loading secret data into each TPM meeting the owner key policy, wherein the secret data was sealed using an access policy signed with the private owner key;
• validating a software version and a hardware serial number associated with the TPM according to the access policy;
• and
• unsealing, in response to the access policy being met, the secret data.

A computing system comprising:

• a plurality of trusted platform modules (TPMs);
• and
• one or more processors physically connected to the plurality of TPMs, wherein the one or more processors are configured to perform a method, the method comprising:
• reading a unique identifier corresponding to each TPM of the plurality of TPMs to determine a system state;
• writing the system state to platform configuration registers (PCRs) for each of the plurality of TPMs;
• loading a sealed private owner key part into each TPM, wherein the TPM is configured to perform a method, the method comprising:
• validating the value of the PCRs to meet an owner key policy;
• and
• unsealing the private owner key part in the TPM where the value of the PCRs meets the owner key policy;
• reconstructing, in response to the owner key policy being met, the private owner key from the private owner key part of each TPM meeting the owner key policy;
• loading secret data into each TPM meeting the owner key policy, wherein the secret data was sealed using an access policy signed with the private owner key;
• validating a software version and a hardware serial number associated with each TPM according to the access policy;
• and
• unsealing, in response to the access policy being met, the secret data.