# US 7,613,921 B2 · Method and apparatus for remotely provisioning software-based security coprocessors > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,613,921 B2 - Document ID: US7613921B2 - Status: Granted - Kind: B2 - Application number: 11/171,880 - Filed: 2005-06-29 - Published: 2006-11-16 - Granted: 2009-11-03 - Earliest claimed: 2005-05-13 - Assignees: Intel Corporation - Inventors: Vincent R. Scaralata - Web page: https://patentgrep.com/patent/US7613921B2 ## CPC - G06F 21/72: in cryptographic circuits - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/602: {Providing cryptographic facilities or services} - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45583: {Memory management, e.g. access or allocation} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A virtual security coprocessor is created in a first processing system. The virtual security coprocessor is then transferred to a second processing system, for use by the second processing system. For instance, the second processing system may use the virtual security coprocessor to provide attestation for the second processing system. In an alternative embodiment, a virtual security coprocessor from a first processing system is received at a second processing system. After receiving the virtual security coprocessor from the first processing system, the second processing system uses the virtual security coprocessor. Other embodiments are described and claimed. ## Claims ### Claim 1 A method comprising: creating a virtual security coprocessor in a first processing system; generating, in the first processing system, an endorsement credential for the virtual security coprocessor, and signing the endorsement credential in the first processing system; and transferring the virtual security coprocessor to a second processing system for use by the second processing system, and transmitting the endorsement credential to the second processing system. ### Claim 2 A method comprising: receiving, at a first processing system, a virtual security coprocessor from a second processing system and an endorsement credential created by the second processing system for the virtual security coprocessor; and after receiving the virtual security coprocessor from the second processing system, using the virtual security coprocessor to provide at least one operation from the group of operations consisting of: providing attestation for the first processing system; and encrypting data for the first processing system. ### Claim 3 (depends on 2) A method according to claim 2, wherein the first processing system comprises a security coprocessor implemented in hardware, the method comprising: using the security coprocessor implemented in hardware to support the virtual security coprocessor. ### Claim 4 An apparatus comprising: a storage medium; and instructions stored in the storage medium, wherein the instructions, when executed by a first processing system, cause the first processing system to perform operations comprising: creating a virtual security coprocessor in the first processing system; generating, in the first processing system, an endorsement credential for the virtual security coprocessor, and signing the endorsement credential in the first processing system; and transferring the virtual security coprocessor to a second processing system for use by the second processing system, and transmitting the endorsement credential to the second processing system. ### Claim 5 An apparatus comprising: a storage medium; and instructions stored in the storage medium, wherein the instructions, when executed by a first processing system, cause the first processing system to perform operations comprising: receiving a virtual security coprocessor from a second processing system and an endorsement credential created by the second processing system for the virtual security coprocessor; and after receiving the virtual security coprocessor from the second processing system, using the virtual security coprocessor to provide at least one operation from the group of operations consisting of: providing attestation for the first processing system; and encrypting data for the first processing system. ### Claim 6 (depends on 5) An apparatus according to claim 5, wherein the first processing system comprises a security coprocessor implemented in hardware, and the instructions cause the first processing system to perform operations comprising: using the security coprocessor implemented in hardware to support the virtual security coprocessor. ### Claim 7 A processing system comprising: a processor; a storage medium communicatively coupled to the processor; and instructions stored in the storage medium, wherein the instructions, when executed by a first processing system, cause the first processing system to perform operations comprising: creating a virtual security coprocessor in the first processing system; generating, in the first processing system, an endorsement credential for the virtual security coprocessor, and signing the endorsement credential in the first processing system; and transferring the virtual security coprocessor to a second processing system for use by the second processing system, and transmitting the endorsement credential to the second processing system. ### Claim 8 A processing system comprising: a processor; a storage medium communicatively coupled to the processor; and instructions stored in the storage medium, wherein the instructions, when executed by a first processing system, cause the first processing system to perform operations comprising: receiving, at the first processing system, a virtual security coprocessor from a second processing system and an endorsement credential created by the second processing system for the virtual security coprocessor; and after receiving the virtual security coprocessor from the second processing system, using the virtual security coprocessor to provide at least one operation from the group of operations consisting of: providing attestation for the first processing system; and encrypting data for the first processing system. ### Claim 9 (depends on 8) A processing system according to claim 8, wherein: The first processing system further comprises a security coprocessor, implemented in hardware, and communicatively coupled to the processor; and the first processing system to use the security coprocessor implemented in hardware to support the virtual security coprocessor. ### Claim 10 (depends on 8) A processing system according to claim 8, wherein: the first processing system further comprises a physical trusted platform module (TPM) communicatively coupled to the processor; and the first processing system to use the TPM to support the virtual security coprocessor. ### Claim 11 (depends on 1) The method of claim 1, further comprising using the virtual security coprocessor in the second processing system to provide attestation for the second processing system. ### Claim 12 (depends on 1) The method of claim 1, further comprising using the virtual security coprocessor in the second processing system to encrypt data for the second processing system. ### Claim 13 (depends on 4) The apparatus of claim 4, wherein the instructions further cause the first processing system to request the second processing system to provide a nonce. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the instructions further cause the first processing system to encrypt a state of the virtual security coprocessor and the nonce to a storage key of the second processing system. ### Claim 15 (depends on 7) The processing system of claim 7, wherein the instructions further cause the first processing system to request the second processing system to provide a nonce. ### Claim 16 (depends on 15) The processing system of claim 15, wherein the instructions further cause the first processing system to encrypt a state of the virtual security coprocessor and the nonce to a storage key of the second processing system.