知搜-全球专利检索

  1. 登录
  2. 注册

搜索结果

81 条记录 (耗时 0.039 秒)

    Secure initial program load
    1.
    发明授权
    Secure initial program load 有权

    公开(公告)号：US11574060B2

    公开(公告)日：2023-02-07

    申请号：US16392833

    申请日：2019-04-24

    申请人： INTERNATIONAL BUSINESS MACHINES CORPORATION

    发明人： Louis P. Gomes ,  Martin Schwidefsky ,  Reinhard T. Buendgen ,  Viktor Mihajlovski

    IPC分类号： G06F21/57

    摘要： An initial program load of a system component of a computing environment is performed. A determination is made as to whether one or more signatures of one or more signed binary code components relating to the system component are verified. Based on determining that the one or more signatures are verified, additional verification is performed. The additional verification includes obtaining a select binary code component of one or more binary code components relating to the system component and determining whether the select binary code component is a particular signed binary code component. Based on determining that the select binary code component is the particular signed binary code component, a check is performed. The initial program load is continued based on a successful check.

    SECURE EXECUTION GUEST OWNER CONTROLS FOR SECURE INTERFACE CONTROL
    3.
    发明申请
    SECURE EXECUTION GUEST OWNER CONTROLS FOR SECURE INTERFACE CONTROL 审中-公开

    公开(公告)号：US20200285759A1

    公开(公告)日：2020-09-10

    申请号：US16296478

    申请日：2019-03-08

    申请人： International Business Machines Corporation

    发明人： Reinhard T. Buendgen ,  Jonathan D. Bradbury

    IPC分类号： G06F21/60 ,  G06F9/455 ,  G06F21/64 ,  H04L9/14 ,  H04L9/08 ,  G06F21/57

    摘要： A method, computer program product, and a system where a secure interface control determines functionality of a secure guest based on metadata. The secure interface control (“SC”) obtains metadata linked to an image of a secure guest to be started by an owner and managed by the hypervisor, where the metadata comprises control(s) that indicate whether a secure guest generated with the image is permitted to obtain a response to a particular request. The SC intercepts, from the secure guest generated with the image, during runtime, a request. The SC determines, based on the control(s), if the secure guest is permitted to obtain a response to the request. If permitted, the SC commences fulfillment of the request, within the computing system. If not permitted, the SC ignores the request.

    BINDING SECURE KEYS OF SECURE GUESTS TO A HARDWARE SECURITY MODULE
    4.
    发明申请
    BINDING SECURE KEYS OF SECURE GUESTS TO A HARDWARE SECURITY MODULE 审中-公开

    公开(公告)号：US20200285746A1

    公开(公告)日：2020-09-10

    申请号：US16296411

    申请日：2019-03-08

    申请人： International Business Machines Corporation

    发明人： Reinhard T. Buendgen ,  Tamas Visegrady ,  Ingo Franzki

    IPC分类号： G06F21/57 ,  G06F9/455 ,  H04L9/08

    摘要： A method, computer program product, and a system where a secure interface control configures a hardware security module for exclusive use by a secure guest. The secure interface control (“SC”) obtains a configuration request (via a hypervisor) to configure the hardware security module (HSM), from a given guest of guests managed by the hypervisor. The SC determines if the HSM is already configured to a specific guest of the one or more guests, but based on determining that the HSM is not configured to the and is a secure guest the SC forecloses establishing a configuration of the HSM by limiting accesses by guests to the HSM exclusively to the given guest. The SC logs the given guest into the HSM by utilizing a secret of the given guest. The SC obtains, from the HSM, a session code and retains the session code.

    Resource-based boot sequence
    5.
    发明授权
    Resource-based boot sequence 有权

    公开(公告)号：US10585671B2

    公开(公告)日：2020-03-10

    申请号：US15651181

    申请日：2017-07-17

    申请人： International Business Machines Corporation

    发明人： Reinhard T. Buendgen ,  Jakob C. Lang ,  Volker Boenisch ,  Angel Nunez Mencias

    IPC分类号： G06F9/4401 ,  G06F9/445 ,  G06F9/50

    摘要： A computer-implemented method, for booting a computer system, that provides a list with entries of startup processes. Each startup process defines a resource of the computer system. For each startup process a requirement is defined. The method further comprises fetching one of the entries of the list with entries of startup processes; determining whether the requirement is satisfied for the one of the entries of the list with entries of startup processes; fetching, in case the requirement is not fulfilled, a next one of the entries of the list with entries of startup processes; starting, in case the required resource is fulfilled, the startup process; and repeating the fetching a next one of the entries, the determining and the starting until all startup processes of the list of startup processes have been started.

    Method for booting and dumping a confidential image on a trusted computer system
    10.
    发明授权
    Method for booting and dumping a confidential image on a trusted computer system 有权
    在受信任的计算机系统上引导和转储机密图像的方法

    公开(公告)号：US09454662B1

    公开(公告)日：2016-09-27

    申请号：US15071303

    申请日：2016-03-16

    申请人： International Business Machines Corporation

    发明人： Reinhard T. Buendgen ,  James A. O'Connor ,  William J. Rooney

    IPC分类号： G06F11/30 ,  G06F21/57

    CPC分类号： H04L63/0853 ,  G06F9/4406 ,  G06F9/4416 ,  G06F12/14 ,  G06F21/121 ,  G06F21/53 ,  G06F21/57 ,  G06F21/572 ,  G06F21/575 ,  G06F21/602 ,  G06F2221/034 ,  G06F2221/2107 ,  H04L9/08 ,  H04L9/14 ,  H04L9/3263 ,  H04L63/0442 ,  H04L63/061 ,  H04L63/0876

    摘要： A method for booting a confidential image on a trusted computer system. A trusted computer system loads an encrypted client image key onto a protected area on the trusted computer system. The trusted computer system loads an encrypted boot image onto a secure logical partition on the trusted computer system. The trusted computer system decrypts the encrypted client image key to obtain a client image key in the protected area. The trusted computer system decrypts, with the client image key, the encrypted boot image to obtain a boot image and a client data key. The trusted computer system starts the boot image, and the boot image mounts the encrypted client data onto the secure logical partition. The client data key is used by the boot image to decrypt data read from the encrypted client data and to encrypt data written to the encrypted client data.

    摘要翻译： 用于在可信计算机系统上引导机密图像的方法。 受信任的计算机系统将加密的客户端映像密钥加载到可信计算机系统上的保护区域上。 受信任的计算机系统将加密的引导映像加载到可信计算机系统上的安全逻辑分区上。 受信任的计算机系统解密加密的客户端图像密钥以获得保护区域中的客户端图像密钥。 受信任的计算机系统利用客户端图像密钥解密加密的引导映像，以获得引导映像和客户端数据密钥。 受信任的计算机系统启动引导映像，引导映像将加密的客户端数据加载到安全逻辑分区上。 引导映像使用客户端数据密钥来解密从加密的客户端数据读取的数据，并加密写入加密的客户机数据的数据。