# US 2017/0286705 A1 · Tpm 2.0 platform hierarchy authentication after uefi post > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0286705 A1 - Document ID: US20170286705A1 - Status: Published application - Kind: A1 - Application number: 15/480,032 - Filed: 2017-04-05 - Published: 2017-10-05 - Earliest claimed: 2016-04-05 - Assignees: Lenovo Enterprise Solutions (Singapore) Pte. Ltd. - Applicants: LENOVO Enterprise Solutions (Singapore) PTE. LTD. - Inventors: TIAN HE LI; Tang Wen Wei - Web page: https://patentgrep.com/patent/US20170286705A1 ## CPC - G06F 21/44: Program or device authentication - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/45: Structures or tools for the administration of authentication - G06F 21/575: {Secure boot} - G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) - H04L 9/3247: {involving digital signatures} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 2209/127: Trusted platform modules [TPM] - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of accessing a trusted platform module in a computing device is disclosed. The method includes storing a platform authorization key in a memory of the computing device that includes the trusted platform module. The platform authorization key includes permitting access to the trusted platform module. The method includes obtaining a digital signature in response to the computing device requesting access to the trusted platform module. The digital signature is generated using at least a command for configuring the trusted platform module. The method includes verifying the digital signature and allowing retrieval of the platform authorization key from the memory of the computing device in order to access the trusted platform module in response to the digital signature is verified, and denying retrieval of the platform authorization key otherwise. ## Claims ### Claim 1 A method comprising: storing a platform authorization key in a memory of a computing device, the computing device a trusted platform module, the platform authorization key permitting access to the trusted platform module; obtaining a digital signature in response to the computing device requesting access to the trusted platform module, the digital signature generated using at least a command for configuring the trusted platform module; verifying the digital signature; and allowing retrieval of the platform authorization key from the memory of the computing device in order to access the trusted platform module if the digital signature is verified, and denying retrieval of the platform authorization key otherwise. ### Claim 2 (depends on 1) The method of claim 1, wherein storing a platform authorization key in a memory of the computing device comprises storing the platform authorization key in a secure memory of the computing device. ### Claim 3 (depends on 2) The method of claim 2, wherein the secure memory comprises a system management memory component accessible by a processor of the computing device running under a system management mode. ### Claim 4 (depends on 3) The method of claim 3, wherein obtaining a digital signature in response to the computing device requesting access to the trusted platform module comprises: generating a command data package encoding a module identifier of the trusted platform module and the command; and transmitting the command data package to a sign server to obtain the digital signature. ### Claim 5 (depends on 4) The method of claim 4, wherein storing a platform authorization key in a memory of the computing device further comprises storing the module identifier in the memory and generating a command data package encoding a module identifier of the trusted platform module and the command comprises retrieving the module identifier from the memory. ### Claim 6 (depends on 5) The method of claim 5, further comprising verifying the module identifier and allowing retrieval of the platform authorization key further in response to successful verification of the module identifier. ### Claim 7 (depends on 4) The method of claim 4, further comprising verifying the module identifier and allowing retrieval of the platform authorization key further in response to successful verification of the module identifier. ### Claim 8 (depends on 2) The method of claim 2, wherein obtaining a digital signature in response to the computing device requesting access to the trusted platform module comprises: generating a command data package encoding a module identifier of the trusted platform module and the command; and transmitting the command data package to a sign server to obtain the digital signature. ### Claim 9 (depends on 1) The method of claim 1, wherein obtaining a digital signature in response to the computing device requesting access to the trusted platform module comprises: generating a command data package encoding a module identifier of the trusted platform module and the command; and transmitting the command data package to a sign server to obtain the digital signature. ### Claim 10 (depends on 1) The method of claim 1, wherein the memory stores a cryptographic key and verifying the digital signature comprises verifying the digital signature by signing the command data package using the cryptographic key. ### Claim 11 (depends on 1) The method of claim 1, wherein the command data package is encrypted before transmission. ### Claim 12 (depends on 1) The method of claim 1, wherein obtaining a digital signature in response to the computing device requesting access to the trusted platform module is performed by a software application running on the operating system of the computing device. ### Claim 13 (depends on 1) The method of claim 1, further comprising accessing a platform firmware control domain of the trusted platform module using the platform authorization key. ### Claim 14 A program product for authenticating a command for configuring a trusted platform module in a computing device comprising a computer readable storage medium that stores code executable by a processor, the executable code comprising code to perform: generating a request for configuring the trusted platform module; obtaining a digital signature, the digital signature generated using the command; and causing the digital signature to be verified thereby authenticating the command for execution by the trusted platform module in response to successful verification. ### Claim 15 (depends on 14) The program product of claim 14, the executable code further comprising code to perform retrieving a module identifier of the trust platform module stored in a memory of the computing device, said digital signature generated using the module identifier. ### Claim 16 (depends on 15) The program product of claim 15, wherein obtaining a digital signature comprises transmitting the command to a sign server to generate the digital signature. ### Claim 17 (depends on 15) The program product of claim 15, wherein causing the digital signature to be verified comprises causing the digital signature to be verified by the computing device under the system management mode. ### Claim 18 (depends on 14) The program product of claim 14, wherein obtaining a digital signature comprises transmitting the command to a sign server to generate the digital signature. ### Claim 19 (depends on 14) The program product of claim 14, wherein causing the digital signature to be verified comprises causing the digital signature to be verified by the computing device under the system management mode. ### Claim 20 A computing device comprising: a trusted platform module; a processor; a memory component configured to store a platform authorization key for permitting access to the trusted platform module; and a data storage device, the data storage device storing non-transitory instructions operative by the processor to: store the platform authorization key in the memory component; obtain a digital signature in response to the computing device requesting access to the trusted platform module, the digital signature generated using at least a command for configuring the trusted platform module; verify the digital signature; and allow retrieval of the platform authorization key from the memory of the computing device in order to access the trusted platform module in response to the digital signature being verified, and to deny retrieval of the platform authorization key otherwise.