Transforming a wrapped key into a protected key

A system for transforming a wrapped key token into a protected key, which is protected by a volatile master key kept in the firmware of a virtual server, the system comprising:

• an isolated virtual server that is adapted for maintaining an isolated virtual server master key;
• the virtual server, wherein the virtual server and the isolated virtual server are adapted for running on the same hypervisor, wherein the hypervisor's firmware is adapted for maintaining a volatile virtual server master key for each virtual server, and wherein the hypervisor is communicatively coupled to a processor and a memory with program instructions thereon;
• a configuring unit, in communication with the processor and the memory, adapted for configuring an association between the virtual server and the isolated virtual server, wherein the association provides a secret shared by the firmware of both the virtual server and the isolated virtual server;
• a secure communication channel between the virtual server and the isolated virtual server, based on the secret;
• wherein the isolated virtual server is adapted, by the program instructions on the memory, for providing to the virtual server, via a first service, a wrapped key token comprising a random key wrapped by the isolated virtual server master key;
• and
• wherein the isolated virtual server is also adapted, by the program instructions on the memory, for providing to the virtual server, in response to a submission of the wrapped key token, via a second service, the protected key, wherein the protected key corresponds to the random key that was wrapped by the isolated virtual server master key.

A computer program product for transforming a wrapped key token into a protected key which is protected by a volatile master key kept in the firmware of a virtual server, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions being executable by a processor of one or more computing systems to cause the one or more computing systems to:

• create an isolated virtual server that maintains an isolated virtual server master key;
• create the virtual server, wherein the virtual server and the isolated virtual server run on the same hypervisor, wherein hypervisor's firmware maintains a volatile virtual server master key for each virtual server;
• configure an association between the virtual server and the isolated virtual server, wherein the association provides a secret shared by the firmware of the virtual server and the isolated virtual server;
• establish a secure communication channel between the virtual server and the isolated virtual server, based on the secret;
• provide to the virtual server, via a first service, the wrapped key token comprising a random key wrapped by the isolated virtual server master key;
• and
• providing to the virtual server, in response to submitting the wrapped key token, via a second service, the protected key, wherein the protected key corresponds to the random key that was wrapped by the isolated virtual server master key.