An information security system is disclosed having a considerably simplified access control infrastructure. The number of secrets in a computer system domain is reduced to a minimum, yet individual users may still be identified and access to applications may still be individually controlled. The trusted entity in each of a plurality of platforms (100, 200, 202, 203) of the computer system may store an identity secret of the platform (100, 200, 202, 203) and may be trusted to use that secret in conjunction with an information label only when the platform (100, 200, 202, 203) is running the correct software to provide and/or take part in a particular service associated with that information label.

One reason why commercial enterprises are reluctant to embrace information security systems is that they require a complex on-line infrastructure, which is relatively difficult and expensive to maintain. A second reason is that applications that use security must be individually written to take advantage of security. This makes them more expensive to buy and costly to maintain. A third reason is that it is relatively simple for an operator to make a mistake and compromise security mechanisms.
Those skilled in the art of information security will be aware of the use of secrets as authorization and authentication information. Possession of a secret is taken as proof of the right to use or provide a service. In some systems, some secrets (such as passwords) are confidentially communicated between the user of a service and a provider of a service. Preferably, however, possession of a secret is proven without disclosing that secret. There are several such methods, generally involving the use of the secret as an input to an algorithm whose inputs are statistically impossible to deduce from its output. Challenge-and-response protocols involving hash algorithms (such as SHA-1) and symmetric or asymmetric cryptographic algorithms (such as 3DES or RSA) may be used for such purposes.
Such systems require the distribution of secrets between the parties. The distribution of secrets such as passwords and symmetric keys requires the use of channels that maintain the confidentiality of those secrets, e.g. a secure socket layer (SSL) protocol. There are numerous such distribution systems. Such secrets may be distributed using confidential channels provided by existing secrets (leading to a hierarchy of secrets). Such secrets may also be distributed through confidential "out-of-band" channels. Those skilled in the art of information security will be also aware of Public Key Infrastructures (PKI). Such systems are trust-based methods that distribute the public keys of asymmetric cryptographic algorithms. Preferably, one entity generates an asymmetric key pair and keeps secret the private key of that pair. The entity then uses a PKI to distribute the public key of that key pair. The PKI issues "digital certificates", which contain a statement of the public key of an entity and the label of that entity, all signed by the (secret) private key of some Certification Authority (CA). The public key of the CA is well publicized. So, when a third party receives a certificate, it can use the CA's public key to verify the contents of the certificate. When a certificate has been verified by such a method, the third party accepts that the stated public key belongs to the stated entity, because the third party trusts the CA. The third party can therefore use the public key from the certificate to verify the authenticity and integrity of data signed by the stated entity.
Some static PKI infrastructure is usually necessary, in order to identify entities. The complexity of the infrastructure rapidly increases, however, when multiple secrets have to be distributed and stored for each user/application pair, and especially when secrets have to be dynamically verified because each platform cannot store all access control information.
Existing security systems tend to have some security functions in the platform and some in individual applications. A platform might have shared security resources, such as a cryptographic accelerator, or a cryptographic library, or a store for secrets, or an SSL engine, for example. A security aware application might use those shared resources when performing its security functions. Those security functions include provision of confidentiality, integrity, authentication, non-repudiation, and so on. Such shared services and individual functions are well known to those skilled in the art of information security. Often each application requires its own security secrets. Duplication of security services is in conflict with preferred security practice, where the number of mechanisms that deal with security should be as small as possible and as tested as possible, to minimize the risk of bad design or poor construction.
The management of access to a service becomes increasingly difficult with increasing complexity and size of service. Each customer (user) is provided with authorization data to permit access to such a service. Methods of user authentication are well known to those skilled in the art. Such user authentication data may take the form of a simple password, biometric measurements, or (preferably) cryptographic keys, for example. Each computer platform providing the service must be capable of recognizing such authorized users, in order that the service is restricted to bona fide users. Each such computer platform must also be provided with authorization data that permits users to validate the service, in order that users may be convinced that a service is bona fide. Each such computer platform providing the service must also be provided with authorization data that permits each such computer platform to identify and validate each other such computer platform. This is necessary in order that a service can be distributed over multiple bona fide computer platforms. Such distribution is a commercial advantage because it enables greater reliability and more economically efficient load distribution. Clearly, a great deal of authorization information can be required. The need to distribute and manage this on-line authorization information is a significant drawback of existing methods of identification and verification at entry points to an electronic service. One such system is the well-known "Kerberos" system [see, for example: "Kerberos: an authentication service for computer networks", Neuman and T'so, IEEE Comms, September 1994]. This is a gatekeeper mechanism, used to verify access rights based upon long term secrets, and to distribute temporary secrets that provide short term access to resources.
Neither the commercial customer nor the commercial domain always benefit from the conventional security model described above; using secrets to identify a user, registering with the domain, obtaining a token to use the computing engine or service, and submitting the token in order to actually use the resource. The extra complexity costs both time and money, both of which are disadvantageous.
Those skilled in the art of information security will be also aware of the Trusted Computing Platform Alliance (TCPA) (details of which can be found at www.trustedpc.org and also in WO 00/48063, the contents of which are incorporated herein by reference). This industry body has defined the concept of a Trusted Computing Platform. Essentially, two roots-of-trust are built into each platform. One is the root-of-trust-for measurement, which is starts the process of measuring the software environment in the platform. The second is the root-of-trust-for-reporting, which stores and reports summaries of the measurements made by the root-of-trust-for measurement. The root-of-trust-for-reporting is usually called the Trusted Platform Module (TPM), because it is typically implemented as a single integrated circuit. The TPM protects its methods from interference. The TPM protects its secrets from observation and interference. The TPM contains several cryptographic functions, such as random number generation, key generation, encryption, and decryption. By means of a TCPA protocol, a TPM may obtain multiple anonymous trusted cryptographic identities. A CA chosen by the owner of that TPM grants each such trusted identity. Each such trusted identity can be used to cryptographically prove that certain data came from a trustworthy computing engine (the TPM). The TCPA specification referred to above also describes how an integrity response may be evoked from a platform. An integrity response provides evidence of the software state of that platform by reporting (amongst other things) the summaries of the measurements made by the root-of-trust-for measurement. An integrity response signed by a trusted identity is sufficient to prove that the integrity response from a platform can be believed (the private key belonging to the trusted identity is used to sign the integrity response from the platform containing that identity). The recipient of the integrity response must compare the response with a set of measurement values that should be obtained if the platform is in a trusted state. Methods of obtaining such comparative values are described in the TCPA specification referred to above, and will not be described here. It should be noted, however, that a signed statement of the summaries of the measurements made by the root-of-trust-for-measurement in a correctly operating platform is a convenient method to permit simple verification of an integrity response. The TCPA system relies upon a PKI; the system relies upon several certificates issued by several entities, including the manufacturer of the TPM, the manufacturer of the platform, a conformance laboratory [such as one that deals with conformance to the international "Common Criteria" security description], and the manufacturers of components of the platform (including the software in the platform). The TCPA specification discloses a method of measurement of the software state of a platform and the summarizing of that state as a number of Platform Configuration Registers (PCRs) inside a Trusted Platform Module, which is much better physically protected against interference and prying than is the rest of the platform. The TCPA specification describes a pair of commands called TPM_SEAL and TPM_UNSEAL. A TPM that receives the command TPM_SEAL (plaintext, pcr-index, pcr-value) encrypts the plaintext data along with the pcr-index and pcr-value. A TPM that receives the command TPM_UNSEAL (ciphertext) internally decrypts the ciphertext data to obtain the data [plaintext, pcr-index, pcr-value]. At this stage, the plaintext data is hidden inside the TPM. The TPM exports the plaintext data out of the TPM only if the current pcr-value of pcr-index in the platform matches the decrypted value of [pcr-index, pcr-value]. Hence data is revealed by the TPM only if the platform is currently in the state that was stated when the plaintext data was encrypted.
Existing security services use conventional methods to control and provide security services. Secrets are is distributed and loaded using key distribution systems and the facilities of a PKI. Each platform providing a service has its own secrets, and other such platforms use those secrets to identify and verify platforms that provide the service. Each user of a service is provided with secrets that enable it to access the service. Each platform providing a service needs proof, either individually or via another platform, that a prospective user actually has the secrets that prove the right to access the service. When TCPA Trusted Platforms have been deployed, existing services may be amended so that: (1) platforms may be identified by trusted identities, (2) platforms may verify each other's integrity before providing the service, using the service, or cooperating to provide the service.
A previous patent application (Trusted States) PCT/GB00/03613, the contents of which are incorporated herein by reference describes how a platform may exist in a variety of different states, each state optimised to ensure the validity of some electronic service. The integrity response provided by the platform serves to prove to a prospective user that the platform is in a particular state that is suitable to safely provide that service. Those skilled in the art of providing an electronic service will be aware that a service may be provided by a single platform or may be provided by one platform cooperating with at least one other platform, and different services may execute upon the same platform. A previous patent application (Performing a service on a computer) GB 00 20441.2, also incorporated herein by reference, describes the use of enhanced compartments to provide specification and isolation and audit of such services.
Existing security systems follow the military model, where users and computing engines have rights and privileges to perform certain actions and use certain data. There are disadvantages in that such a model is not always necessary for a commercial domain wishing to provide a computing resource. The domain might be providing a conventional electronic service, or might be providing just a computing engine upon which a user can execute his own data and applications. Indeed, the domain needs to provide such an engine service for itself, in order to partition its platforms as a set of arbitrary computing engines. An important concern of many such domains is that a user will pay for the resources consumed. This may be true even when the user belongs to the domain, because corporate accounting models often charge individual projects or individual departments for use of corporate resources. Of course, it is still possible that a domain needs just to confirm that the "customer" or user has the right to use a service and/or resource, and that no payment is required. This conventional security model is still appropriate for an employee of a company or a citizen of a country whose ID permits access to certain resources, as a matter of right.
A given user wanting a computing resource may wish to use applications and data provided by that resource, or may wish to obtain access to a virgin computing engine, or a computing engine executing some limited amount of software such as an operating system but few or no applications. The user may partition his processing requirements according to level of security/privacy, and distribute a task amongst domains according to those security/privacy criteria. Non-sensitive computing threads may be executed on arbitrary platforms such as individual workstations connected to a corporate network or to the Internet, rather than executed by a Data Center. A user (or even a domain) could take advantage of unused computing resources in one time zone when computing resources in another time zone are stretched. A private individual could execute sensitive data on his own platform and have a reciprocal agreement to execute insensitive data on an arbitrary platform belonging to a private individual who is asleep, and whose platform is idle. A roaming private individual could execute sensitive data on his own Personal Digital Appliance (PDA) and have an agreement to execute less sensitive data on an arbitrary platform in the logically local environment. A multinational corporation could use its worldwide desktop workstation resources for corporate processing when employees are not at their desks. The same non-sensitive thread could be executed on more than one platform, and the results compared, to provide increased confidence in the results obtained from arbitrary platforms.
It follows that there is an advantage in reducing the complexity of a traditional security system, even if the absolute level of security is less than that provided by a conventional security system. The basic platform should provide security, in order that applications can be ignorant of security. There should be rapid access to computing resources and services, without having to use gatekeeper authorization mechanisms.
The Invention
According to the invention a computer system comprises at least one platform containing a trusted entity and at least one label, the trusted entity being operable such that use of the or each label by the trusted entity is dependent on the presence or potential presence of a predetermined software state in the or each platform.
The at least one label may be adapted to indicate or advertise the presence or potential presence of the predetermined software state in the or each platform.
The presence of the predetermined software state may be an indication that the trusted entity is capable of providing a particular computing resource or service. The potential presence of the predetermined software state may be an indication that the trusted entity is capable of providing a particular computing resource or service.
The or each label may describe a service which can potentially be offered by the at least one platform.
The computer system advantageously provides a trusted apparatus which is operable to indicate when a particular computing resource or service may be available from a trusted entity.
The predetermined software state may include a particular configuration of computing resources and/or software described directly or indirectly by the or each label.
Labels in at least two platforms may be the same where the labels describe essentially the same configuration of computing resources and/or software. The labels in the two platforms may be essentially the same where the labels describe a particular configuration of computing resources and/or software related to the same distributed computing engine or distributed service.
The or each label may be widely published and one form of published label may be signed using a secret known to the platform. One form of published label may include descriptive information and is signed by a trusted entity. One form of published label may include descriptive information about the configuration of computing resources and/or software associated with the label and is signed by a trusted entity. One form of published label may include an offer to provide a configuration of computing resources and/or software associated with the label. The or each label may be signed using a secret known to the platform.
Reception by the platform of a cryptographic challenge incorporating one of said at least one labels from a second platform may cause the platform to determine whether the computing resources and/or software associated with said label can be provided by the platform.
Proof of possession of a label by a platform may be sufficient for another entity to cooperate with that platform for the purposes of using and/or providing the computing resources and/or software described by that label.
The computer system may be operable such that the right to use the computing resources and/or software described by the label depends on provision of one or more of:                proof of possession of a platform secret,        proof of possession of a user secret,        presentation of a non-secret authorisation value associated with a user whose use is known to be indicative of a request from the user,        presentation of a non-secret authorisation value associated with a user whose use is known to be indicative of agreement by the user to tender payment.
At least one platform may contain trustworthy integrated mandatory enforcement controls and security capabilities that transparently provide security and privacy to applications that are at least substantially ignorant of security and privacy, and preferably requires permission from at least one other platform to permit the flow of information to the resources allocated to said other platform from the resources allocated to the first-mentioned platform.
According to another aspect of the invention a computer system comprises at least one platform containing a trusted entity and at least one label, the trusted entity being operable such that use of the or each label by the trusted entity is dependent on the presence or potential presence of a predetermined software state in the or each platform, wherein the at least one label is adapted to indicate or advertise the presence or potential presence of the predetermined software state in the or each platform, and wherein the or each label is widely published and describes a service or resource which can potentially be offered by the at least one platform.
According to a further aspect of the invention a computer system comprises at least one platform containing a trusted entity and at least one label, wherein the label describes a predetermined software state in the or each platform and wherein the trusted entity is operable to use the label if the predetermined software state is described by the label is present or potentially present in the or each platform.
The trusted entity may sign the at least one label with a secret known to the platform only if the predetermined software state is present or potentially present in the at least one platform.
The at least one label may publicly disclose the predetermined software state in order to indicate the availability of a service or the resource on the or each platform.
According to the invention a computer system comprises at least one platform containing a trusted entity and at least one application, wherein the platform is operable to perform security functions for the computer system.
The platform preferably performs substantially all security functions and the applications preferably perform substantially no security functions.
The platform may be operable to apply mandatory security controls on communications from the computer system. Updates of security functions may be broadcast across the system to the at least one platform.
According to the invention a method for a computer system to signal the potential availability of a computing resource comprises providing a platform containing a trusted entity with at least one label, wherein the label is used by the platform only when a predetermined software state is present in the platform.
The label may describe the computing resource or service, which is defined by the predetermined software state.
An information security system may have a level of overall security slightly less than that of a conventional security system, depending on exact circumstances, but it is anticipated that the level of security is adequate for commercial purposes.
One aspect of the invention concerns the simplification of access control infrastructure that must be provided by the domain. The number of secrets in the domain is reduced to a minimum, yet individual users may still be identified and access to applications may still be individually controlled. At the same time, secure applications may be maintained across the domain by a broadcast mechanism, without having to deal with each platform as an individual. A mechanism of payment for resources is an integral part of the system. The requirement for a domain's on-line Public Key Infrastructure (PKI) is reduced, or even eliminated.
Another aspect is the transfer of all security mechanisms into the platform, away from applications. This simplifies applications and makes them less of a risk, because they are no longer required to properly implement security functions. This also makes it possible to apply security to legacy applications that are not aware of security. This also reduces risks, because the platform can provide mandatory security controls and because there is a reduction in the number of people required to design and build security mechanisms and controls.
This invention also recognizes that a major requirement of a user of such domains is that a user's data and applications on a computing engine do not "leak" to other users. If a user chooses to cache applications and information with a domain (for whatever length of time), the domain needs to provide access controls to those applications and data, such that only the user or his agent can use the applications and data.
This invention discloses an architecture that potentially eliminates the need for applications to be aware of security; minimizes the number of secrets in the platform (just one secret per platform); minimizes the number of secrets that identify the user (just one secret/value per user); permits all secrets to be installed at manufacture or initialisation, yet enables separate access controls for separate users to separate services or domains; enables the broadcast of maintenance information over all platforms in the domain, irrespective of platform identity; and does not necessarily need an on-line PKI infrastructure.
One main aspect of the invention is that a trusted entity in each of a plurality of platforms stores an identity secret of the platform and can be trusted to use that secret in conjunction with a label only when the platform is running the correct software to provide and/or take part in a particular service associated with that label.
A second aspect of the invention is the publication of global labels describing services and computing engines. Each global label preferably serves to identify the properties of an engine and/or service executing on that engine, and is preferably signed by a platform hosting the engine/service. Such labels and their interpretations may be published on a database, or on the World Wide Web, and may be available within a domain or globally. Such labels and their interpretations are preferably digitally signed by a trusted entity, preferably the domain itself. A platform preferably publishes the global labels of the engines and/or services that it has the potential to provide, even if the platform is not currently providing or in a position to provide that engine and/or service.
A third aspect of the invention is that a platform determines whether an engine and/or a service associated with a label can actually be provided only when a platform is requested to provide a particular engine and/or service associated with a label.
A fourth aspect of the invention is that a platform may provide and/or use an engine and/or a service associated with another platform based solely upon recognition of a label owned by that other platform.
A fifth main aspect of the invention is that a domain need not provide its own on-line PKI to validate users using secrets. Instead, the domain may either use an external on-line service that may use true secrets or may use quasi-secrets. Preferably the on-line service is one that can be used for user identification and more preferably the on-line PKI is one that can be used for on-line credit verification and payment.
A sixth aspect of the invention is that each of a plurality of platforms has an integral security service that provides security/privacy functions that drastically reduce (if not eliminate) the level of security functions that individual applications on the platforms must incorporate. The security service preferably enables an operator and/or a user to set the policy governing the level of security and privacy that will be provided for the engines and/or services that execute on the platform.
Each platform may be considered to have one or more cryptographic identities that are published only if the platform is in a certain state. Each cryptographic identity preferably consists of a different global label and the same shared secret for use in cryptographic algorithms. The identity and the mechanism that publishes global labels are preferably trusted, so that a third party believes that a platform is in the appropriate state to provide a particular engine and/or service when the platform exports that identity. Each such state preferably corresponds to an environment where mandatory controls are applied to a user's data and applications. These controls preferably isolate the user's data and applications as and when necessary. Such states may also correspond to services executing in such an environment.
All identities publicizing the same engine and/or service preferably have the same label, across all platforms, at least within the domain. This permits easy identification of platforms that can cooperate to provide those engines and/or services. A label may however be differentiated to indicate that a platform is executing the client portion of a client-server process, the server portion of a client-server process, or a peer portion of a peer-peer process, for example. As mentioned previously, all identities belonging to the same platform preferably use the same cryptographic secret, but have different labels. If there are privacy concerns, some or all identities belonging to the same platform could have different cryptographic secrets, but this increases complexity. Identities belonging to different platforms and/or systems must preferably have cryptographic secrets that are (statistically) different. Identities could be obtained via the TCPA protocol for obtaining platform identities, but are preferably preloaded or maintained directly by the domain itself.
Each identity secret preferably has an associated credential in the form of a digital certificate. That credential preferably attests to the name and/or nature of the platform containing the secret. That credential is preferably digitally signed by an entity that is considered trustworthy by third parties that wish to interact with the platform containing the identity secret. Preferably that trusted entity is the domain itself.
Each label preferably has an associated credential in the form of a digital certificate. That credential preferably attests to the name and/or nature of the engine and/or service described by that label. That credential is preferably digitally signed by an entity that is considered trustworthy by third parties that wish to interact with platforms providing that engine and/or secret. Preferably that trusted entity is the domain itself.
When a platform asserts that it can provide an engine and/or service, it preferably uses its identity secret to sign advertising data comprising at least the label describing that engine and/or service and an indication that the data is an advert. A platform posts or retracts appropriate adverts to/from a web site (for example), preferably according to whether it has the potential to provide the engine and/or services that are associated with that label. Each advert is preferably associated with an address (such as an IP address), to enable communications with the platform. The existence of such advertising does not imply that the platform will provide that service; only that it has the potential to provide that service. On receipt of a request, a platform preferably assesses its internal state, which has been measured in a reliable manner, preferably using TCPA mechanisms. The platform (strictly, the platform's TPM) preferably uses its identity secret to sign confirmation of the availability of an engine and/or service only if the platform's state is the correct state to provide the engine and/or service. Such confirmation data preferably includes at least the label describing that engine and/or service and an indication that the data is a confirmation.
Preferably both the user and the host use platforms whose architecture complies with this invention. Otherwise, one platform can provide or consume the service, but two platforms cannot cooperate, and/or cooperate to provide a distributed service to a third platform, in the manner envisaged in this invention.
If a user wishes to use a particular engine/service, the user or his agent preferably browses Web sites and searches for adverts of that particular type of engine and/or service. When the user finds a suitable label, it verifies the associated credentials and decides whether to trust the attestation. If the user trusts the attestation sufficiently for the task in hand, he preferably contacts the indicated platform in the indicated domain, states the target engine/service, presents any payment information or identification information that may be necessary, and presents any relevant policy information. A domain platform may decide whether or not to grant access based upon the user's credentials. Alternatively, the domain may grant access irrespective of the user's credentials.
After two platforms have agreed to cooperate, they preferably use conventional cryptographic methods such as the Diffie-Hellman (DH) protocol or the Secure Socket Layer (SSL) to provide confidentiality of communication between them. So the long-term identity secret inside the platform provides identification of the platform, while less permanent secrets created by the DH protocol or SSL, preferably provide confidentiality for the platform and/or for the engines and services provided by the platform. The user preferably sends to the domain a policy statement that states the security and privacy conditions that apply to the data and applications that will be executed by the domain. Such a policy will often indicate just that defaults are to be used. Such defaults are preferably that that all user data and applications are to be isolated from that of other users while they are on the host. The user may also intend to cache certain data and applications at the domain's platform. Then the host must isolate and store and protect such data and applications, such that only the user can access them, based upon the user's identity or the identity of the user's platform. These protection mechanisms do not require the involvement of the user. The domain may have trusted facilities that provide the necessary protection, probably but not necessarily involving cryptographic processes and the storage of secrets known only to the domain and its agents. The default policy may be that the user can gain access to those data and applications if the user's platform has the correct identity-label and the user presents the same generic payment/access information.
In one preferred method of use, domains are not aware of the identity of the actual user or users. Platforms constituting a distributed service or distributed computing engine in a domain will preferably cooperate with other platforms having a global label describing that distributed service or computing engine and signed by the domain. This model is particularly applicable to a group of platforms configured to belong to a particular set, such as a computing center for a domain.
In another preferred method of use, domains may require the presence of a user or users at a platform, or at a particular platform. In that case, the user's platform may pass the user's credentials to the domain. Preferably, however, the platform may export a particular label only when a certain user or users are present, it being the duty of the platform to verify that the user is actually present. The platform may use any of the conventional recognition methods to verify that a user is present, including passwords, biometrics, location, and security tokens such as smartcards. This model is particularly applicable when a user has a PDA and wishes to use computing resources in the domain. In one sense, the user's platform becomes the user's token as far as the network is concerned.
A platform requires a trusted mechanism to control the use of the identity secret and the global labels. The identity secret is preferably used by the TPM to sign a given label only if the platform is in the state that corresponds to the engine/service associated with the label. One suitable mechanism is an adaptation of the TCPA TPM_SEAL and TPM_UNSEAL mechanisms. Recall that a TPM exports UNSEALed plaintext data out of the TPM only if the current pcr-value of pcr-index in the platform matches the decrypted value of [pcr-index, pcr-value]. For the purposes of this invention, a label is used as the plaintext data, and the pcr-index and pcr-value are values that correspond to the software state of the engine/service associated with the label. Alternatively, a TPM could simply store the labels and PCRs, and be arranged to release them only when the correct software state is detected. Preferably a set of labels and PCRs is preloaded into the TPM before deployment of the platform. This reduces the burden on the user of a platform, since platforms are already supplied with a useful set of identities. Any upgrades or maintenance of these identities is preferably done by an entity, preferably the domain, which is trusted by all third parties that will interact with the platform. To perform an upgrade or do maintenance, the domain preferably determines the platform state that it wishes to correspond to some particular engine/service and broadcasts the same information to all platforms within the domain. Part of the broadcast is preferably the distribution of new or upgraded application/domain software. Another part of the broadcast is preferably the distribution of the corresponding new or upgraded software measurements (PCRs) to TPMs, such information being signed using the domain's private key. Each TPM preferably verifies the new information in the same way, using the same public key preloaded into the TPM at manufacture or initialization.
A label is preferably not confirmed by a platform identity unless the platform's software state is such that the platform enforces a minimum set of requirements (protection of engines and/or services), and contains an entity that does security processing and hides that security processing from applications on the platform. A label that does this but is not associated with a given engine/service is called the "root label", of the platform. It can be used for signing when the platform meets the minimum requirements. Production of signatures incorporating other labels preferably depends upon the presence of the computing engine and/or service associated with the label. When merely advertising, a platform preferably consists of any existing engines and/or services plus a superposition of potential engines and potential services. When a suitable challenge (a "quantum challenge" seems a suitable name, for obvious reasons) is received by a platform, it preferably forces the platform to decide what states can actually be supported by the platform. The platform may make all actual states visible to the challenger. Alternatively, the challenged platform may just instantiate the challenged engine/service (if possible), and provide a conventional crypto-response back to the challenger to confirm provision of the engine/service associated with the label.
When a first platform wishes to verify that a target platform will provide a particular service, it sends a "quantum challenge" to the target platform. The TPM in the target platform inspects its (PCR) state measurements. If the desired state exists, either because the platform enters that state on receipt of the challenge or is already in that state, the TPM is preferably able to UNSEAL the appropriate label and preferably signs its response (including the label) using the platform identity secret corresponding to that label. That is to say, it signs a nonce (received in the quantum challenge) plus the label corresponding to the desired service using the platform's identity secret (or the secret specifically allocated to that identity label). The first platform receives the response, checks the nonce and checks the label. The first platform then checks the signature, using the public key of a trusted Certification Authority, preferably the domain. This signature check may be done on-line, but is preferably done off-line using a public key loaded at manufacture or initialization. If all checks pass, the first platform believes that the target is running the particular service, and may decide to use or perform the service in cooperation with the target platform. Such a check may be all that is required if a verified platform identity and label provide sufficient trust. This may well be the case for a service that is internal to an organization and/or domain.
If payment but not authorization or identification is required to use or provide a service, and the requestor has money in an electronic form, the required amount of electronic money is preferably simply transferred between platforms at some point.
If payment is required to use or perform a service, the requester is required to provide payment information. This preferably takes the form of a credit card number or credit card signature. A credit card number may belong to the platform or may belong to a user. If it belongs to the platform, the number is preferably stored in the platform, preferably in a secure manner, such as that provided by a TPCA TPM_SEAL command. If the credit card number belongs to a user, it may be stored in the platform, preferably in a secure manner, and released after permission from the user. Alternatively, the user may provide the number to the platform. If a credit card signing secret belongs to the platform, the secret is stored in the platform, preferably in a secure manner such as that provided by a TPCA TPM_SEAL command, and used to sign a request. If a credit card secret belongs to the user, the secret may be stored in the platform and used to sign a request upon identification by the platform of the user, and/or of the user by the platform, and/or permission by the user. If a credit card secret belongs to a user, the secret may be stored in a token such as a smartcard, and used to sign a request upon identification by the platform of the user, and/or of the user by the platform. The protocol that must be used may be similar or the same as that used by a Point-Of-Sale terminal. The entity requesting payment then uses an existing credit agency, such as the VISA (Trade Mark) or Mastercard (Trade Mark) networks, to verify the payment authority.
If a user authentication is required, the same authentication is preferably used for all authorizations of that user. (Of course, multiple authentication/authorization values may be used, but this increases complexity.) Preferably this user authentication should also indicate the ability and desire to pay for the service. Note that, in this invention, the value that provides user authentication is not necessarily a true secret, merely a value that is guarded by the user and used in circumstances when the user wishes to give approval for some process, and is potentially visible to more entities than just the user and the verifier.
Preferably, therefore, this user authentication should have the properties of a credit card, whether a simple number (a value stored on a magnetic card, for example), or a signing secret (stored on a smartcard, for example).
If payment is not required but authorization and/or identification is required to use or perform a service, essentially the same process as for payment may be used. The difference being that the credit agency is used simply to verify the authorization/identification information, not to request payment. The credit agency might charge some money for providing this service. In effect, the credit agency is being paid for providing a PKI that would otherwise have to be provided by the domain. The protocol that must be used may be similar or the same as that used by a Point-Of-Sale terminal. Alternatively, a simpler protocol may be used. In the case of a card signing secret, the card might be requested to sign a nonce created by the domain and/or the credit agency, for example.
If payment is not required but authorization and/or identification is required to use or perform a service, a process similar to the same payment process may be used. The difference is that some identification and/or authorization server is used simply to verify the authorization/identification information, not to request payment.
When a platform is exhibiting the behaviour associated with a label, even just the root label, its software environment should preferably protect a user's data and applications from interference or prying by data and applications belonging to other users. A person skilled in the art will be aware that compartments and virtual machines are well suited to this task. Information from one compartment or virtual machine is prevented from unauthorized interference or prying on other compartments or virtual machines.
When a platform is exhibiting the behaviour associated with a label, even just the root label, its software environment preferably includes a security service that cooperates with the mechanism providing the compartments and/or virtual machines. This security service preferably performs all the security services on behalf of the engines and services running in the compartments and/or virtual machines. The security service preferably verifies the labels of other platforms that are communicating with this platform. The security service may check that incoming messages have correct signatures that contain the correct label. The security service may cooperate with the platform's TPM to sign out-going messages while incorporating the correct label. The security service preferably manages the Diffie-Hellman protocol between platforms and sets up and takes down secure channels as required. The security service preferably manages all storage of secrets used to store data and/or applications belonging to another platform and/or user inbetween active sessions. The security service also preferably performs other security services, as described in a prior patent application "Performing a service on a computer" (referred to above), on behalf of the applications. The security service is preferably managed by an application on its host computer, but preferably accepts policies from remote platforms governing the data and applications and engine and service for that remote platform on the local platform. The local management application preferably does not provide means to override those policies, but can refuse to execute processes on unacceptable terms.
One aspect of this invention is a modification that removes the differentiation between the client and the server, thus migrating the invention towards a peer-to-peer architecture. This aspect of the invention is that a client advertises its ability to participate in a particular service. The client preferably creates a signed certificate that states that the client is able to participate in a particular service. The certificate is preferably created by signing the label of the service using the identity of the client's TPM. The certificate preferably indicates that the client may be able to participate in the service, not that it wishes to, or is even able to, at the time that the certificate is posted. The client preferably posts that certificate to the advertising service. This process is analogous to the procedure followed by the server described above, where the server signs the label describing a service and posts the certificate to the advertising service, to indicate that the server might provide the service, not that the server will actually provide the service. The client preferably also posts to the advertising service an additional certificate, which is the public key of the client signed by a trusted domain, and is attestation by the domain that the client may be trusted to accurately state the services (labels) in which it may participate. Again, this mirrors the actions of the server described above.
Another aspect is a modification that provides a convenient revocation mechanism and permission mechanism. In the system described above, the server preferably posts to the advertising service the attestations by the domain that the server may be trusted to state the services (labels) in which they may participate. In this aspect of the invention, the domain preferably controls the advertising service and itself posts the attestation for both the client and the server. This permits the domain to dynamically control whether a particular computer is able to participate in a service. If the domain does not control the advertising service, the clients and servers preferably post attestations to the advertising service, but the domain preferably posts revocation certificates to the advertising service. Thus a computer, when visiting the advertising service, can discover whether a client and/or server might participate in a service, and whether the client and/or server is permitted to participate in a service. Both clients and servers preferably periodically visit the advertising service, and use the presence and/or absence of the attestation and revocation certificates to update their permissions to provide a participate in a given service.
All of the features described herein can be combined with any of the above aspects in any combination.
FIG. 1 illustrates the information that exists in a system consisting of platform-n 100, credential certificate 114, credential 116, credit card number 123 and credential 119, preferably either at manufacture or at initialization of the system. A TPM 101 in platform-n 100 contains a public key 102 of trusted domain-A. The TPM 101 also contains a statistically unique secret, which is a private (identity) key 103 of an asymmetric key pair, and used to prove the identity of the platform. A corresponding public (identity) key 112 is inside a credential (certificate) 114 that is signed 113 by trusted domain-A. The TPM 101 also contains labels 104,106 (but note that not all TPMs contain all labels). One label 104 indicates service-X. Another label 106 indicates engine-Y. The TPM 101 contains values 105 that correspond to measurements relevant to service-X. The TPM 101 contains values 107 that correspond to measurements relevant to engine-Y. Each label 104,106 of each engine/service is associated 108,109 with the set of values 105,107 that correspond to the measurements relevant to the engine/service. The platform-n 100 also contains programs 125. A set of programs 110 provides service-X. A set of programs 111 provides engine-Y. A set of values 105 associated with label 104 corresponds to the results of measurements that should be obtained if the platform 100 is executing the programs 110. The set of values 107 associated with label 106 corresponds to the results of measurements that should be obtained if the platform 100 is executing the programs 111. Each platform also contains all the programs 115 that are required to ensure that a platform is in the configuration that conforms to the meaning of a label. Label 104 is also inside credential 116 (in the form of an X.509 standard certificate) signed 118 by trusted domain-A and including a reference 117 to a description of service-X implied by label 104. Label 106 is also inside credential 119 (also an X.509 certificate) signed 121 by trusted domain-A and including a reference 120 to a description of engine-Y implied by label 106. A user 123 has either a credit card number 122 and/or a credit card signing-secret 124.
FIG. 2 illustrates four platforms, platform-1 100, platform-2 200, platform-3 202, platform-4 203. Platform-1 100 contains TPM 101 and programs 125. Platform-2 200 contains a TPM 205 and programs 206. Platform-3 202 contains a TPM 207 and programs 208. Platform-4 203 contains a TPM 209 and programs 210. Each TPM 101,205,207,209 is capable of attesting that the associated platform 100,200,202,203 may be trusted to provide an engine and/or take part in a service. Also illustrated is an external credit verification service 204. A communication fabric 201 (such as the Internet or a Local Area Network, for example) connects all four platforms and the credit verification service. The programs 125,206,208,210 in each platform 100,200,202,203 respectively provide at least a security service (e.g. 115 for platform-1 100 in FIG. 1) plus applications to provide services (e.g. 110,111 for platform-1 100 also in FIG. 1).
FIG. 3 illustrates a Web service-page. Each platform (100, 200, 202 203) advertises (using a Web page) the engines and services that it may potentially provide. The information on this particular service page 301 advertises platforms that can provide service-X. One set 303 of information advertises the potential availability of service-X from platform-1 100. The information includes the certificate 309 of label-X 104 signed by platform-1, the certificate 114 of platform-1's public key signed by domain-A, and the IP address 302 of platform-1 100. Another set 306 of information advertises the potential availability of service-X from platform-2 200. The information includes the certificate 308 of label-X signed by platform-2, the certificate 304 of platform-2's public key signed by domain-A, and the IP address 305 of platform-2 200. Similar information 307 from other platforms may be available. The information includes the certificate 116 of label-X and its description, signed by domain-A.
FIG. 4 is a flow chart that illustrates the process by which platform-1 100 uses service-X on platform-2 200 after consulting a web page 301. Column 401 illustrates events at platform-1 100. Column 402 illustrates events at platform-2 200. Column 403 illustrates events at the web server.
In step-1 404, platform-1 100 visits the Web service page 301. The service-page 301 is widely publicized and/or available at a well known address, for example.
In step-2 405, platform-1 100 verifies that the certificates 309,114,308,304,116 and certificates from other platforms are correctly signed.
In step-3 406, platform-1 100 discovers that platform-2 200 is able to provide service-X, since trusted domain-A has signed the public key of platform-2 in the certificate 304, trusted domain-A has signed the label X and description of service-X in certificate 116, and the private key of platform-2 has signed the label of service-X in certificate 308.
In step-4 407, platform-1 100 contacts platform-2 200 using IP address 305 and requests the provision of the service corresponding to the label X of service-X, using a challenge from platform-1 to platform-2.
In step-5 408, platform-2 200 attempts to start service-X using the programs 110. The attempt is successful, so the measurements taken by the TPM 205 in platform-2 200 now indicate to the TPM 205 that it is permitted to use the label X 104 associated with service-X.
In step-6 409, platform-2 200 signs label X and the nonce 410 (from the incoming challenge) using its secret key, and sends the result 411 back to platform-1 100.
In step-7 412, platform-1 100 verifies the signature of platform-2 200 and hence verifies that platform-2 200 is now confirming the presence of service-X.
In step-8 415, platform-2 200 optionally performs a similar test on platform-1 100, to verify that platform-1 100 also contains service-X.
In step-9 416, platform-1 100 and platform-2 200 cooperate to setup a secure channel, using the Diffie-Hellman protocol.
In step-10 417, platform-1 100 and platform-2 200 provide and consume service-X, by executing the service and passing data 418,419 signed by their respective private keys and including label X.
FIG. 5 is a flow chart that illustrates the process by which platform-3 202 uses an engine-Y on platform-4 203. Column 501 illustrates events at a user of platform-3 202. Column 502 illustrates events at platform-3 202. Column 503 illustrates events at platform-4 203. Column 504 illustrates events at the web site. Column 505 illustrates events at the credit verification service 204. The protocol executes step 1 404 to step 9 416 of FIG. 4, until step 10 417, because the use of engine-Y requires user authorization.
In step-10 507 of FIG. 5, platform 3 202 asks its user to permit the use of a credit card number associated with the user.
In step-11 508, the user grants permission by entering the credit card number into platform-3 202.
In step-12 509, platform-3 202 sends the credit card number to platform-4 203 over the secure channel set up in step 9 416 between platform-3 202 and platform-4 204.
In step-13 510, platform-4 203 contacts the credit agency 204 by a protocol outside the scope of this invention.
In step-14 511, the credit agency 204 confirms to platform-4 203 the validity of the credit card number. In this case, the credit card agency 204 charges platform-4 203 for this service, although it could just have easily have charged the owner of the credit card number.
Finally, in step-15 512, platform-3 202 and platform-4 203 provide and consume engine-Y, by instantiating the engine on platform-4 and executing data and applications provided by platform-3 on that engine. Data 513 passing back and forth is signed by their respective private keys and includes label Y.
FIG. 6 illustrates the preferred architecture by which platform-2 provides service-X and platform-4 provides engine-Y. In this example, platform-2 200 and platform-4 203 execute service-X (provided by programs 1,2,3 110) in compartment-1 602 and execute engine-Y (provided by programs 1,6,8 111) in compartment-2 603. A security service 605 may also execute in a compartment 604. Other software processing 601, probably including kernel software, enforces and provides the compartment properties of the platforms 1 and 2. The security service 605 provides all security for service-X and engine-Y. The security service 605 intercepts messages 606,607 between the outside world and service-X. The security service 605 intercepts messages 606,608 between the outside world and engine-Y.
FIG. 7 is a flow chart that illustrates the process by which a platform is maintained and/or upgraded. Column 701 illustrates events at domain-A. Column 702 illustrates events at the platforms in domain-A.
In step-1 703, domain-A signs new values that are to be associated with existing label-n, signs a new set of {label-p and its associated values} and signs new programs.
In step-2 704, domain-A sends those new data to all of the platforms in its domain.
In step-3 705, each platform's TPM 101, 205, 207, 209 verifies the signatures on the incoming data using the public key of domain-A that was stored in each TPM. In step-4 706, the programs are stored in the platform, the values associated with label-n in the TPM 101, 205, 207, 209 are replaced by the new values, and the new set of {label-p and its associated values} is installed in the TPM 101, 205, 207, 209.
The previous description assumes that a single domain both controlled the platforms and provided/managed the services. This does not have to be the case. A viable alternative is for one domain to control the platforms and a different domain to define/provide the services. Then one important change is that a platform, when using a label, should sign and provide a statement of the interpretation of the label by the platform. This is necessary in order that a second platform can reliably deduce the implications at a first platform of a particular label at that first platform. Platform-1 could provide this statement, for example, by modifying the credential 308 (currently a label signed by platform-1) so that the credential 308 includes the precise meaning of the label as implemented by platform-1. This might be done, for example, by modifying the credential 308 to include a reference to another credential 116, which is a signed description of the meaning of a label.
If different domains provide the platforms and the services, a service provided by the platform domain may be used to install and update the foreign services in the platforms.
If different domains provide the platforms and the services, an engine service provided by the platform domain may be used to provide services in the platforms on behalf of the service domain.
The system and protocol described herein provides significant advantages because the security requirements are considerably reduced and the total number of secrets in a system is reduced, thus giving advantageous simplification of the security system. Also the security infrastructure is kept out of the applications and engines to improve their efficiency.
The computing platforms described herein have been explained with particular reference to the TCPA specification. However, that specification is just an example of a trusted component of a computing platform and other types of trusted component are equally applicable to the invention described herein.

Hewlett-Packard Development Company, L.P.


A phenol-formaldehyde resole resin for use as a binder for glass fibers is acidified with sulfamic acid to a pH of 3 or less after base-catalyzed resinification. An increase in actual solids observed compared with neutralized resin, reflecting a desired improvement in efficiency.

1. Field of the Invention
The present invention relates to the manufacture of fiberglass insulation materials, and more particularly to the preparation of phenolic resin for glass fibers.
2. Brief Description of the Prior Art
Aqueous dispersions of phenol-formaldehyde resole resins are frequently used in the manufacture of glass fiber insulation materials, such as insulative batts for walls, in roofs and ceilings, insulative coverings for pipes, and the like. Typically, after glass fiber has been formed, the still hot fiber is sprayed with aqueous binder dispersion in a forming chamber or hood, with the fibers being collected on a conveyer belt in the form of a wool-like mass associated with the binder. In some cases, a glass fiber web is sprayed with the aqueous dispersion. Both resole and urea-modified resole resins have been employed for this purpose, the urea contributing to the xe2x80x9cpunkingxe2x80x9d resistance of the binder (i.e., resistance to exothermic decomposition at elevated temperatures), and reducing volatiles liberated when the resin is cured at elevated temperature.
An excess of formaldehyde over phenol is typically used so as to minimize the free phenol in the reaction product. Subsequently, other components (for example, urea) may be included to scavenge free formaldehyde.
Frequently, in the manufacture of glass fiber insulation materials, the aqueous resole resin is prepared in advance of the preparation of the binder, or is supplied by a resin manufacturer and stored until shortly before use. The resole is typically prepared by reaction of phenol and formaldehyde under basic conditions, the resulting reaction mixture being neutralized to a slightly basic pH by addition of a strong acid, to provide a water-dilutable resole. Subsequently, the binder is prepared by adding to the resole resin an acid catalyst for curing the resin, water to dilute the dispersion, and optionally other components, such as a silane glass-adhesion promoter, an oil emulsion lubricant, and urea to reduce volatile materials liberated during curing.
It is desirable to obtain the highest possible level of solids during preparation of the resole resin. High solids correlate with reduced volatile liberation and enhanced efficiency.
The resole resin can be prepared by any of a variety of specific processes, such as disclosed in U.S. Pat. No. 5,300,562, hereby incorporated by reference. Often, a single stage process is employed. Phenol and formaldehyde are mixed with a strongly basic catalyst, such as an alkali metal base, and the mixture is maintained at an elevated temperature until the desired degree of reaction has occurred, after which time the reaction mixture is cooled and neutralized by addition of a suitable acid. Alternatively, a multiple step process can be employed such one involving an initial reaction step under acid conditions and a subsequent reaction step under basic conditions, followed by neutralization.
U.S. Pat. No. 5,362,842 discloses a two-step process for making a urea-formaldehyde resin composition including an initial step under basic conditions and a second step under acidic conditions, during which the pH is maintained in the range from 4.9 to 5.2.
U.S. Pat. Nos. 5,358,748 and 5,505,998 disclose an acidic glass fiber binding composition. A strong aqueous soluble acid is employed in preparing the binder composition in order to reduce the level of alkylamine otherwise produced during cure. Alklyamines are disclosed to be undesirable odiferous materials produced by degradation of urea (the formaldehyde scavenger) during cure. A strong acid, that is, an acid with a pKa value of 4 or less, is added to the binder composition to lower the pH to a value between 4.5 and 6.5, preferably between 4.5 and 6. Suitable acids include sulfamic acid, oxalic acid and sulfuric acid. The binder includes a phenol formaldehyde resin, preferably having a low free formaldehyde content and a low free phenol content. According to this patent, most commercially available phenol formaldehyde resins have an alkaline pH range, such as between 9 and 9.6, and this makes the addition of the strong acid to provide a pH between 4.5 and 6.5 a quite different thing.
According to U.S. Pat. No. 5,538,761, phenol-formaldehyde condensates prepared under acid conditions or with low levels of formaldehyde under basic conditions are generally not water soluble, as significant quantities of insoluble dihydroxydiphenylmethanes are produced.
U.S. Pat. No. 5,538,761 discloses a process for preparing binder-treated fiberglass exhibiting lower formaldehyde and ammonia emissions by use of an acidifying hydrolyzable salt, a mineral acid, or partial ester of carboxylic acid to lower the instantaneous pH of the urea-extended pre-react binder solution to less than 5.5, and preferably in the range 3.0 to 5.0, and more preferably in the range 4.0 to 5.0. The process also includes coating fiberglass with the acidified solution, and curing the binder. The xe2x80x9cpre-reactxe2x80x9d is a binder solution comprising phenolformaldehyde resole resin to which urea has been added and permitted to react with the free formaldehyde.
U.S. Pat. No. 5,864,003 discloses a thermosetting resin composition containing a mixture of a phenol-formaldehyde resole resin and a latent curing agent. The latent curing agent acts synergistically with a strong acid catalyst of the type conventionally used to cure phenol resole resins. Such strong acid catalysts include inorganic acids such as sulfuric acid, hydrochloric acid, and phosphoric acid and organic acids such as sulfamic acid, tricholoracetic acid, and aromatic di- and polysulfonic acids, such as phenyl sulfonic and other organosulfonic acids. The U.S. Pat. No. 5,864,003 patent notes that the resole resin can be neutralized after alkaline reaction of the phenol and formaldehyde using a conventional acid neutralizing agent such as methane sulfonic acid, hydrochloric acid, phosphoric acid, or sulfuric acid. Neutralization is accomplished by adding a sufficient amount of acid to establish a pH of between 6.5 and 7.5 in the aqueous resin, although a pH as low as 4.0 may result in stable resin systems.
Given the large volume of resinous binder compositions required in the production of fiberglass insulation and for other uses, and the need to minimize offensive emissions of formaldehyde and other compounds during manufacture, there is a continuing need for phenol-formaldehyde resin compositions for use in binders which exhibit low emissions during cure, and that have high solids.
The present invention provides an improved method or process for preparing a phenolic resin for use as a binder for glass fibers and giving higher solids than prior art processes. Higher solid compositions are very desirable from an emission-reduction perspective. This process provides more efficient resin compositions by increasing the solids level of the resin composition, and reduced emissions during cure, while maintaining good storage stability, as determined by the water dilutability of the resin composition. The process can be used to prepare compositions including either water-soluble phenol-formaldehyde resole resins or water-soluble phenol-formaldehyde resole resins modified with a nitrogenous reactant such as urea and/or ammonia. The present process provides compositions that exhibit very good stability, even at low pH.
The process comprises preparing a water-soluble phenol-formaldehyde resole resin by first preparing an initial aqueous mixture including formaldehyde and phenol, and adding a basic polymerization catalyst to the initial aqueous mixture. The aqueous mixture is then maintained at a predetermined temperature during reaction of the phenol and formaldehyde to form the water-soluble phenol-formaldehyde resole resin until the free formaldehyde content of the aqueous mixture drops to a predefined level. Next, the aqueous mixture is cooled, and finally acidified with sulfamic acid to a pH of no greater than 3. Preferably, the aqueous mixture including the unmodified resole resin is acidified to a pH from about 2 to 3.
The acidified resole resin of the present process is stable at low pH. The acidified resole resin can be modified by subsequent addition of one or more acidic modifiers to alter or improve the properties of the resulting resin and/or the binder subsequently prepared from the resole resin. Examples of suitable acidic modifiers that can be employed include latent catalysts such as ammonium sulfate, reactive diluents such as benzylic alcohols, weak acids such as boric acid, and fatty acids such as oleic and stearic acids, and esters, such as diethyl phosphite.
Optionally, the process can be used to prepare a modified phenol-formaldehyde resin composition by preparing an aqueous reaction mixture including the phenol-formaldehyde resole resin and a nitrogenous reactant, such as urea, ammonia, or a mixture of urea and ammonia; and permitting the nitrogenous reactant to react with the phenol-formaldehyde resole resin to form a modified resin.
Subsequently, preparation of the binder is completed by adding a catalyst for curing the resole resin.
Preferably, the phenol-formaldehyde resin has a formaldehyde-to-phenol mole ratio of from about 2.5:1 to 4.2:1, and more preferably, from about 3.2:1 to 4.0:1. It is also preferred that the predefined level be about 40 percent by weight of the free formaldehyde in the initial aqueous mixture.
Further, the process of the present invention also optionally provides for adding ammonia and/or urea to the reaction mixture as a formaldehyde scavenger. Preferably, the ammonia is added in sufficient quantity to give a weight ratio of formaldehyde scavenger to solids of unmodified resin of from about 1.0:100 to 3.0:100.
When a urea or ammonia-modified binder is desired, it is preferred that the mole ratio of the urea or ammonia modifying agent to the free formaldehyde of the phenol-formaldehyde resin be from about 1:1 to 1.75:1, and that the aqueous mixture be maintained at a temperature of from about 5xc2x0 C. to 30xc2x0 C. while permitting the modifying agent to react with the resole resin.
The present invention also provides a process for producing a glass fiber batt, which comprises preparing a binder as described above and spraying the binder on glass fibers to form a batt; and then curing the binder at an elevated temperature.
In completing preparation of the aqueous mineral fiber binder composition, other typical binder components, such as an acid elevated temperature cure catalyst, a mineral oil lubricant, and an organo-silane adhesion promoter, can be added to the aqueous mixture of the modified resole. Such components can be added to the aqueous mixture of modified resole resin shortly before application of the binder to the glass fibers.
The phenol-formaldehyde resole resin employed in the process of the present invention can be prepared by conventional methods known in the art, such as those which give water-soluble resole resin and employ commercial grade phenol and formaldehyde materials. For example, the formaldehyde can be provided in the form of an aqueous formalin solution have 30-50 percent by weight formaldehyde, although other forms of formaldehyde known to the art can also be used. In addition to phenol itself, other hydroxy-functional aromatic compounds can be employed, or used in addition to phenol. Examples of substituted phenols that can be used include alkyl-substituted phenols, such as o-cresol, m-cresol, and p-cresol, 3,5-xylenol, 3,4-xylenol, 3,4,5-trimethyl phenol, 3-ethyl phenol, 3,5-diethyl phenol, p-butyl phenol, 3,5 dibutyl phenol, p-amyl phenol, and p-octyl phenol; cycloalkyl-substituted phenols such as cyclohexyl phenol and 3,5-dicyclohexyl phenol; alkenyl-substituted phenols; aryl-substituted phenols such as p-phenyl phenol; alkoxy-substituted phenols such as 3,5-dimethyoxyphenol, p-ethoxy phenol, p-butoxy phenol, and 3,4,5-trimethoxyphenol; aryloxy phenols such as p-phenoxy phenol; and halogen-substituted phenols such as p-chlorophenol as well as polycyclic phenols such as napthol, anthranol, and substituted derivatives. Similarly, dihydric phenols such as catechol, resorcinol, hydroquinone, bisphenol A and bisphenol xc2x0 F. can be used. However, phenol itself is especially preferred. Mixtures of phenols can also be used, preferably, mixtures which include phenol itself.
Similarly, other reactive aldehydes can be substituted in whole or in part for formaldehyde to produce the aqueous solution of water-soluble resole resin. Examples of other reactive aldehydes that can be used include acetaldehyde, propionaldehyde and benzaldehyde. Formaldehyde is especially preferred.
The preparation of resole resins is reviewed and described in R. W. Martin, The Chemistry of Phenolic Resins (John Wiley and Sons, Inc., New York 1956) at 88-97.
The process of this invention relates to the preparation of a water-soluble phenol-formaldehyde resole resin. A base-catalyzed condensation of the phenol and the aldehyde is typically used to prepare the resin. The reaction, which is exothermic, is initiated after mixing the phenol and the aldehyde by addition of the catalyst. The proportion of phenol to the aldehyde is selected to yield a resole-type resin (stoichiometric excess of formaldehyde) when formaldehyde and phenol are used, the mole ratio of formaldehyde to phenol preferably being from about 2.5:1 to 4.2:1, and more preferably from about 3.2:1 to 4.0:1. Preferably, an aqueous mixture of formaldehyde and phenol is maintained at a first temperature of from about 40xc2x0 C. to 50xc2x0 C. as a basic polymerization catalyst is added.
The catalyst used in the process of preparing the resole resin can include at least one basic alkali metal or alkaline earth metal base. Examples of alkali metal bases that can be used include the hydroxides of sodium, potassium, and lithium. Examples of alkaline earth metal bases that can be used include the oxides and hydroxides of calcium, barium and strontium, such as calcium oxide and calcium hydroxide. Potassium hydroxide or sodium hydroxide is preferred over calcium hydroxide, as the alkali metal bases appear to provide greater stability than calcium hydroxide in the present process. Other strongly basic water-soluble substances that do not react with formaldehyde, such as tertiary amines such as triethylamine, tertiary amino alcohols such as 2-dimethylamino-2-methyl-1-propanol and 2-(dimethylamino)-2-(hydroxmethyl)-1,3-propanediol, and the like, can also be used in catalyzing the preparation of the resole resin.
The temperature is then preferably permitted to rise the first temperature to a second temperature, preferably between about 60xc2x0 C. and 80xc2x0 C., and more preferably 70 C. The time required for the temperature rise to occur depends on the scale on which the exothermic reaction is being carried out. On a production scale, this temperature rise can occur over a period of about thirty minutes. If desired, the reaction vessel can be cooled to slow the temperature increase.
This second temperature is preferably maintained until the free formaldehyde content of the aqueous mixture drops by about 65 percent of the initial free formaldehyde level and more preferably by about 60 percent of the initial free formaldehyde level, by weight.
Next, the aqueous mixture is preferably cooled, preferably to a temperature between about 20xc2x0 C. and 30xc2x0 C., and the aqueous mixture is acidified by addition of sulfamic acid, preferably to a pH of about 3 or less, more preferably to a pH of from about 2.5 to 3.5. Unexpectedly, such resins neutralized to a pH of about 3 or less exhibit actual solids that are greater than theoretical solids (based on unneutralized solids).
Typically, the process is selected to provide an aqueous resole resin with total solids of about 40 to 50 percent by weight. The aqueous resole resin can also include small amounts of residual formaldehyde, such as up to about 15 percent by weight, and small amounts of residual phenol, such as up to about 2 percent by weight. In addition, the aqueous resole resin will typically contain small amounts of residual sodium, calcium or like salts from the resin polymerization.
Because the acidified resole resin of the present process is stable at low pH, the acidified resole resin can be modified by subsequent addition of one or more acidic modifiers to alter or improve the properties, such as the cure characteristics, of the resulting resin and/or the binder subsequently prepared from the resole resin. The amount of acidic modifier employed depends upon the nature of the modifier and the extent of modification desired. Examples of suitable acidic modifiers that can be employed include latent catalysts such as aryl phosphites, salts of a primary or secondary amine and a strong acid, partial phosphate esters; reactive diluents such as benzylic alcohols; weak acids such as boric acid, and fatty acids such as oleic and stearic acids; and polycarboxylic acids such as polyacrylic acids. Aryl phosphite latent catalysts are disclosed, for example, by U.S. Pat. No. 5,317,050, as alternatives to strong acid catalysts for rapid hardening of phenolic resins at relatively modest elevated temperatures. Amine salts of strong acids are disclosed as effective latent catalysts for phenolic resins by U.S. Pat. No. 5,243,015, which also discloses the synergistic combination of such a latent catalyst with a minor amount of conventional strong acid cure catalyst. U.S. Pat. No. 5,378,793 discloses partial phosphate esters as latent catalysts for phenolic resole resins, the partial phosphate esters being prepared by reaction of condensed phosphoric acids with polyols under controlled conditions. U.S. Pat. No. 6,133,403 discloses benzylic alcohols, namely alkoxy benzyl alcohols and dibenzyl ethers, as reactive diluents for phenolic resins hardenable with strong acid cure catalysts. The use of polyacrylic acids as an acidic modifier for resole resins is disclosed, for example, in U.S. Pat. Nos. 5,670,585 (reduction of ammonia emissions), 6,194,512 (preferential formation of trimethylol phenol) and U.S. Pat. No. 5,804,254 (flexibilizing additive).
After preparation of the aqueous resole resin has been completed, the aqueous resin can be packaged, as by drumming, and stored until needed or transferred to a transportation vehicle such as a tank wagon or rail car and shipped to another site where binder for mineral fiber articles is to be produced.
The aqueous resole resin of the present invention has good stability, as measured by its water dilutability. Preferably, the aqueous resole resin can be diluted by greater than 2000 to 1 even after two weeks storage at low temperature (5xc2x0 C. or 40xc2x0 F.).
The aqueous resole resin produced can be used to prepare an aqueous binder for articles formed using mineral fibers. Typically, in such articles, the mineral fibers, such as glass fibers, are initially formed into a non-woven mat. An aqueous binder including the resole resin is typically sprayed on newly formed, still hot, glass fibers in a forming chamber or like apparatus to yield a wool-like mass including the glass fibers, bound by the resin binder. The characteristics and utility of the article produced are determined to some extent by the type of mineral fiber used, the length and diameter of the fibers, the density, oxidation, and concentration of the fibers in the mat, and the like. For some applications, it may be desirable to weave the fibers or otherwise form a fabric from the fibers.
Alternatively, in one embodiment of the present invention, the aqueous resole resin can be modified at the resin-manufacturing site by post-reaction with one or more formaldehyde scavengers for reducing the free formaldehyde before the resin is packaged and shipped. Alternatively, formaldehyde scavengers can be added later, after the resole resin arrives at the site where it will be used. Typically, the resole resin is diluted with water, and a cure catalyst is added, to form an aqueous binder. The binder is applied to the fibrous material to be bound; and the resole is cured by application of heat. The binder may also contain other components, such as one or more formaldehyde scavengers.
Typically, a nitrogenous reactant such as urea is employed as a formaldehyde scavenger for phenol-formaldehyde resole resins. Other scavengers can also be used, including nitrogenous reactants such as ammonia, ammonium hydroxide, primary and secondary amines, thiourea, dicyandiamide, guanidine, aminotriazoles such as guanamine and benzoguanamine, melamine, melamine-formaldehyde resins and dicyandimine-formaldehyde resins. Other type of formaldehyde scavengers can also be employed, such as sodium sulfite, sodium cyanide, and resorcinol. Combinations of reactants can also be used, with the combination of urea and ammonia being presently preferred.
Preferably, formaldehyde scavenger is added in an amount sufficient to react with substantially all residual formaldehyde in the resole resin. When urea employed as the formaldehyde scavenger, the mole ratio of urea to the free formaldehyde in the aqueous mixture including the resole resin is preferably from about 1:1 to 1.75:1. On mixing the formaldehyde scavenger with the aqueous resole resin, an increase in the pH of the aqueous mixture is observed, such as an increase in pH to a range of 7 to 9.
In one embodiment of the present process, urea and ammonia are added directly to the aqueous resole mixture, after the aqueous mixture has been acidified, and preferably no more than about three days after the acidification of the reaction mixture. Advantageously, the urea and ammonia can be added just after the acidification. Preferably, the aqueous reaction mixture thus provided is agitated for at least a time sufficient to ensure complete mixing of the resole resin, the urea, and the ammonia, such as for at least about 30 to 60 minutes, using conventional liquid mixing equipment. If the acidified aqueous mixture including the resole is stored for a period before the nitrogenous reactants are added, it is preferred that the aqueous mixture be stored at a temperature below ambient, such as from about 40 to 55xc2x0 F.
The phenolic resin prepared by process of the present invention has a storage stability of at least about two weeks at temperatures up to at least about 55xc2x0 F.
The process of the present invention can further include subsequently completing preparation of the binder by adding a catalyst, such as a latent acid catalyst, for curing the resole resin.
Examples of catalysts for curing the resole resin include acid catalysts such as salts, preferably ammonium or amino salts of acids, such as ammonium sulfate, ammonium phosphate, ammonium sulfamate, ammonium carbonate, ammonium acetate, ammonium maleate, and the like. The acid catalyst can be added in an amount of from about 0.1 to 5 percent by weight based on the weight of the resole resin, or on the basis of the resole resin and urea in the case of a urea-modified resole resin. When a latent catalyst is employed as an acidic modifier of the resin, the amount of cure catalyst can be reduced, or the cure catalyst can be omitted entirely, depending on the type and amount of latent catalyst employed.
Completing preparation of the binder can also include addition of a lubricant composition, such as a mineral oil emulsion, and a material promoting adhesion of the modified resole resin to the glass fibers, such as a suitable silane. An example of an adhesion-improving silane that can be added is 3-aminopropyl triethoxysilane. Other additives such as finely divided mineral fibers, non-reactive organic resins such as Vinsol (trademark of Hercules) resin (derived from rosin), tall oil, surface active compounds such as lignosulfonate salts, thickeners and rheology control agents, dyes, color additives, water, and the like, can also be added to the aqueous binder.
Prior to application of the binder, the binder can be diluted by addition of water to provide a concentration suitable for application to the hot mineral fibers or mineral fiber web or mat. For example, water can be added to provide a total solids content of from about 1 to 80 percent by weight.
The aqueous binder can be applied directly to newly formed, still hot glass fibers, or to a mineral fiber mat or fabric, and subsequently dried and cured to form an article. The mineral fiber can be a glass fiber, and the mat can be a non-woven mat. The mineral fibers can be continuous or chopped or can take the form of a mineral fiber wool. When glass fiber is used, it can be formed by any conventional process, such as by flame or steam blowing, by centrifugal fiberizing, or the like. The shape, fiber, density, fiber lengths, fiber orientation, and like characteristics of the fiber mat depend on the application intended for the articles produced. One especially important application is thermal insulation. In this case, the fiber mats take the form of continuous rolls or batts of non-woven, randomly oriented glass fibers. A similar mat is used in the production of glass fiber batts for acoustic insulation.
When thermal and acoustic glass fiber insulation is to be produced, the newly formed, still hot glass fibers are typically sprayed in a forming chamber or hood with the aqueous binder to distribute a coating of binder over the fibers, and especially at contact points between fibers. If the hot fibers do not have sufficient heat content to drive off the water, the mat coated with the aqueous binder solution can be subsequently thermally dried to remove water. In either case, the resinous compounds including the resole and the nitrogenous reactant are cured to form an infusible binder for the mineral fiber mat.
The process of the present invention can also be used to prepare binders for other mineral fiber articles such as battery separators, printed circuit boards, and electrical insulation products as well as for processed wood products such as chipboard, particle board, plywood, and the like.
The following examples are illustrative of the processes, compositions, and articles of the present invention, and will be useful to those of ordinary skill in the art in practicing the invention. However, the invention is in no way limited by these examples. Unless otherwise indicated all percentages are given on a weight basis in the following examples.

Method of preparing a higher solids phenolic resin