# US 2018/0025183 A1 · Management of Authenticated Variables > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0025183 A1 - Document ID: US20180025183A1 - Status: Published application - Kind: A1 - Application number: 15/709,047 - Filed: 2017-09-19 - Published: 2018-01-25 - Earliest claimed: 2014-06-27 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Vincent J. Zimmer; Nicholas J. Adams; Giri P. Mudusuru; Lee G. Rosenbaum; Michael A. Rothman - Web page: https://patentgrep.com/patent/US20180025183A1 ## CPC - G06F 21/72: in cryptographic circuits - G06F 21/575: {Secure boot} - G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - G06F 2221/034: Test or assess a computer or a system - H04L 2209/12: Details relating to cryptographic hardware or logic circuitry - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An embodiment includes an apparatus comprising: an out-of-band cryptoprocessor coupled to secure non-volatile storage; and at least one storage medium having firmware instructions stored thereon for causing, during runtime and after an operating system for the apparatus has booted, the cryptoprocessor to (a) store a key within the secure non-volatile storage, (b) sign an object with the key, while the key is within the cryptoprocessor, to produce a signature, and (c) verify the signature. Other embodiments are described herein. ## Claims ### Claim 1 An apparatus comprising: a processor; a cryptoprocessor that is out-of-band with the processor; and at least one storage medium storing firmware instructions, wherein the firmware instructions are to cause the cryptoprocessor to verify a signature of an object, wherein the at least one storage medium is non-transitory. ### Claim 2 (depends on 1) The apparatus of claim 1, further comprising: a secure non-volatile storage to store a key, wherein the firmware instructions are to cause the cryptoprocessor to generate the signature of the object using the key stored in the secure non-volatile storage. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the secure non-volatile storage is included in the cryptoprocessor. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the key is a private key, wherein the private key is associated with a public key, and wherein the firmware instructions are to cause the cryptoprocessor to communicate the public key outside of the cryptoprocessor while retaining the private key within the cryptoprocessor. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the object includes a Unified Extensible Firmware Interface (UEFI) variable, the firmware includes platform initialization (PI) firmware, and the cryptoprocessor is a trusted product module (TPM) implemented in at least one of firmware and hardware. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the firmware instructions are to cause the cryptoprocessor to create the object within the cryptoprocessor. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the firmware instructions are to cause the cryptoprocessor to create the key within the cryptoprocessor. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the firmware instructions are to cause the cryptoprocessor to execute instructions during pre-boot operations of the apparatus. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the firmware instructions are to access the cryptoprocessor in response to a determination that an operating system is not accessing the cryptoprocessor. ### Claim 10 A method comprising: executing firmware instructions stored in at least one storage medium of a device; and responsive to an execution of the firmware instructions: accessing a cryptoprocessor of the device, wherein the cryptoprocessor is out-of-band with a general purpose processor of the device; and causing the cryptoprocessor to verify a signature of an object, wherein the signature is based on a key. ### Claim 11 (depends on 10) The method of claim 10, further comprising, responsive to the execution of the firmware instructions: storing the key in a secure non-volatile storage included in the cryptoprocessor; and generating, by the cryptoprocessor, the signature of the object using the key stored in the secure non-volatile storage. ### Claim 12 (depends on 11) The method of claim 11, wherein the key is a private key, wherein the private key is associated with a public key, wherein the method further comprises, responsive to the execution of the firmware instructions: communicating, by the cryptoprocessor, the public key outside of the cryptoprocessor while retaining the private key within the cryptoprocessor. ### Claim 13 (depends on 10) The method of claim 10, further comprising, responsive to the execution of the firmware instructions: creating, by the cryptoprocessor, the key and the object within the cryptoprocessor. ### Claim 14 (depends on 10) The method of claim 10, further comprising, responsive to the execution of the firmware instructions: causing the cryptoprocessor to execute instructions during pre-boot operations of the device. ### Claim 15 (depends on 10) The method of claim 10, further comprising: determining whether an operating system is accessing the cryptoprocessor; and in response to a determination that an operating system is not accessing the cryptoprocessor, accessing the cryptoprocessor by the firmware instructions. ### Claim 16 At least one non-transitory storage medium having firmware instructions stored thereon, the firmware instructions executable to: access a cryptoprocessor of a device, wherein the cryptoprocessor is out-of-band with a general purpose processor of the device; and cause the cryptoprocessor to generate a signature of an object using a key. ### Claim 17 (depends on 16) The at least one non-transitory storage medium of claim 16, the firmware instructions executable to: cause the cryptoprocessor to validate the signature of the object. ### Claim 18 (depends on 16) The at least one non-transitory storage medium of claim 16, the firmware instructions executable to: cause the cryptoprocessor to store the key in a secure non-volatile storage of the cryptoprocessor. ### Claim 19 (depends on 18) The at least one non-transitory storage medium of claim 18, wherein the key is a private key, wherein the private key is associated with a public key, wherein the firmware instructions are executable to: cause the cryptoprocessor to communicate the public key outside of the cryptoprocessor while retaining the private key within the cryptoprocessor. ### Claim 20 (depends on 16) The at least one non-transitory storage medium of claim 16, the firmware instructions executable to: access the cryptoprocessor in response to a determination that an operating system is not accessing the cryptoprocessor.