Method and apparatus for migrating a virtual TPM instance and preserving uniqueness and completeness of the instance
AssigneeInternational Business Machines Corporation
InventorsStefan Berger, Kenneth A. Goldman, Reiner Sailer
Life of this patent
Estimating the term…
Abstract
A migration scheme for virtualized Trusted Platform Modules is presented. The procedure is capable of securely migrating an instance of a virtual Trusted Platform Module from one physical platform to another. A virtual Trusted Platform Module instance's state is downloaded from a source virtual Trusted Platform Module and all its state information is encrypted using a hybrid of public and symmetric key cryptography. The encrypted state is transferred to the target physical platform, decrypted and the state of the virtual Trusted Platform Module instance is rebuilt.
Claims31
A computer implemented method for migrating a virtual trusted platform module instance, the computer implemented method comprising:
- locking the virtual trusted platform module instance, wherein locking the virtual trusted platform module instance comprises freezing a state of a virtual trusted module instance, wherein once frozen, the virtual trusted module instance will no longer accept normal trusted platform module commands, but will only accept commands related to migrating the virtual trusted module, wherein the state of the virtual trusted platform module instance may be exported after the virtual trusted module instance has been locked and wherein the virtual trusted platform module instance cannot be unlocked once the virtual trusted platform module instance has been locked,
- exporting the state of the virtual trusted platform module instance through a parent virtual trusted platform module instance on a source platform, wherein the parent virtual trusted platform module instance on the source platform has control over a life-cycle of the virtual trusted platform module instance on the source platform;
- and
- importing the state of the virtual trusted platform module instance through a parent virtual trusted platform module instance on a destination platform, wherein the parent virtual trusted platform module instance on the destination platform has control over a life-cycle of the virtual trusted platform module instance on the destination platform.
A computer program product comprising a non-transitory computer usable medium including computer usable program code for the migration of virtual trusted platform module instances, said computer program product comprising:
- computer usable program code for locking a virtual trusted platform module instance, wherein locking the virtual trusted platform module instance comprises freezing a state of the virtual trusted module instance, wherein once frozen, the virtual trusted module instance will no longer accept normal trusted platform module commands, but will only accept commands related to migrating the virtual trusted module, wherein the state of the virtual trusted platform module instance may be exported after the virtual trusted module instance has been locked and wherein the virtual trusted platform module instance cannot be unlocked once the virtual trusted platform module instance has been locked;
- computer usable program code for exporting the state of the virtual trusted platform module instance through a parent virtual trusted platform module instance on a source platform, wherein the parent virtual trusted platform module instance on the source platform has control over a life-cycle of the virtual trusted platform module instance on the source platform;
- and
- computer usable program code for importing the state of the virtual trusted platform module instance through a parent virtual trusted platform module instance on a destination platform, wherein the parent virtual trusted platform module instance on the destination platform has control over a life-cycle of the virtual trusted platform module instance on the destination platform.
A system for the migration of virtual trusted platform module instances, comprising:
- a storage device, wherein the storage device stores computer usable program code;
- and
- a processor, wherein the processor executes the computer usable program code to:
- lock the virtual trusted platform module instance, wherein locking the virtual trusted platform module instance comprises freezing a state of a virtual trusted module instance, wherein once frozen, the virtual trusted module instance will no longer accept normal trusted platform module commands, but will only accept commands related to migrating the virtual trusted module, wherein the state of the virtual trusted platform module instance may be exported after the virtual trusted module instance has been locked and wherein the virtual trusted platform module instance cannot be unlocked once the virtual trusted platform module instance has been locked;
- and to export the state of the virtual trusted platform module instance through a parent virtual trusted platform module instance on a source platform;
- and import the state of the virtual trusted platform module instance through a parent virtual trusted platform module instance on a destination platform.
Dependencies are inferred from the claim text.