Back to results
US 10,834,077 B2Granted
Booting and dumping a confidential image on a trusted computer system
AssigneeInternational Business Machines Corporation
InventorsReinhard T. Buendgen, James A. O'Connor, William J. Rooney
Life of this patent
Estimating the term…
Abstract
A computer program product and a computer system for generating and deploying a secure boot image and encrypted client data to a trusted computer system. Embodiments of the present invention disclose deploying a secure boot image and encrypted client data from a client to a trusted computer system. Embodiments of the present invention disclose booting a confidential image on a trusted computer system. Embodiments of the present invention also disclose a process of dumping a confidential image on the trusted computer system.
Claims8
A computer program product for generating and deploying a secure boot image and encrypted client data to a trusted computer system, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code executable to:
- generate, by a client computer, a client image key;
- generate, by the client computer, a client data key;
- generate, by the client computer, the encrypted client data by encrypting client data, with the client data key;
- write, by the client computer, the client data key into a boot image;
- generate, by the client computer, an encrypted boot image by encrypting the boot image, with the client image key;
- generate, by the client computer, an encrypted client image key, with a public host key on the client computer, wherein the public host key is a public key of an asymmetric key pair and corresponds to a private host key stored in a protected area on the trusted computer system;
- generate, by the client computer, a secure boot image including the encrypted boot image and the encrypted client image key;
- deploy, by the client computer, the secure boot image including the encrypted boot image and the encrypted client data to the trusted computer system, wherein the encrypted boot image is loaded by the trusted computer system into a secure logical partition on the trusted computer system, wherein the encrypted client image key is loaded by the trusted computer system into the protected area on the trusted computer system;
- wherein the encrypted client image key is decrypted by the trusted computer system to obtain the client image key in the protected area on the trusted computer system, with the private host key stored in the protected area on the trusted computer system;
- wherein the encrypted boot image are decrypted by the trusted computer system to obtain the boot image and the client data key in the secure logical partition on the trusted computer system, with the client image key in the protected area on the trusted computer system;
- wherein the boot image in the secure logical partition on the trusted computer system is started by the trusted computer system;
- and
- wherein the encrypted client data is mounted onto the secure logical partition on the trusted computer system, by the boot image in the secure logical partition on the trusted computer system.
10 more elements
A computer system for generating and deploying a secure boot image and encrypted client data to a trusted computer system, the computer system comprising:
- one or more processors, one or more computer readable tangible storage devices, and program instructions stored on at least one of the one or more computer readable tangible storage devices for execution by at least one of the one or more processors, the program instructions executable to:
- generate, by a client computer, a client image key;
- generate, by the client computer, a client data key;
- generate, by the client computer, the encrypted client data by encrypting client data, with the client data key;
- write, by the client computer, the client data key into a boot image;
- generate, by the client computer, an encrypted boot image by encrypting the boot image, with the client image key;
- generate, by the client computer, an encrypted client image key, with a public host key on the client computer, wherein the public host key is a public key of an asymmetric key pair and corresponds to a private host key stored in a protected area on the trusted computer system;
- generate, by the client computer, a secure boot image including the encrypted boot image and the encrypted client image key;
- deploy, by the client computer, the secure boot image including the encrypted boot image and the encrypted client data to the trusted computer system, wherein the encrypted boot image is loaded by the trusted computer system into a secure logical partition on the trusted computer system, wherein the encrypted client image key is loaded by the trusted computer system into the protected area on the trusted computer system;
- wherein the encrypted client image key is decrypted by the trusted computer system to obtain the client image key in the protected area on the trusted computer system, with the private host key stored in the protected area on the trusted computer system;
- wherein the encrypted boot image are decrypted by the trusted computer system to obtain the boot image and the client data key in the secure logical partition on the trusted computer system, with the client image key in the protected area on the trusted computer system;
- wherein the boot image in the secure logical partition on the trusted computer system is started by the trusted computer system;
- and
- wherein the encrypted client data is mounted onto the secure logical partition on the trusted computer system, by the boot image in the secure logical partition on the trusted computer system.
11 more elements
Dependencies are inferred from the claim text.