Vmware, Inc.

Bo Gan

Alexey Makhalov

Ravishankar Chamarajnagar

Raghunath Krishnamurthy

Sriram Nambakam

Maria Potapova

Sharath George

The disclosure herein describes integrity verification of a checksum of a canister data structure using built-in checksum verification capability. A kernel image is accessed, and a canister data structure is allocated in a section of memory. The canister data structure is loaded with canister data from the kernel image, wherein the loading is based on an interpreter obtained from the kernel image, wherein the canister data includes address relocation data and a checksum of the canister data. A binary image of the canister data structure is assembled, wherein the assembling includes at least performing reverse relocation on the canister data structure using the address relocation data. A checksum is generated based on the assembled binary image, and the checksum of the canister data is verified using the generated checksum. The integrity of the canister data structure is confirmed based on the verification.

Verifying object file canisters using built-in reverse relocation integrity checking

The present disclosure relates to centralized volume encryption key management for edge devices with trusted platform modules (TPM)s. In some aspects a volume encryption key is generated for a gateway device. A sealing authorization policy is also generated for the gateway device. The sealing authorization policy is generated based on a predetermined platform configuration register (PCR) mask and expected PCR values. The volume encryption key and the sealing authorization policy are transmitted from the management service to the gateway device to provision the gateway device with the volume encryption key.

Centralized volume encryption key management for edge devices with trusted platform modules

Growing community of inventors

Bellevue, WA, United States of America

Bo Gan