US 2026/0303341 A1 · TRANSFORMING HSM PROTECTED KEY TO FW PROTECTED KEY

Abstract

A TEE may store a connection credential (CC). The TEE may receive a request from a secVM for data to open a connection based on the CC with an HSM. The TEE may provide the data to open the connection based on the CC to the secVM. The TEE may derive a KTK using the CC, a host private key, and an HSM public key. The TEE may provide a KTK handle to the secVM. The TEE may receive, from the secVM, the KTK handle and a KTK(K), wherein the plaintext key (K) corresponds to the HSM protected key. The TEE may unwrap the KTK(K) using the KTK referenced by the KTK handle to produce the K. The TEE may wrap the K with a secVM specific host FW wrapping key (FWWK) to create the FWWK(K). The TEE may provide the FWWK(K) to the secVM.

Claims20

Dependent claims

A method for transforming a hardware security module (HSM) protected key (HSM(K)) into host firmware (FW) protected key (FWWK(K)) that is specific to a secure virtual machine (secVM), the method comprising:

storing, by a trusted execution module (TEE), a connection credential (CC);
receiving a request from the secVM for data to open a connection based on the CC with an HSM;
providing, by the TEE, the data to open the connection based on the CC to the secVM;
deriving, by the TEE, a key transport key (KTK) using the CC, a host private key, and an HSM public key;
providing, by the TEE, a KTK handle to the secVM;
receiving, by the TEE and from the secVM, the KTK handle and a wrapped plaintext key (KTK(K)) wrapped using the KTK, wherein the plaintext key (K) corresponds to the HSM protected key;
unwrapping, by the TEE, the KTK(K) using the KTK referenced by the KTK handle to produce the K;
wrapping, by the TEE, the K with a secVM specific host FW wrapping key (FWWK) to create the FWWK(K);
and
providing, by the TEE, the FWWK(K) to the secVM.

7 more elements

A system for transforming a hardware security module (HSM) protected key (HSM(K)) into a host firmware (FW) protected key (FWWK(K)) that is specific to a secure virtual machine (secVM), the system comprising:

a trusted execution environment (TEE) comprising hardware and firmware configured to:
store a connection credential (CC),
provide data to open a connection based on the CC to the secVM,
derive a key transport key (KTK) using the CC, a host private key, and an HSM public key,
provide a KTK handle to the secVM,
receive, from the secVM, the KTK handle and a wrapped plaintext key (KTK(K)) wrapped using the KTK, wherein the plaintext key (K) corresponds to the HSM protected key,
KTK(K) using the KTK referenced by the KTK handle to produce the K,
wrap the K with a secVM specific host FW wrapping key (FWWK) to create the FWWK(K), and
provide the FWWK(K) to the secVM;
and
the secVM configured to:
establish a connection with the HSM using the data to open the connection based on the CC from the TEE;
communicate a request (R) to convert the HSM (K) into a host FW protected key to the HSM via the connection;
in response to the R, receive the KTK(K) from the HSM;
provide the KTK(K) and the KTK handle to the TEE;
and
receive the FWWK(K) from the TEE.

14 more elements

Dependencies are inferred from the claim text.

Transforming hsm protected key to fw protected key

Life of this patent

Transforming hsm protected key to fw protected key

Life of this patent

Abstract

Claims20