Securing stored content for trusted hosts and safe computing environments

A computing system for providing a trusted computing environment for one or more computing components stored on a connectable nonvolatile memory device when said nonvolatile memory device is coupled to said computing system to protect said nonvolatile memory device, wherein said computing system comprises:

• one or more processors capable of executing executable computer program code;
• memory capable of storing said computer program code;
• a Trusted Platform Module component for ensuring that a trusted host computing environment is provided for said one or more computing components stored on said nonvolatile memory device;
• and
• a security monitor for monitoring said trusted host computing environment;
• wherein said Trusted Platform Module component is configured to:
• verify internal integrity of said computing system;
• attest to integrity of said computing system to said nonvolatile memory device when said internal integrity of said computing system is successfully verified;
• prevent a host computing environment from being provided for said one or more computing components when said internal integrity of said computing system is not successfully verified;
• allow a host computing environment to be provided for said one or more computing components when said internal integrity of said computing system is not successfully verified;
• and
• initiate and/or assign said security monitor to monitor said host computing environment when said host computing environment is provided for said one or more computing components;
• wherein said attest to said integrity of said computing system comprises:
• obtaining from secure memory one or more host integrity values for said computing system;
• and
• providing said one or more host integrity values to said nonvolatile memory device;
• and
• wherein said nonvolatile memory device is configured to:
• determine whether said computing system is a trusted host that can provide a trusted computing environment for said one or more computing components by comparing said one or more host integrity values to one or more known host integrity values;
• load and/or facilitate loading of said one or more computing components on said host computing environment when said computing system is a trusted host;
• and
• prevent loading of said one or more computing components on said host computing environment when said computing system is not a trusted host, thereby preventing said one or more computing components from using or being used in said host computing environment.

A computer-implemented method for ensuring that one or more computing components stored on a first device including a trusted device component and a nonvolatile memory are used in a trusted host computing environment provided by a host computing system in response to said first device being connected to said host computing system, said method comprising:

• requiring said host computing system to attest to integrity of a host computing environment to the first device before allowing said one or more computing components to use and/or be used in said host computing environment;
• determining whether said host computing system has successfully attested to said integrity of said host computing environment;
• and
• allowing said one or more computing components to use and/or be used in said host computing environment when said host computing system has successfully attested to said integrity of said host computing environment;
• wherein requiring said host computing system to attest to said integrity of said host computing environment comprises:
• obtaining from secure memory one or more host integrity values for said host computing system;
• and
• providing said one or more host integrity values to said first device;
• and
• wherein said first device is configured to:
• determine whether said host computing system is a trusted host that can provide a trusted computing environment for said one or more computing components by comparing said one or more host integrity values to one or more known host integrity values;
• load and/or facilitate loading of said one or more computing components on said host computing environment when said host computing system is a trusted host;
• and
• prevent loading of said one or more computing components on said host computing environment when said host computing system is not a trusted host, thereby preventing said one or more computing components from using or being used said host computing environment.

A non-transitory computer readable storage medium including computer program code for ensuring that one or more computing components stored on a first device having a nonvolatile memory are used in a safe host computing environment provided by a host computing system, said computer program code comprising:

• computer program code for requiring said host computing system to attest to integrity of said host computing environment to said first device before allowing said one or more computing components to use and/or be used in said host computing environment;
• computer program code for determining whether said host computing system has successfully attested to said integrity of said host computing environment;
• and
• computer program code for allowing said one or more computing components to use and/or be used in said host computing environment when said host computing system has successfully attested to said integrity of said host computing environment;
• wherein requiring said host computing system to attest to said integrity of said host computing environment comprises:
• obtaining from secure memory one or more host integrity values for said host computing system;
• and
• providing said one or more host integrity values to said first device;
• and
• wherein said first device is configured to:
• determine whether said host computing system is a trusted host that can provide a trusted computing environment for said one or more computing components by comparing said one or more host integrity values to one or more known host integrity values;
• load and/or facilitate loading of said one or more computing components on said host computing environment when said host computing system is a trusted host;
• and
• prevent loading of said one or more computing components on said host computing environment when said host computing system is not a trusted host, thereby preventing said one or more computing components from using or being used in said host computing environment.

A device for securing content stored therein for trusted computing systems trusted to provide a safe host computing environment for said content, wherein said device comprises:

• nonvolatile memory capable of storing content;
• and
• a trusted device security system configured to:
• require a host computing system after the device is connected to the host computing system to attest to its integrity to the device before allowing said content stored on said device to be accessed by said host computing system and/or be provided to said host computing system;
• determine whether said host computing system has successfully attested to its integrity;
• and
• allow said content to be accessed by said host computing system and/or provided to said host computing system only when said host computing system has successfully attested to its integrity;
• wherein requiring said host computing system to attest to its integrity comprises:
• obtaining from secure memory one or more host integrity values for said host computing system;
• and
• providing said one or more host integrity values to the device;
• and
• wherein the device is configured to:
• determine whether said host computing system is a trusted host that can provide a trusted computing environment for said one or more computing components by comparing said one or more host integrity values to one or more known host integrity values;
• load and/or facilitate loading of said one or more computing components on a host computing environment provided by said host computing system when said host computing system is a trusted host;
• and
• prevent loading of said one or more computing components on a host computing environment provided by said host computing system when said host computing system is not a trusted host, thereby preventing said one or more computing components from using or being used in said host computing environment.

A computer-implemented method in a host computing system of providing a trusted computing environment for content stored on a device having a nonvolatile memory, said method comprising:

• receiving from said device an attestation challenge to integrity of said host computing system that can provide a host computing environment for said content;
• attesting to said integrity of said host computing environment in response to said attestation challenge from said device, thereby allowing said device to determine and indicate whether it trusts said host computing system as a trusted host that can provide a trusted host computing environment trusted to be safe for said content stored on said device;
• and
• providing said host computing environment for said content stored on said device when said device indicates that it trusts said computing system as a trusted host;
• whereby said device is protected;
• wherein attesting to said integrity of said host computing environment comprises:
• obtaining from secure memory one or more host integrity values for said host computing system;
• and
• providing said one or more host integrity values to said device;
• and
• wherein said device is configured to:
• determine whether said host computing system is a trusted host that can provide a trusted computing environment for said one or more computing components by comparing said one or more host integrity values to one or more known host integrity values;
• load and/or facilitate loading of said one or more computing components on said host computing environment when said host computing system is a trusted host;
• and
• prevent loading of said one or more computing components on said host computing environment when said host computing system is not a trusted host, thereby preventing said one or more computing components from using or being used in said host computing environment.

A computing system for providing a trusted host computing environment trusted to be safe for content stored on an external device having a nonvolatile memory, wherein said computing system comprises:

• a trusted host security system;
• receive from said external device a request to attest to integrity of said computing system as a trusted host that can provide a trusted computing environment trusted to be safe for content stored on said external device;
• attest to said integrity of said computing system to said external device in response to said request from said external device, thereby allowing said external device to determine and indicate whether it trusts said host computing system as a trusted host;
• and
• provide said host computing environment for said content stored on said external device when said external device indicates that it trusts said computing system as a trusted host;
• wherein attesting to said integrity of said computing system comprises:
• obtaining from secure memory one or more host integrity values for said computing system;
• and
• providing said one or more host integrity values to said external device;
• and
• wherein said external device is configured to:
• determine whether said computing system is a trusted host that can provide a trusted computing environment for said one or more computing components by comparing said one or more host integrity values to one or more known host integrity values;
• load and/or facilitate loading of said one or more computing components on said host computing environment when said computing system is a trusted host;
• and
• prevent loading of said one or more computing components on said host computing environment when said computing system is not a trusted host, thereby preventing said one or more computing components from using or being used in said host computing environment.