Encryption with sealed keys
AssigneeInternational Business Machines Corporation
InventorsMarco Kraemer, Hoang-Nam Nguyen, Carsten Otte, Christoph Raisch
Life of this patent
Estimating the term…
Abstract
An aspect includes a computer system with a network encryption device and a trusted container within firmware or hardware and/or within a virtual machine running on the computer system. The network encryption device includes a key store for storing secret encryption keys and a network traffic encryption engine for negotiating and/or storing encryption keys in the key store and/or for encrypting and/or decrypting network traffic using the encryption keys from the key store. The trusted container includes a flow analyzer for analyzing network traffic received from the network encryption device.
Claims20
A computer system comprising:
- a network encryption device and a trusted container within firmware or hardware and/or within a virtual machine running on the computer system, the network encryption device comprising:
- a key store to store secret encryption keys;
- and
- a network traffic encryption engine to negotiate and/or store encryption keys in the key store and/or encrypt and/or decrypt network traffic using the encryption keys from the key store;
- and
- the trusted container comprising a flow analyzer to analyze network traffic received from the network encryption device.
A method for providing encryption with sealed keys in a computer system having a network encryption device and a trusted container within firmware or hardware and/or a virtual machine running on the computer system, wherein the network encryption device provides a secure interface for forwarding data unaltered through a host/operating system between an application and a network interface device, the method comprising:
- providing a network traffic encryption engine to negotiate and/or store encryption keys in a key store implemented in the network encryption device;
- encrypting and/or decrypting network traffic using the encryption keys from the key store;
- and
- analyzing network traffic received from the network encryption device by a flow analyzer implemented in the trusted container.
A computer program product for providing encryption with sealed keys in a computer system having a network encryption device and a trusted container within a firmware or hardware and/or a virtual machine running on the computer system, wherein the network encryption device provides a secure interface for forwarding data unaltered through a host/operating system between an application and a network interface device, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
- providing a network traffic encryption engine for negotiating and/or storing encryption keys in a key store implemented in the network encryption device;
- encrypting and/or decrypting network traffic using the encryption keys from the key store;
- and
- analyzing network traffic received from the network encryption device by a flow analyzer implemented in the trusted container.
Dependencies are inferred from the claim text.