1. A method for provisioning an endorsement key (EK) certificate for a firmware trusted platform module (fTPM), comprising:
receiving a derived key (DK) from a hardware trusted platform (HWTP), wherein the fTPM is implemented in the HWTP, the DK is derived from a hardware key (HWK) securely stored in the HWTP, the HWK is unique to the HWTP, and the HWK is not available to the fTPM;
generating an endorsement primary seed (EPS) based on the DK;
generating a hashed endorsement primary seed (HEPS) based on a hash of the EPS;
forwarding the HEPS to a provisioning station; and
receiving, from the provisioning station, an EK certificate corresponding to the HEPS.
2. The method of claim 1, further comprising:
generating a public key and private key comprising the EK, wherein the EK certificate has the public key.
3. The method of claim 1, further comprising:
storing the EK certificate in secure nonvolatile memory of the HWTP that is available only to the fTPM.
4. The method of claim 1, wherein the provisioning station has a database of HEPSs and corresponding EK certificates, and wherein each HEPS and corresponding EK certificate is associated with only one particular fTPM.
5. A station, comprising:
means for receiving a derived key (DK) from a hardware trusted platform (HWTP), wherein the means for receiving the DK is implemented in the HWTP, the DK is derived from a hardware key (HWK) securely stored in the HWTP, the HWK is unique to the HWTP, and the HWK is not available to the means for receiving the DK;
means for generating an endorsement primary seed (EPS) based on the DK;
means for generating a hashed endorsement primary seed (HEPS) based on a hash of the EPS;
means for forwarding the HEPS to a provisioning station; and
means for receiving, from the provisioning station, an EK certificate corresponding to the HEPS.
6. The station of claim 5, further comprising:
means for generating a public key and private key comprising the EK, wherein the EK certificate has the public key wherein the deterministic function includes a hash function.
7. The station of claim 5, further comprising:
means for storing the EK certificate in secure nonvolatile memory of the HWTP.
8. A station, comprising:
a processor configured to:
receive a derived key (DK) from a hardware trusted platform (HWTP), wherein the DK is derived from a hardware key (HWK) securely stored in the HWTP, the HWK is unique to the HWTP, and the HWK is not available to a firmware trusted platform module (fTPM);
generate an endorsement primary seed (EPS) based on the DK;
generate a hashed endorsement primary seed (HEPS) based on a hash of the EPS;
forward the HEPS to a provisioning station; and
receive, from the provisioning station, an EK certificate corresponding to the HEPS.
9. The station of claim 8, wherein the fTPM generates a public key and private key comprising the EK, and the EK certificate has the public key.
10. The station of claim 8, wherein the fTPM stores the EK certificate in secure nonvolatile memory of the HWTP that is available only to the fTPM.
11. The station of claim 8, wherein the provisioning station has a database of HEPSs and corresponding EK certificates, and wherein each HEPS and corresponding EK certificate is associated with only one particular fTPM.
12. A computer program product, comprising:
computer-readable medium, comprising:
code for causing a computer to receive a derived key (DK) from a hardware trusted platform (HWTP), wherein a firmware trusted platform module (fTPM) is implemented in the HWTP, the DK is derived from a hardware key (HWK) securely stored in the HWTP, the HWK is unique to the HWTP, and the HWK is not available to the fTPM;
code for causing a computer to generate an endorsement primary seed (EPS) based on the DK;
code for causing a computer to generate a hashed endorsement primary seed (HEPS) based on a hash of the EPS;
code for causing a computer to forward the HEPS to a provisioning station; and
code for causing a computer to receive an EK certificate corresponding to the HEPS from the provisioning station.
13. The computer program product of claim 12, further comprising:
code for causing a computer to generate a public key and private key comprising the EK, wherein the EK certificate has the public key wherein the deterministic function includes a hash function.
14. The computer program product of claim 12, further comprising:
code for causing a computer to store the EK certificate in secure nonvolatile memory of the HWTP that is available only to the fTPM.
15. A method for generating an endorsement key (EK) certificate and a hashed endorsement primary seed (HEPS) at a secure facility, comprising:
receiving an encrypted derived key EDK for a particular hardware trusted platform (HWTP), wherein the derived key (DK) is derived from a hardware key HWK that is unique to the HWTP;
decrypting the EDK using a private key for the secure facility to generate the DK;
generating an endorsement primary seed (EPS) based on the DK;
generating the hashed endorsement primary seed (HEPS) based on a hash of the EPS;
generating the endorsement key (EK) based on the EPS;
signing a public portion of the EK to generate the EK certificate; and
associating the HEPS and the EK certificate in a database.
16. The method of claim 15, wherein the size of the EPS is fixed and depends on an algorithm used to generate the EK based on the EPS.
17. The method of claim 15, wherein the EK certificate is for a firmware trusted platform module (fTPM) that is associated with the HWTP with the unique HWK.
18. The method of claim 17, further comprising:
sending the database to at least one original equipment manufacture (OEM) for provisioning the fTPM with the EK certificate.
19. The method of claim 15, wherein:
the EK comprises a public key and a private key; and
the EK certificate includes the public key.
20. A station, comprising:
means for receiving an encrypted derived key EDK for a particular hardware trusted platform (HWTP), wherein the derived key (DK) is derived from a hardware key HWK that is unique to the HWTP;
means for decrypting the EDK using a private key for a secure facility to generate the DK;
means for generating an endorsement primary seed (EPS) based on the DK;
means for generating a hashed endorsement primary seed (HEPS) based on a hash of the EPS;
means for generating an endorsement key (EK) based on the EPS;
means for signing a public portion of the EK to generate the EK certificate; and
means for associating the HEPS and the EK certificate in a database.
21. The station of claim 20, wherein the size of the EPS is fixed and depends on an algorithm used to generate the EK based on the EPS.
22. The station of claim 20, wherein the EK certificate is for a firmware trusted platform module (fTPM) that is associated with the HWTP with the unique HWK.
23. The station of claim 22, further comprising:
means for sending the database to at least one original equipment manufacture (OEM) for provisioning the fTPM with the EK certificate.
24. The station of claim 20, wherein:
the EK comprises a public key and a private key; and
the EK certificate includes the public key.
25. A station, comprising:
a processor configured to:
receive an encrypted derived key EDK for a hardware trusted platform (HWTP), wherein the derived key (DK) is derived from a hardware key HWK that is unique to the HWTP;
decrypt the EDK using a private key for a secure facility to generate the DK;
generate an endorsement primary seed (EPS) based on the DK;
generate a hashed endorsement primary seed (HEPS) based on a hash of the EPS;
generate an endorsement key (EK) based on the EPS;
sign a public portion of the EK to generate the EK certificate; and
associate the HEPS and the EK certificate in a database.
26. The station of claim 25, wherein the size of the EPS is fixed and depends on an algorithm used to generate the EK based on the EPS.
27. The station of claim 25, wherein the EK certificate is for a firmware trusted platform module (fTPM) that is associated with the HWTP with the unique HWK.
28. The station of claim 27, wherein the processor is further configured to:
send the database to at least one original equipment manufacture (OEM) for provisioning the fTPM with the EK certificate.
29. The station of claim 25, wherein:
the EK comprises a public key and a private key; and
the EK certificate includes the public key.
30. A computer program product, comprising:
computer-readable medium, comprising:
code for causing a computer to receive an encrypted derived key EDK for a hardware trusted platform (HWTP), wherein the derived key (DK) is derived from a hardware key HWK that is unique to the HWTP;
code for causing a computer to decrypt the EDK using a private key for a secure facility to generate the DK;
code for causing a computer to generate an endorsement primary seed (EPS) based on the DK;
code for causing a computer to generate a hashed endorsement primary seed (HEPS) based on a hash of the EPS;
code for causing a computer to sign a public portion of the EK to generate the EK certificate; and
code for causing a computer to associate the HEPS and the EK certificate in a database.
31. The computer program product of claim 30, wherein the size of the EPS is fixed and depends on an algorithm used to generate the EK based on the EPS.
32. The computer program product of claim 30, wherein the EK certificate is for a firmware trusted platform module (fTPM) that is associated with the HWTP with the unique HWK.
33. The computer program product of claim 32, further comprising:
code for causing a computer to send the database to at least one original equipment manufacture (OEM) for provisioning the fTPM with the EK certificate.
34. The computer program product of claim 30, wherein:
the EK comprises a public key and a private key; and
the EK certificate includes the public key.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. Inorganic nanofiltration membrane containing:
a multichannel monolithic ceramic support composed of a mixture of Al2O3 and of TiO2 and exhibiting a mean equivalent pore diameter Ds of between 1 and 20 m,
a microfiltration membrane separating layer situated at the surface of the channels and composed of sintered particles of metal oxide(s), the mean equivalent pore diameter Do of which before sintering is between 0.1 and 3.0 m, according to a DsDo ratio such that 0.3<DsDo<200, the said microfiltration membrane layer exhibiting a mean equivalent pore diameter Dm of between 0.05 and 1.5 m,
an ultrafiltration membrane separating layer situated on the said microfiltration membrane layer and composed of sintered particles of metal oxide(s), the mean equivalent pore diameter Du of which before sintering is between 2 and 100 nm, according to a DmDu ratio such that 0.5<DmDu<750,
a nanofiltration membrane separating layer situated on the said ultrafiltration membrane layer and composed of sintered particles of metal oxide(s), the mean equivalent pore diameter Dn of which before sintering is between 0.5 and 1.5 nm,
the said inorganic nanofiltration membrane exhibiting a cutoff threshold of between 100 and 2000 daltons.
2. Membrane according to claim 1, characterized in that the said monolithic support exhibits a porosity greater than 30%.
3. Membrane according to either of claims 1 and 2, characterized in that the said monolithic support is a ceramic of Al2O3 grains coated at least in part with TiO2 grains, the TiO2(Al2O3TiO2) ratio by weight being between 1 and 75%.
4. Membrane according to one of claims 1 to 3, characterized in that the metal oxide(s) of the microfiltration membrane layer is (are) alumina, zirconia or, preferably, titanium oxide.
5. Membrane according to one of claims 1 to 4, characterized in that the metal oxide(s) of the ultrafiltration membrane layer is (are) titanium oxide or, preferably, zirconia.
6. Membrane according to one of claims 1 to 5, characterized in that the metal oxide of the ultrafiltration membrane layer is zirconia, the said layer exhibiting a cutoff threshold of between 10 and 300 kD, for example 15 kD.
7. Membrane according to one of claims 1 to 6, characterized in that the nanofiltration membrane layer is zirconia.
8. Membrane according to one of claims 1 to 7, characterized in that the nanofiltration membrane layer is obtained by a process of sol-gel type preferably comprising a hydrolysis in alcoholic medium.
9. Membrane according to claim 8, characterized in that the nanofiltration membrane layer is a zirconia layer obtained by a process of sol-gel type comprising:
the formation of a sol by hydrolysis in alcoholic medium of a zirconium alkoxide precursor, preferably in the presence of a complexing ligand;
the deposition of the sol on the ultrafiltration membrane layer, preferably by bringing the ultrafiltration membrane layer and the sol prepared above into contact by filling the channels, to which sol has been added beforehand an organic binder;
the conversion of the sol into a gel by drying;
finally, a heat treatment.
10. Use of the membrane according to one of claims 1 to 9 in a process for refining cane sugar.
11. Use of the membrane according to one of claims 1 to 9 for the treatment of the saline effluents resulting from the regeneration of the ion-exchange resins employed in the refining of cane sugar.