System and method for securely provisioning and generating one-time-passwords in a remote device
AssigneeBroadcom Corporation
InventorsMark Buer, Douglas Allen
Life of this patent
Estimating the term…
Abstract
A secure processor such as a TPM generates one-time-passwords used to authenticate a communication device to a service provider. In some embodiments the TPM maintains one-time-password data and performs the one-time-password algorithm within a secure boundary associated with the TPM. In some embodiments the TPM generates one-time-password data structures and associated parent keys and manages the parent keys in the same manner it manages standard TPM keys.
Claims26
An apparatus for securely generating a first one-time password, the apparatus comprising:
- a data memory;
- a secure processor configured to store a shared secret in a binary large object (blob) structure in the data memory and execute a one-time password algorithm to generate the first one-time password using the shared secret, wherein the secure processor is configured to maintain the shared secret within a security boundary of the secure processor and execute the one-time password algorithm within the security boundary, and wherein the secure processor is configured to use a storage root key of the secure processor to encrypt the blob structure;
- and
- a memory manager, external to the secure processor, configured to manage the data memory.
An apparatus for securely generating a first one-time password, the apparatus comprising:
- a data memory;
- a secure processor configured to store a definition for a one-time password algorithm in a binary large object (blob) structure in the data memory and execute the one-time password algorithm in accordance with the definition to generate the first one-time password using a shared secret, wherein the secure processor is configured to maintain the definition and the shared secret within a security boundary of the secure processor and execute the one-time password algorithm within the security boundary of the secure processor, and wherein the secure processor is configured to use a storage root key of the secure processor to encrypt the blob structure;
- and
- a memory manager, external to the secure processor, configured to manage the data memory.
An apparatus for securely generating a first one-time password, the apparatus comprising:
- a data memory;
- and
- a secure processor configured to store both a shared secret and a definition for a one-time password algorithm in a binary large object (blob) structure in the data memory and execute the one-time password algorithm in accordance with the definition to generate the first one-time password using the shared secret, wherein the secure processor is configured to maintain both the shared secret and the definition within a security boundary of the secure processor and execute the one-time password algorithm in the security boundary, and wherein the secure processor is configured to use a storage root key of the secure processor to encrypt the blob structure;
- and
- a memory manager, external to the secure processor, configured to manage the data memory.
Dependencies are inferred from the claim text.