Controlling execution of software by combining secure boot and trusted boot features

A data processing system for controlling execution of software, the data processing system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• perform a set of measurements on a software module while performing a process to prepare the software module for execution on the data processing system in response to the data processing system receiving an input to execute the software module on the data processing system;
• request an authorization to proceed with the process of preparing the software module for execution on the data processing system from a trusted third party computer in response to determining that the set of measurements meets a predetermined criterion;
• execute the software module in response to the data processing system receiving the authorization to proceed with the process of preparing the software module for execution on the data processing system from the trusted third party computer;
• determine whether the authorization satisfies a security policy in response to the data processing system receiving the authorization to proceed with the process of preparing the software module for execution on the data processing system from the trusted third party computer;
• and
• release a secret key in response to the data processing determining that the authorization satisfies the security policy.

A computer program product for controlling execution of software, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a data processing system to cause the data processing system to perform a method comprising:

• responsive to the data processing system receiving an input to execute a software module on the data processing system, performing, by the data processing system, a set of measurements on the software module while performing a process to prepare the software module for execution on the data processing system;
• responsive to the data processing system determining that the set of measurements meets a predetermined criterion, requesting, by the data processing system, an authorization to proceed with the process of preparing the software module for execution on the data processing system from a trusted third party computer;
• responsive to the data processing system receiving the authorization to proceed with the process of preparing the software module for execution on the data processing system from the trusted third party computer, executing, by the data processing system, the software module;
• responsive to the data processing system receiving the authorization to proceed with the process of preparing the software module for execution on the data processing system from the trusted third party computer, determining, by the data processing system, whether the authorization satisfies a security policy;
• and
• responsive to the data processing determining that the authorization satisfies the security policy, releasing, by the data processing system, a secret key.