Distributed trusted platform module key management protection for roaming data

A system, comprising first processing circuitry, a first hardware security module corresponding to the first processing circuitry, second processing circuitry, and a second hardware security module corresponding to the second processing circuitry;

• the first processing circuitry configured to execute a virtual machine (VM) with a first virtual security module that is associated therewith and that is an instance of the first hardware security module, the first virtual security module having state data associated with the VM that includes a cryptographic storage key that encrypts data of a virtual disk of the VM, the state data being encrypted with the cryptographic security key;
• the first hardware security module storing a cryptographic security key;
• the second hardware security module storing:
• a public transfer key and a private transfer key linked thereto;
• the first hardware security module configured to:
• encrypt the cryptographic security key using the public transfer key received from the second hardware security module;
• and
• provide the encrypted cryptographic security key to the second hardware security module;
• the second hardware security module configured to:
• decrypt, using the private transfer key, the encrypted cryptographic security key;
• and
• the second processing circuitry configured to:
• execute the VM, subsequent to a transfer thereof from the first processing circuitry, with a second virtual security module that is an instance of the second hardware security module and based at least on the state data being decrypted for the second virtual security module using the cryptographic security key.

Computer-readable storage media having program instructions recorded thereon that, when executed by a processing system that includes first processing circuitry, a first hardware security module corresponding to the first processing circuitry, second processing circuitry, and a second hardware security module corresponding to the second processing circuitry, perform a method, the method comprising:

• encrypting a cryptographic security key by the first hardware security module, which stores the cryptographic security key, using a public transfer key received from the second hardware security module;
• providing the encrypted cryptographic security key to the second hardware security module;
• determining that a transfer condition has been met for transferring a virtual machine (VM) to be executed by the second processing circuitry, the VM having a first virtual security module associated therewith, which is an instance of the first hardware security module, the first virtual security module having state data associated with the VM that includes a cryptographic storage key that encrypts data of a virtual disk of the VM, and the state data being encrypted with the cryptographic security key;
• and
• executing the VM at the second processing circuitry, using a second virtual security module that is an instance of the second hardware security module, as a part of said transferring, based at least in part on:
• decrypting, by the second hardware security module and using a private transfer key corresponding to the public transfer key, the encrypted cryptographic security key, and
• decrypting the state data for the second virtual security module using the cryptographic security key.