Abstract: Various embodiments include methods and devices for implementing protection of data by preventing non-authorized firmware modification on a computing device. Embodiments may include measuring, by a software program, an image of a firmware update producing a measurement of the image of the firmware update, modifying a version identifier of a prior installed firmware producing a version identifier of the firmware update, applying a root key generation algorithm to the measurement of the image of the firmware update, the version identifier of the firmware update, and an enroll identity credential, generating an enroll encryption root key as an output of the root key generation algorithm, applying a seed key encryption algorithm to the enroll encryption root key and an enroll encryption seed key, and generating a sealed encryption seed key as an output of the seed key encryption algorithm.

Abstract: Techniques for operating a transmitter are provided. An example method for transmitting protected digital content from a transmitter to a receiver according to those techniques includes determining whether the receiver is compliant with a version of a content protection protocol, sending, to the receiver, a content type indicator indicating that the digital content comprises a first content type regardless of whether the digital content actually comprises the first content type responsive to the receiver being compliant with the version of the content protection protocol, and transmitting the digital content to the receiver.

Abstract: Techniques for operating a receiver are provided. An example method according to these techniques includes receiving a content type indicator from a transmitter indicating that a content stream from the transmitter comprises a first content type, performing a first integrity check on the content stream by decrypting content from the content stream based in part on the content type indicator, incrementing a counter responsive to the first integrity check failing due to a mismatch between the content type indicator and the content of the content stream, performing a second integrity check on the content stream by decrypting the content from the content stream based in part on a second content type responsive to the counter exceeding a threshold, and decrypting the content stream based in part on the second integrity check being successful.

Abstract: Aspects may relate to a device to provide trusted time assurance. The device may comprise: a time clock; an interface; and a processor coupled to the interface. The processor may be configured to operate a trusted execution environment to: receive a request through the interface from a server to send current time; receive a nonce from the server through the interface; sign the current time from the time clock, the nonce received from the server, and device information with an attestation key; transmit the signed current time, nonce, and device information to the server through the interface. The device may then receive an application, a service, or data and a defined period of time from the server through the interface to be available for use for the defined period of time measured by the trusted execution environment.

Abstract: Methods, apparatus, and computer program products for generating a derivative key for an execution environment (EE) are described. An example of a method includes obtaining a device key by a key derivation circuit, obtaining a context string by the key derivation circuit from a one-time writable bit register (OWBR), generating the derivative key for a current EE by the key derivation circuit based on the device key and on the context string from the OWBR.

Abstract: Methods, apparatus, and computer program products for generating a derivative key for an execution environment (EE) are described. An example of a method includes obtaining a device key by a key derivation circuit, obtaining a context string by the key derivation circuit from a one-time writable bit register (OWBR), generating the derivative key for a current EE by the key derivation circuit based on the device key and on the context string from the OWBR.

Abstract: Disclosed is a method for provisioning an endorsement key (EK) certificate for a firmware trusted platform module (fTPM). In the method, the fTPM receives a derived key (DK) from a hardware trusted platform (HWTP). The fTPM is implemented in the HWTP, the DK is derived from a hardware key (HWK) securely stored in the HWTP, the HWK is unique to the HWTP, and the HWK is not available to the fTPM. The fTPM generates an endorsement primary seed (EPS) based on the DK, and generates a hashed endorsement primary seed (HEPS) based on a hash of the EPS. The fTPM forwards the HEPS to a provisioning station, and receives, from the provisioning station, an EK certificate corresponding to the HEPS.

Abstract: Disclosed is a method for provisioning an endorsement key (EK) certificate for a firmware trusted platform module (fTPM). In the method, the fTPM receives a derived key (DK) from a hardware trusted platform (HWTP). The fTPM is implemented in the HWTP, the DK is derived from a hardware key (HWK) securely stored in the HWTP, the HWK is unique to the HWTP, and the HWK is not available to the fTPM. The fTPM generates an endorsement primary seed (EPS) based on the DK, and generates a hashed endorsement primary seed (HEPS) based on a hash of the EPS. The fTPM forwards the HEPS to a provisioning station, and receives, from the provisioning station, an EK certificate corresponding to the HEPS.