Externally managed security and validation processing device

An apparatus, comprising:

• an application system, including one or more processing elements and memory;
• and
• a Trusted Platform Module including:
• a cryptographic processing subsystem, including one or more processors and memory, configured to perform security or validation services;
• an application interface configured to communicate with the application system including to provide said security or validation services to the application system;
• and
• a secure management interface configured to communicate information, including configuration information for the cryptographic processing system for performing said security or validation services, with a service profile system external to the apparatus without passing said configuration information through the application system;
• where said configuration information includes providing and withdrawing of one or more credentials, with the application interface and the secure management interface being two distinct physical interfaces of the Trusted Platform Module;
• wherein the application system is configured to use said security or validation services provided by the Trusted Platform Module.

A method, comprising:

• configuring a Trusted Platform Module based on configuration parameters received via a secure management interface integrated in the Trusted Platform Module of an appliance, with the Trusted Platform Module including using one or more processing elements and memory;
• and
• providing security or validation services over a bus, within the appliance and distinct from the secure management interface, by the Trusted Platform Module to an application system within the appliance, with the application system being implemented using hardware distinct from the Trusted Platform Module;
• wherein the bus is directly coupled to the Trusted Platform Module with communication over the bus performed using an application interface integrated in Trusted Platform Module and different than the secure management interface;
• wherein the configuration parameters of the Trusted Platform Module do not traverse the bus nor are accessible by the application system, and the secure management interface and the application interface are two distinct physical interfaces of the Trusted Platform Module.

A networked system, comprising:

• a service profile system;
• a first platform including:
• a first cryptographic system configured to perform security or validation services;
• and a first application system configured to use the first cryptographic system for performing said security or validation services;
• wherein the first cryptographic system includes:
• a first cryptographic processing subsystem, including one or more processors and memory, configured to perform security or validation services;
• a first application interface configured to communicate with the first application system, with said communicating including providing said security or validation services to the first application system;
• and a first secure management interface configured to communicate information, including first configuration information for the first cryptographic processing system for performing said security or validation services, with a service profile system external to the first platform without passing said configuration information through the first application system nor the first application interface, with the first application interface and the first secure management interface being two distinct physical interfaces of the first cryptographic processing subsystem;
• and
• a second platform including:
• a second cryptographic system configured to perform said security or validation services;
• and a second application system configured to use the second cryptographic system for performing said security or validation services;
• wherein the second cryptographic system includes:
• a second cryptographic processing subsystem, including one or more processors and memory, configured to perform security or validation services;
• a second application interface configured to communicate with the second application system, with said communicating including providing said security or validation services to the second application system;
• and a second secure management interface configured to communicate information, including second configuration information for the second cryptographic processing system for performing said security or validation services, with the service profile system external to the second platform without passing said configuration information through the second application system nor the second application interface, with the second application interface and the second secure management interface being two distinct physical interfaces of the second cryptographic processing subsystem;
• wherein the service profile system is configured to provide first configuration information to the first cryptographic system and second configuration information to the second cryptographic system.