# US 2025/0094601 A1 · Virtualizing secure vault of data processing unit for secure hardware security module for hosts > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094601 A1 - Document ID: US20250094601A1 - Status: Published application - Kind: A1 - Application number: 18/369,070 - Filed: 2023-09-15 - Published: 2025-03-20 - Earliest claimed: 2023-09-15 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Chakradhar Kar; Sri Goli - Web page: https://patentgrep.com/patent/US20250094601A1 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/602: {Providing cryptographic facilities or services} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 21/72: in cryptographic circuits - G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method of securing and virtualizing firmware trusted platform modules (TPMs) for virtualizing a hardware security module (HSM) for a host within a network fabric is provided. The system and method include operably coupling a set of components associated with a host comprising a data processing unit (DPU) secure vault and a firmware trusted platform module (TPM). The firmware TPM is configured as a virtual firmware TPM. The DPU secure vault secures the virtual firmware TPM into one or more virtual firmware TPMs based on one or more partitions configured with the DPU secure vault. A virtual TPM manager communicatively coupled to the DPU secure vault manages one or more virtual TPMs for hosting a set of Virtual Machines (VMs) or Containers. ## Claims ### Claim 1 A method of securing and virtualizing firmware trusted platform modules (TPMs) within a network fabric, comprising: operably coupling a set of components associated with a host comprising a data processing unit (DPU) secure vault and a firmware TPM; configuring the firmware TPM as a virtual firmware TPM; securing, by the DPU secure vault, the virtual firmware TPM into one or more virtual firmware TPMs based on one or more partitions configured with the DPU secure vault; and managing, by a virtual TPM manager communicatively coupled to the DPU secure vault, the one or more virtual TPMs for hosting a set of Virtual Machines (VMs). ### Claim 2 (depends on 1) The method of claim 1, further comprising: configuring a hypervisor to communicate with at least one virtual TPM driver and with the virtual TPM manager for hosting one or more virtual machines (VMs). ### Claim 3 (depends on 2) The method of claim 2, wherein each VM is configured with a separate virtual TPM driver. ### Claim 4 (depends on 3) The method of claim 3, wherein the hypervisor is configured as a virtual TPM proxy. ### Claim 5 (depends on 1) The method of claim 1, wherein the DPU secure vault is partitioned using an eFuse for separately securing one or more domains, and wherein firmware TPM is configured for use as a built-in HSM. ### Claim 6 (depends on 5) The method of claim 5, wherein at least one secure firmware TPM is virtualized for exposure to at least one VM configured with the host. ### Claim 7 (depends on 6) The method of claim 6, wherein the firmware TPM is configured to store private keys for encryption and to protect at least one VM at launch and throughout a life cycle of the at least one VM. ### Claim 8 (depends on 1) The method of claim 1, further comprising: in response to initializing of the firmware TPM, enabling one or more sub-firmware components associated with one or more virtual firmware TPMs which are managed by the virtual TPM manager. ### Claim 9 A non-transitory computer-readable medium storing instructions that, when executed, cause a processor to perform operations, comprising: operably coupling a set of components associated with a host comprising a data processing unit (DPU) secure vault and a firmware trusted platform module (TPM); configuring the firmware TPM as a virtual firmware TPM; securing, by the DPU secure vault of the DPU, the virtual firmware TPM into one or more virtual firmware TPMs based on one or more partitions configured with the DPU secure vault; and managing, by a virtual TPM manager communicatively coupled to the DPU secure vault, the one or more virtual TPMs for hosting a set of containers. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9, the operations further comprising: configuring the virtual TPM manager in one or more DPU cores to act as a proxy for hosting one or more containers. ### Claim 11 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein each container is configured with a separate virtual TPM driver configured with the virtual TPM manager that acts as the proxy for each container. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the DPU secure vault is partitioned using an eFuse for separately securing one or more domains, and wherein the firmware TPM is configured for use as a built-in HSM. ### Claim 13 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein at least one secure firmware TPM is virtualized for exposure to at least one container configured with the host. ### Claim 14 (depends on 9) The non-transitory computer-readable medium of claim 9, further comprising: in response to initializing of the firmware TPM associated with the TPM, enabling one or more sub-firmware components associated with one or more virtual firmware TPMs which are managed by the virtual TPM manager. ### Claim 15 A system for virtualizing a firmware Trusted Platform Module (TPM) comprising: at least one data processing unit (DPU) secure vault; and a firmware TPM; wherein the DPU secure vault is partitioned into one or more security domains, wherein the firmware TPM is virtualized into at least one virtual firmware TPM, and wherein the one or more security domains of the DPU secure vault are configured to secure, the at least one firmware TPM is controlled by a virtual TPM manager. ### Claim 16 (depends on 15) The system of claim 15, wherein one or more secure firmware TPMs are virtualized into one or more virtual sub-firmware TPMs. ### Claim 17 (depends on 15) The system of claim 15, further comprising: one or more sets of hardware components that are disjointly configured to each other wherein each set of hardware components is configured to implement a respective secure domain. ### Claim 18 (depends on 15) The system of claim 15, further comprising: a hypervisor configured to communicate with at least one virtual TPM driver and with the virtual TPM manager to host one or more virtual machines (VMs). ### Claim 19 (depends on 16) The system of claim 16, wherein each VM is configured with a separate virtual TPM driver. ### Claim 20 (depends on 15) The system of claim 15, wherein the DPU secure vault is partitioned using an eFuse to separately secure one or more virtual firmware TPMs and wherein the firmware TPM is configured for use as a built-in HSM.