Secure connection of virtual machine to hardware security module

A system for securely connecting a secure virtual machine (secVM) to a remote hardware security module (HSM), the system comprising:

• a trusted execution environment (TEE) comprising hardware and firmware configured to:
• store a connection credential for accessing the remote HSM,
• negotiate a connection credential wrapping key (CCWK) with the remote HSM,
• encrypt the connection credential using the CCWK to generate a wrapped connection credential,
• derive a transport key (TKCC) from the connection credential, and
• provide a protected version of the transport key (pTKCC) to the secVM;
• and
• the secVM configured to:
• receive the wrapped connection credential and the pTKCC from the TEE, and
• establish a secure connection with the remote HSM using the wrapped connection credential.

A computer program product comprising a computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform a method for securely connecting a secure virtual machine (secVM) to a remote hardware security module (HSM), the method comprising:

• requesting a wrapped connection credential from a trusted execution environment;
• receiving, by the secVM, a wrapped connection credential and a protected version of a transport key (pTKCC) from a trusted execution environment (TEE), the wrapped connection credential wrapped created by wrapping a connection credential (CC) stored in the TEE using a connection credential wrapping key negotiated between the TEE and the HSM;
• and
• establishing, by the secVM, a secure connection with the remote HSM using the wrapped connection credential, wherein communication over the secure connection is encrypted using a connection credential transport key (TKCC).