# US 2022/0045853 A1 · Hypervisor protected key

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2022/0045853 A1
- Document ID: US20220045853A1
- Status: Published application
- Kind: A1
- Application number: 17/452,105
- Filed: 2021-10-25
- Published: 2022-02-10
- Earliest claimed: 2020-07-02
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Reinhard Theodor Buendgen; Christian Borntraeger
- Web page: https://patentgrep.com/patent/US20220045853A1

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- G06F 9/45545: {Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox}
- H04L 9/0822: {using key encryption key}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method, a computer system, and a computer program product for cryptography are provided. A guest virtual server registers with a trusted hypervisor by using guest credentials. A guest wrapping key associated with the guest credentials is generated. A satellite virtual server instance that shares a master key with the virtual guest server is generated in the trusted hypervisor. A copy of the guest wrapping key is passed to the satellite virtual server instance. A random guest key is wrapped with the guest wrapping key, thereby producing a wrapped guest key. The wrapped guest key is rewrapped with the master key to form a protected guest key.

## Claims

### Claim 1

A computer-implemented method for cryptography, the method comprising:
registering a guest virtual server with a trusted hypervisor by using guest credentials,
generating a guest wrapping key associated with the guest credentials,
generating in the trusted hypervisor a satellite virtual server instance that shares a master key with the virtual guest server,
passing a copy of the guest wrapping key to the satellite virtual server instance,
wrapping a random guest key with the guest wrapping key, thereby producing a wrapped guest key, and
rewrapping the wrapped guest key with the master key to form a protected guest key.

### Claim 2 (depends on 1)

The method according to claim 1, further comprising unwrapping, via the satellite virtual server instance and the guest wrapping key, the wrapped guest key to form an unwrapped key, wherein the rewrapping occurs to the unwrapped key.

### Claim 3 (depends on 1)

The method according to claim 1, further comprising sending a conversion request from the guest virtual server, the conversion request comprising the guest credentials as a conversion argument.

### Claim 4 (depends on 1)

The method according to claim 1, further comprising maintaining, via the trusted hypervisor, a data memory associated with data needed to verify the guest credentials.

### Claim 5 (depends on 4)

The method according to claim 4, further comprising protecting the data memory with a passphrase.

### Claim 6 (depends on 1)

The method according to claim 1, further comprising computing, via the trusted hypervisor, data to verify the guest credentials, wherein the computing comprises using a cryptographic one-way function.

### Claim 7 (depends on 1)

The method according to claim 1, further comprising protecting the guest wrapping key via a hardware security module.

### Claim 8 (depends on 1)

The method according to claim 1, further comprising:
configuring the satellite virtual server instance with virtual server specific data; and
storing the virtual server specific data in a crypto control block of a virtual machine.

### Claim 9 (depends on 1)

The method according to claim 1, wherein the satellite virtual server instance has a sole interface, and
wherein the sole interface connects to the trusted hypervisor.

### Claim 10 (depends on 1)

The method according to claim 1, further comprising:
generating the random guest key via the trusted hypervisor using a service from the satellite virtual server instance,
wherein the wrapping of the random guest key occurs via the trusted hypervisor using the service from the satellite virtual server instance.

### Claim 11 (depends on 1)

The method according to claim 1, further comprising authorizing, by the trusted hypervisor, each request following the registering,
wherein the authorizing comprises using additional guest credentials provided with a respective request following the registering.

### Claim 12 (depends on 1)

The method according to claim 1, further comprising authorizing, by the trusted hypervisor, a further request of the guest virtual server following the registering, wherein the authorizing comprises using guest specific data.

### Claim 13

A computer system for cryptography, the computer system comprising:
one or more processors, one or more computer-readable memories, and program instructions stored on at least one of the one or more computer-readable memories for execution by at least one of the one or more processors to cause the computer system to:
register a guest virtual server with a trusted hypervisor by using guest credentials,
generate a guest wrapping key associated with the guest credentials,
generate in the trusted hypervisor a satellite virtual server instance that shares a master key with the virtual guest server,
pass a copy of the guest wrapping key to the satellite virtual server instance,
wrap a random guest key with the guest wrapping key, thereby producing a wrapped guest key, and
rewrap the wrapped guest key with the master key to form a protected guest key.

### Claim 14 (depends on 13)

The computer system according to claim 13, wherein the program instructions are further for execution by the at least one of the one or more processors to cause the computer system to unwrap, via the satellite virtual server instance and the guest wrapping key, the wrapped guest key to form an unwrapped key, wherein the rewrapping occurs to the unwrapped key.

### Claim 15 (depends on 13)

The computer system according to claim 13, wherein the program instructions are further for execution by the at least one of the one or more processors to cause the computer system to send a conversion request from the guest virtual server, the conversion request comprising the guest credentials as a conversion argument.

### Claim 16 (depends on 13)

The computer system according to claim 13, wherein the program instructions are further for execution by the at least one of the one or more processors to cause the computer system to maintain, via the trusted hypervisor, a data memory associated with data needed to verify the guest credentials.

### Claim 17 (depends on 16)

The computer system according to claim 16, wherein the program instructions are further for execution by the at least one of the one or more processors to cause the computer system to protect the data memory with a passphrase.

### Claim 18 (depends on 13)

The computer system according to claim 13, wherein the program instructions are further for execution by the at least one of the one or more processors to cause the computer system to compute, via the trusted hypervisor, data to verify the guest credentials, wherein the computing comprises using a cryptographic one-way function.

### Claim 19 (depends on 13)

The computer system according to claim 13, wherein the program instructions are further for execution by the at least one of the one or more processors to cause the computer system to protect the guest wrapping key via a hardware security module.

### Claim 20

A computer program product for cryptography, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions being executable by a processor to cause the processor to:
register a guest virtual server with a trusted hypervisor by using guest credentials,
generate a guest wrapping key associated with the guest credentials,
generate in the trusted hypervisor a satellite virtual server instance that shares a master key with the virtual guest server,
pass a copy of the guest wrapping key to the satellite virtual server instance,
wrap a random guest key with the guest wrapping key, thereby producing a wrapped guest key, and
rewrap the wrapped guest key with the master key to form a protected guest key.