International Business Machines Corporation

Angel Nunez Mencias

Jakob Christopher Lang

Reinhard Theodor Buendgen

Christine Axnix

Thomas Pohl

Ute Gaertner

Franziska Geisert

Albert Schirmer

Martin Troester

Volker Boenisch

Gerhard Banzhaf

Eric A Weinmann

James M Jenks

Jochen Schweflinghaus

Mareike Lattermann

Rene Trumpp

Utz Bacher

Klaus Werner

Joerg Schmidbauer

Stefan Usenbinz

Victor Rafael Escobar Olmos

Stefan Liesche

Nicolas Maeding

Dirk Herrendoerfer

Andreas Maier

Volker M M Boenisch

Peter Morjan

Martin Recktenwald

Timo Kussmaul

Marco Kraemer

Ulrich Mayer

Einar Lueck

Stefan Amann

Karunakar Bojjireddy

Sven Sterbling

Marco Pavone

Erlander Lo

James Robert Magowan

Fabian Romanowski

Tomas Libal

Michael Holzheu

David F Craddock

Christoph Raisch

Dirk Bolte

Joseph M Gdaniec

Gerd Konrad Bayer

Christopher S Smith

Marco H Kroll

Benno Schuepferling

Dennis Zeisberg

Martin Tröster

Natalie Speiser

Sebastian Hense

Dimitrij Pankratz

Florian Fritz

Justin D Miller

Fabian Kulmann

Preethi Polepalli Yeshwanth

Takuya Nakaike

Anbazhagan Mani

Michael J Jordan

Moriyoshi Ohara

Roland Seiffert

Martin Schwidefsky

David G Chapman

Stefan Roscher

Herwig Gustav Elfering

Kai Brennenstuhl

Ralf Schaufler

Simon Spinner

Holger Smolinski

Edward McCarthy

Robert Breker

Robert Kieninger

Natalia V Ivanova

Peter James De Meo

An example operation may include one or more of storing one or more public keys of one or more policy services, receiving, via a signing service, a blockchain transaction that has content that has been verified by a policy service and includes a signature created by a private key of the policy service, verifying, via a hardware security module (HSM), the signature of the policy service based on a public key of the policy service from among the one or more public keys, and in response to a verification of the signature of the policy service, signing, via the HSM, the blockchain transaction using a wallet key of a user of the blockchain transaction.

Digital asset platform with HSM verification

A computer-implemented method for monitoring and auditing secure software builds is disclosed. The computer-implemented includes receiving a build file containing a sequence of build instructions. The computer-implemented method further includes, for each build instruction being executed: determining an indicator value corresponding to a monitoring level associated with a build instruction; and modifying logging of trace information associated with a computing system executing the build instruction based, at least in part, on the indicator value corresponding to the monitoring level.

Monitoring and auditing secure software builds

A method includes: federating, by a computer device, a proxy hardware security module from a physical hardware security module; storing, by the computer device, the proxy hardware security module; receiving, by the computer device, a first one of a plurality of periodic identifying communications from the physical hardware security module; and erasing, by the computer device, the proxy hardware security module as a result of the computer device not receiving a second one of the plurality of periodic identifying communications.

HSM self-destruction in a hybrid cloud KMS solution

A computer-implemented method for managing a life-cycle of at least in parts interdependent cryptographic keys is disclosed. Each of the cryptographic keys is signed and relates to a different one of artifacts. The method comprises creating a key manifest, wherein the key manifest comprises data about determined dependencies of the cryptographic keys at a point in time when one of the artifacts is built encrypting the key manifest with a manifest key, and upon a life-cycle change happening to one out of the group comprising one of the artifacts and one of the interdependent cryptographic keys in the key manifest of the one of the artifacts, the method comprises decrypting the key manifest and invoking an action to a related one out of the group comprising the one of the artifacts and at least one of the interdependent cryptographic keys in accordance with the key manifest.

Chained manifest for key management and attestation

Securing pods in a container orchestration environment is provided. A container runtime interface command is verified to perform an orchestration action on a set of containers comprising an application workload that corresponds to a service based on matching the container runtime interface command to a rule contained in a trusted execution environment contract included in a pod sandbox virtual machine of a trusted execution environment. It is determined whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract. In response to determining that the container runtime interface command to perform the orchestration action on the set of containers is valid, the container runtime interface command is executed to perform the orchestration action on the set of containers in the pod sandbox virtual machine of the trusted execution environment.

Securing pods in a container orchestration environment

A computer-implemented method for securely transferring a secret from a source computing component to a target computing component, wherein the source computing component and the target computing component are part of a secure computing environment is disclosed. The method comprises upon the source computing component receiving from the target computing component a signed attestation document, verifying, by the source computing component, an authenticity and content of the attestation document, and upon a successful verification of the authenticity and the content, transferring, by the source computing component the secret to the target computing system. Thereby, the attestation document is attesting that the target computing component is compliant to an update governance rule.

Trusted system upgrade and secrets transfer in a secure computing environment

Aspects of the invention include loading an image of a virtual server onto a boot partition of a trusted execution environment (TEE), wherein a first key is embedded in the image. A second key is received from an end customer of an application. Data is received from an independent software vendor (ISV) of the application, wherein the data includes a third key. The second key and the third key are combined inside the TEE to create a fourth key. An available memory space in an independent memory device is encrypted using the fourth key to create a secure data volume. Encrypted data is stored in the secure data volume.

Storage encryption for a trusted execution environment

A computer-implemented method for building trusted executable software using trusted building units, wherein a path between the building units is untrusted, is disclosed. The method comprises generating, by each of the trusted building units, an identifier for identifying an output of the respective trusted building unit, wherein the respective trusted building unit also generates a signed confirmative certificate comprising the identifier. The method comprise as well utilizing, by each of the distributed trusted building units, output results of at least one of a predecessor build unit of the trusted building unit as input, validating that each of the signed confirmative certificates conforms to a predefined set of policy rules, and upon a failed validating of the signed confirmative certificate of one of the trusted building units, terminating the building of the trusted executable software.

Trust validation for software artifacts

The present disclosure relates to a computer implemented method for executing an application. The method comprises: executing a bootloader in a trusted execution environment, wherein the executing comprises: decrypting received encrypted secrets using decryption keys of the boot loader, storing the decrypted secrets in a storage accessible by the application, creating a proof record indicating the application, the secrets and the trusted execution environment, storing the proof record in the storage, and deleting the decryption keys. The application may be executed in the trusted execution environment using the decrypted secrets. The proof record may be provided by the application for proving authenticity.

Trusted workload execution

Multiple work requests from different applications are queued to be processed subsequently without interruption by a crypto device. A prediction table is generated for each application to be processed by the crypto device. An initial credit value is determined for each incoming work request. The work request is an entry in an ordered queue in the order of time using respective time stamps. The next work request to be processed is selected from the entries in the queue by using the first entry in the queue for which the credit values for the corresponding application is greater than or equal to the predicted execution time for the corresponding request type in the prediction table. The selected next work request is processed.

Crypto device operation

The present disclosure relates to a method for deploying an application in an execution environment using a first and second sets of key pairs. The method comprises: creating a sequence of tasks comprising build tasks followed by a deploy task. The tasks are configured to receive a task input for performing the tasks. The task input comprises a contribution input and an output of a task preceding at least one of the build tasks. The contribution input comprises secrets. The output of the build tasks is encrypted with a respective encryption key of the first set of key pairs, wherein the contribution input of a task subsequent to the first task is encrypted with a respective encryption key of the second set of keys. The tasks may be executed in the execution environment using unencrypted content of the task inputs.

Building and deploying an application

A method for sharing secret data between multiple containers. In response to the initial booting of an operating system instance in a container, a unique operating system identifier is generated for the operating system instance. A grant authority stores the unique operating system identifier in a reserved area of a secure storage device. In response to a request from the operating system instance to access secret data in the secure storage device, the grant authority determines whether the unique operating system identifier is stored in the secure storage device. The operating system instance may be granted access to secret data in the non-reserved area of the secure storage device.

Sharing secret data between multiple containers

An aspect includes receiving a software image file set and a capacity requirement at a software image distribution system. A software image is generated based on the software image file set. A license record is generated based on the capacity requirement. The software image and the license record are provided to an external interface of the software image distribution system. An installation action is triggered by the software image distribution system on to a machine based on a request of an ordering system.

Processing unit subtype configuration

An example operation may include one or more of receiving a unique identifier and a security value from an object, retrieving a previously stored security value of the object from a database based on the received unique identifier, determining that the object is verified based on the received security value and the previously stored security value, and modifying the previously stored security value to generate a modified security value and transmitting the modified security value to the database.

Tracking and verification of physical assets

A computer program product, the computer program product including a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer device to cause the computer device to: federate a proxy hardware security module from a physical hardware security module; store the proxy hardware security module; receive a first one of a plurality of periodic identifying communications from the physical hardware security module; and erase the proxy hardware security module as a result of the computer device not receiving a second one of the plurality of periodic identifying communications.

Growing community of inventors

Stuttgart, Germany

Angel Nunez Mencias