# US 7,467,370 B2 · Apparatus and method for creating a trusted environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,467,370 B2 - Document ID: US7467370B2 - Status: Granted - Kind: B2 - Application number: 11/090,964 - Filed: 2005-03-25 - Published: 2005-10-06 - Granted: 2008-12-16 - Earliest claimed: 2005-03-25 - Assignees: Hewlett-Packard Development Company, L.P. - Inventors: Graeme John Proudler; Boris Balacheff; David Plaquin - Web page: https://patentgrep.com/patent/US7467370B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/575: {Secure boot} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 2221/2105: Dual mode as a secondary aspect - G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy - G06F 2221/2149: Restricted operating environment - G06F 2221/2153: Using hardware token as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer apparatus for creating a trusted environment comprising a trusted device arranged to acquire a first integrity metric to allow determination as to whether the computer apparatus is operating in a trusted manner; a processor arranged to allow execution of a first trust routine and associated first operating environment, and means for restricting the first operating environment access to resources available to the trust routine, wherein the trust routine being arranged to acquire the first integrity metric and a second integrity metric to allow determination as to whether the first operating environment is operating in a trusted manner. ## Claims ### Claim 1 A computer apparatus for creating a trusted environment comprising: a trusted device arranged to acquire a first integrity metric to allow determination as to whether the computer apparatus is operating in a trusted manner, said trusted device being a physical device which binds an identity of the computer apparatus to first reliably measured data by means of said first integrity metric, wherein the trusted device is a tamper resistant device; a software trust routine which binds an identity of at least an operating system environment to second reliably measured data by means of at least a second integrity metric; a processor arranged to allow execution of the trust routine and associated operating environment, and means for restricting access of the operating system environment to resources available to the trust routine, wherein the trust routine is arranged to acquire (i) the first integrity metric of said trusted device as an indicator of whether a user of said computer apparatus should trust that said computer apparatus and (ii) a second integrity metric to allow determination as to whether the operating system environment is operating in a trusted manner consistently with said second reliably measured data; wherein the means for restricting access of the operating environment comprises a control layer of software and an operating system of the operating system environment adapted such that any instructions in the operating system of the operating system environment with potential to affect any environment outside the operating system environment cause a transition to a control layer. ### Claim 2 (depends on 1) A computer apparatus according to claim 1, wherein the trust routine is arranged to incorporate cryptographical functionality for restricting access to data associated with the trust routine. ### Claim 3 (depends on 1) A computer apparatus according to claim 1, wherein the trusted device has an attestation identity and an attestation identity certificate containing attestation by a third party that the trusted device comprises a valid trusted platform module and that the computer apparatus comprises a valid trusted platform. ### Claim 4 (depends on 3) A computer apparatus according to claim 3, wherein the trust routine has an endorsement credential providing attestation by the trusted device that the trust routine comprises a valid virtual trusted platform module and a platform credential providing attestation by the trusted device that the trust routine and the operating environment comprises a valid virtual trusted platform. ### Claim 5 (depends on 4) A computer apparatus according to claim 4, wherein the trust routine has an attestation identity and an attestation identity certificate containing attestation that the trusted device comprises a valid trusted platform module and that the computer apparatus comprises a valid trusted platform. ### Claim 6 (depends on 5) A computer apparatus according to claim 5, wherein the attestation is provided by a third party. ### Claim 7 (depends on 5) A computer apparatus according to claim 5, wherein the attestation is provided by the trusted device. ### Claim 8 (depends on 5) A computer apparatus according to claim 5, wherein the trusted device is arranged on powering down of the computer apparatus to store the endorsement credential, the platform credential and the attestation identity certificate of the trust routine. ### Claim 9 A method for creating a trusted environment in a computer apparatus, the method comprising: acquiring a first integrity metric to allow determination as to whether a computer apparatus has a trusted device wherein the trusted device is a tamper resistant device; binding an identity of the computer apparatus to first reliably measured data by means of said first integrity metric acquired by a trusted device in the computing apparatus, the trusted device having an attestation identity attested by a third party; executing a trust routine and an associated operating system environment; acquiring (i) the first integrity metric of said trusted device as an indicator of whether a user of said computer apparatus should trust that said computer apparatus and (ii) a second integrity metric to allow determination as to whether the operating system environment is operating in a trusted manner consistently with said second reliably measured data; determining as to whether the operating system environment is operating in a trusted manner consistently with said second reliably measured data; and restricting the operating system environment's access to resources available to the trust routine by means of a control layer of software and an operating system of the operating system environment adapted such that any instruction in the operating system of the operating system environment with potential to affect any environment outside the operating system environment cause a transition to a control layer. ### Claim 10 (depends on 9) A method according to claim 9, further comprising the trust routine generating an attestation identity and obtaining an attestation identity certificate using the endorsement credential and the platform credential. ### Claim 11 (depends on 9) A method according to claim 9, further comprising: the trusted device providing the trust routine with an endorsement credential providing attestation by the trusted device that the trust routine comprises a valid virtual trusted platform module and a platform credential providing attestation by the trusted device that the trust routine and the operating system environment comprises a valid virtual trusted platform.