Abstract: A method and system for verifying binding of an initial trusted device to a secured processing system binds an initial device or replacement when no binding information is available from another device in the system. A platform credential is issued only when a valid binding is verified, by sending a proof of binding to a credential provider, such as the manufacturer. The method secures against security breaches that can occur when a device is removed from the system during the binding process. The binding information is generated in the device upon installation and includes system identification information so that at each initialization, upon return of binding information from the system to the device, the device can ensure that it is installed in the proper system and abort operation if the system does not match.

Abstract: A method and system for backup and restore of a context encryption key (CEK) for a trusted device within a secured processing system maintains security of virtualized trusted device contexts, providing for replacement of a trusted device in the field. The CEK is encrypted along with a system identifier by a random number to yield a first result. The first result is again encrypted with a manufacturer public key. The resulting blob is stored along with the random number. To restore, the system sends the blob and the device ID to a server. The server obtains the first result by decrypting with the manufacturer private key, re-encrypts with the device public key and sends the new result back. The system sends the new result to the device along with the associated random number. The device decrypts the new result using its private key and decrypts the CEK using the random number.

Abstract: A method and system for enabling security attestation for a computing device during a return from an S4 sleep state. When the computing device enters into the S4 state following a successful boot up, the attestation log is appended to the TPM tick count and the log is signed (with a security signature). When the device is awaken from S4 state, the BIOS obtains and verifies the log created during the previous boot. The CRTM maintains a set of virtual PCRs and references these virtual PCRs against the log. If the values do not match, the return from S4 state fails and the device is rebooted.

Abstract: A method and system for remotely controlling a hard drive on a local computer. A NIC includes a Port Selector under the control of a NIC processor. Access to the hard drive is selectively afforded to either the local computer or to a remote computer by the Port Selector. Preferably, the method and system permit remote access to a local hard drive even if the local computer is disabled, due to causes including, but not limited to, system failure, lost power or corrupted data on the hard drive.

Abstract: A computer system includes a security subsystem which is able to trustfully track which files or storage areas of a storage device have been altered since a last virus scan. The trusted information can then be used to accelerate scans for undesirable code or data such as viruses and invalid or corrupt registry entries. In the case of viruses, files or storage areas which have been altered are scanned against a super-set of virus definitions. Unaltered files or storage areas are scanned against a subset of virus definitions.

Abstract: A computer system includes a security subsystem which is able to trustfully track which files or storage areas of a storage device have been altered since a last virus scan. The trusted information can then be used to accelerate scans for undesirable code or data such as viruses and invalid or corrupt registry entries. In the case of viruses, files or storage areas which have been altered are scanned against a super-set of virus definitions. Unaltered files or storage areas are scanned against a subset of virus definitions.

Abstract: In a LAN environment, which provides access for multiple users to the Internet, clients (predictors) are selected for identifying Internet content, by their requests, which would be of interest to a larger audience, and then this content is “pushed down” to the caches of an audience of clients. In so selecting content there is a recognition of a shared intellectual direction (e.g. a joint effort) that exists to encourage interest in similar material. This cache “library” is particularly directed to mobile users who work unconnected at times and may lack the time or background to select and pre-load the library.

Abstract: A method and system for ensuring security-compliant creation and certificate generation for endorsement keys of manufactured TPMs. The endorsement keys are generated by the TPM manufacturer and stored within the TPM. The TPM manufacturer also creates a signing key pair and associated signing key certificate. The signing key pair is also stored within the TPM, while the certificate is provided to the OEM's credential server. During the endorsement key (EK) credential process, the TPM generates a signed endorsement key, which comprises the public endorsement key signed with the public signing key. The credential server matches the public signing key of the endorsement key with a public signing key within the received certificate. The EK certificate is generated and inserted into the TPM only when a match is confirmed.

Abstract: A method for repairing a failed network connection between a client system and a network is disclosed. In a first aspect, the method preferably includes collecting real time connectivity information by the client system and utilizing the real time connectivity information by the client system to establish a connection with the network.

Abstract: A method and system for ensuring security-compliant creation and signing of endorsement keys of manufactured TPMs. The endorsement keys are generated for the TPM. The TPM vendor selects an N-byte secret and stores the N-byte secret in the TPM along with the endorsement keys. The secret number cannot be read outside of the TPM. The secret number is also provided to the OEM's credential server. During the endorsement key (EK) credential process, the TPM generates an endorsement key, which comprises both the public key and a hash of the secret and the public key. The credential server matches the hash within the endorsement key with a second hash of the received public key (from the endorsement key) and the vendor provided secret. The EK certificate is generated and inserted into the TPM only when a match is confirmed.

Abstract: An apparatus, system, and method for shared access to secure computing resources are provided. The apparatus, system, and method include a secure computing module. The secure computing module transacts a secure function for two or more computing modules including an excluding computing module configured to exclusively access the secure computing module. The secure computing module identifies a first computing module transacting the secure function and sets the context of the secure computing module to the first computing module context. The first computing module transacts the secure function, but cannot transact the secure function for a second computing module. The second computing module may also transact the secure function, but may not transact the secure function for the first computing module.

Abstract: A computer readable medium and computer system for repairing a failed network connection between a client system and a network is disclosed. In a first aspect, the method preferably includes collecting real time connectivity information by the client system and utilizing the real time connectivity information by the client system to establish a connection with the network. In a second aspect, a computer system coupled to a network includes at least one network adapter for monitoring and collecting real time connectivity information from the network, memory for storing the real time connectivity information, and a processor coupled to the memory and to the at least one network adapter, where the processor is configured to execute program instructions for utilizing the real time connectivity information to repair a failed network connection between the computer system and the network.

Abstract: A computing device includes an application such as Lotus® Notes® requiring log on data to access. A trusted platform module (TPM) can hold the log on data. A software-implemented shim is interposed between the application and security module to appear to function as the application or the security module for providing a means for migrating the token if desired by a user.

Abstract: A client computer is connected via a network to an anti-virus server. A signal from the anti-virus server notifies the client computer that an anti-virus needs to be immediately downloaded from the anti-virus server. The client computer disengages from the network, and re-establishes a link with only the trusted anti-virus server. The anti-virus fix is installed, the client computer re-booted, and the client computer is then allowed to reconnect to the full network. If the client's primary operating system (OS) is infected, a secondary OS in the client computer performs the anti-virus download and execution. The disengagement from the network is performed by applying a filter in a network interface card (NIC) driver by the primary OS, the secondary OS, a service processor (SP), or by a virtual machine manager (VMM), depending on which is available at the client computer.

Abstract: A system and method for enabling multiple levels of access to data on a system includes receiving an identifying metric and processing the metric by salting, hashing, encrypting, or a combination thereof the metric to obtain a table lookup value. The table lookup value is used to index a PW hash table to retrieve a security value. The security value is used to update the contents of a hardware register value such as a selected platform configuration register (PCR) of a Trusted Platform Module (TPM). A selected cryptographic key is then released to the user if the hardware register value matches a predetermined value. In this embodiment, each of a set of security values corresponds to a cryptographic key and each cryptographic key corresponds to one of the levels of access to data.

Abstract: A method and system for downloading software according to an identity of a user. Upon booting up a client computer, the user is automatically directed to a deployment server, which contains a listing of software to which the user is authorized to download and use. The directions to the deployment server are provided by a domain name server, or a domain controller. The software initially loaded onto the client computer is minimal, such that it is easily appended with additional features and programs.

Abstract: When an authenticated wireless computer loses connectivity to a wireless access point of a network and roams to another access point, the wireless computer (e.g., a hypervisor in the computer) determines whether the new access point is authorized for secure communication and if so, releases access to secure data on the network through the new access point.

Abstract: A system for creating a secure wireless channel between a laptop computer and a video projector. The system allows a person, or presenter, to send presentation information wirelessly without having to worry about unwanted eavesdroppers receiving the presentation information. Prior to the presentation, the projector generates a random number and projects the number on a screen. The presenter types the random number into his computer and an encryption program within the computer uses the random number to create a temporary session key. Advantageously, the random number is never transmitted wirelessly. The session key is then used to encrypt the presentation information before the information is wirelessly transmitted to the projector. The projector receives the information and uses the same random number to decrypt the presentation information. After decryption, the presentation information is projected on a screen for presentation to the audience.

Abstract: Trusted platform module (TPM) keys are copied to a floppy diskette or fob that is external to the customer device in which the TPM resides, so that if the keys in TPM are zeroed as a result of, e.g., a malicious denial of service attack, they can be copied back from the diskette or fob.

Abstract: A method, computer program product and system for detecting modifications to code placed in memory by the POST BIOS during a POST operation. The POST BIOS may measure the legacy BIOS code and the code supporting the legacy BIOS during the POST operation and storing that measurement in a secure location. After the system runs in an activated state, the system may enter a sleep state after a period of inactivity. After the system receives an awakening event, the boot block code may measure the legacy BIOS code and the code supporting the legacy BIOS code stored in memory. The boot block code may compare the measurement with the value stored in the secure location by the POST BIOS. If the measurement does not equal the value stored in the secure location, then modification of either the legacy BIOS code and/or code supporting the legacy BIOS code is detected.