International Business Machines Corporation

Helmut H Weber

Steven A Bade

Gerhard Banzhaf

Kenneth Wayne Boyd

Siegfried Sutter

Thomas J Dewkett

Nia Letise Kelley

Harry M Yudenfriend

Charles W Gainey, Jr

Richard Louis Arndt

Kenneth Fairclough Day, Iii

Thomas Schlipf

Stefan Amann

Jeffrey William Palm

Maor Ben-Dayan

Kristiann J Schultz

Ahmed Abbas

James Peter Ward

Gerd Breiter

James Patrick Hoff

Ronald Perez

Erich Klink

Christine Axnix

Michael Man Behrendt

Roland Frech

Hubert Harrer

Andreas Bieswanger

Leendert Peter Van Doorn

Dietmar Schmunkamp

Friedemann Baitinger

Andrea Schmidt

Bernd Garben

Stefan Wirag

Deploying a software service. A defined software service offering is selected from a plurality of defined software service offerings. An instantiation order for deploying the selected defined software service offering on a corresponding computer system is generated. Each defined software service offering comprises a software service definition and at least one defined software policy. One selected from the group consisting of the software service definition, the software policy, and a combination thereof, provides a hardware configuration for the software service, a software configuration for the software service, and a managing policy for the software service. The instantiation order of the software service for execution on the computer system is created based on the hardware configuration, the software configuration and the managing policy.

Method, arrangement, computer program product and data processing program for deploying a software service

An enhanced mechanism for providing data protection for variable length records utilizes high performance block storage metadata. In an embodiment, an emulated record that emulates a variable length record, such as a Count-Key-Data (CKD) record or an Extended-Count-Key-Data (ECKD) record, is generated by a Host Bus Adapter (HBA) of a mainframe system. The emulated record comprises a sequence of extended fixed-length blocks, each of which includes a data block and a footer. A confluence of the footers defines a high performance block storage metadata unit associated with the emulated record and includes a checksum that covers all data blocks and all footers of the entire emulated record. In one embodiment, the checksum is checked during transit of the emulated record between a HBA and a storage subsystem (e.g., by the HBA when the emulated record is received from the storage subsystem, and/or by a switch in the data transfer path), during a hardening step when writing the emulated record to a disk, and/or during a verification step when reading the emulated record from the disk.

Data protection for variable length records by utilizing high performance block storage metadata

For block based end-to-end data protection for extended count key data (ECKD) in a computing environment, information units (IU's) are aligned in a block boundary format. Block protection trailer data is added to each one of the IU's.

Blocked based end-to-end data protection for extended count key data (ECKD)

A method and apparatus are disclosed in a data processing system for establishing virtual endorsement credentials. The data processing system includes a hardware trusted platform module (TPM). Logical partitions are generated in the system. A different virtual TPM is generated for each one of the logical partitions. For each one of the logical partitions, the virtual TPM that was generated for the logical partition then dynamically generates a virtual endorsement key, which is stored only within a corresponding virtual TPM. Using the virtual endorsement key, each virtual TPM also generates a virtual endorsement credential for use by the logical partition that includes the virtual TPM. The virtual endorsement credential is generated within the data processing system without the data processing system or its devices accessing a trusted third party that is external to the data processing system.

Establishing virtual endorsement credentials for dynamically generated endorsement keys in a trusted computing platform

Exemplary method, system, and computer program product embodiments for block based end-to-end data protection for extended count key data (ECKD) in a computing environment are provided. In one embodiment, by way of example only, information units (IU's) are aligned in a block boundary format. Block protection trailer data is added to each one of the IU's. Additional system and computer program product embodiments are disclosed and provide related advantages.

A system for virtualizing information technology (IT) appliances can include an IT appliance hosting facilities software. The IT appliance hosting facilities software can be implemented at a layer of abstraction above a virtual machine host, which is implemented in a layer of abstraction above a hardware layer of a computing system. The IT appliance hosting facilities software can include programmatic code functioning as virtualized hardware upon which a set of IT appliance software modules are able to concurrently run. The IT appliance hosting facilities software can provide caching, application level security, and a standardized framework for running the IT appliance software modules, which are configured in conformance with the standardized framework.

Runtime environment for virtualizing information technology appliances

Data protection method for variable length records by utilizing high performance block storage metadata

A method, system and computer program product for enhancing the functionality of the existing core root of trust measurement (CRTM). The CRTM is extended to allow platform manufacturer controlled and certified code to be incorporated into the function of the CRTM, wherein the manufacturer may define the policy for accepting a new function into the CRTM. When a firmware or software module image is compiled, the build process generates a hash value of the compiled firmware or software image, wherein the hash value reflects a fingerprint (or short hand) representation of the compiled image. A determination is made as to whether the hash value of the firmware or software image is to be a CRTM extension. If so, a digital signature of the module is created using the CRTM extension private key. This signature value is added to the firmware or software module.

Method for extending the CRTM in a trusted platform

Multiple logical partitions are provided in a data processing system. A unique context is generated for each one of the logical partitions. When one of the logical partitions requires access to the hardware TPM, that partition's context is required to be stored in the hardware TPM. The hardware TPM includes a finite number of storage locations, called context slots, for storing contexts. Each context slot can store one partition's context. Each one of the partitions is associated with one of the limited number of context storage slots in the hardware TPM. At least one of the context slots is simultaneously associated with more than one of the logical partitions. Contexts are swapped into and out of the hardware TPM during runtime of the data processing system so that when ones of the partitions require access to the hardware TPM, their required contexts are currently stored in the hardware TPM.

Product for providing a scalable trusted platform module in a hypervisor environment

A computer implemented method for recovering a partition context in the event of a system or hardware device failure. Upon receiving a command from a partition to modify context data in a trusted platform module (TPM) hardware device, a trusted platform module input/output host partition (TMPIOP) provides an encrypted copy of the context data and the command to the TPM hardware device, which processes the command and updates the context data. If the TPM hardware device successfully processes the command, the TMPIOP receives the updated context data from the TPM hardware device and stores the updated context data received in encrypted form in a context data cache or a non-volatile storage off-board the TPM hardware device. If the TPM hardware device fails to successfully process the command, the TMPIOP uses a last valid copy of the context data to retry processing of the command on a different TPM hardware device.

Protocol for trusted platform module recovery through context checkpointing

A method is described for implementing a trusted computing environment within a data processing system where the data processing system includes a single hardware trusted platform module (TPM). Multiple logical partitions are provided in the data processing system. A unique context is generated for each one of the logical partitions. When one of the logical partitions requires access to the hardware TPM, that partition's context is required to be stored in the hardware TPM. The hardware TPM includes a finite number of storage locations, called context slots, for storing contexts. Each context slot can store one partition's context. Each one of the partitions is associated with one of the limited number of context storage slots in the hardware TPM. At least one of the context slots is simultaneously associated with more than one of the logical partitions. Contexts are swapped into and out of the hardware TPM during runtime of the data processing system so that when ones of the partitions require access to the hardware TPM, their required contexts are currently stored in the hardware TPM.

Method for providing a scalable trusted platform module in a hypervisor environment

Method for reducing a transient thermal mismatch

Growing community of inventors

Dettenhausen, Germany

Helmut H Weber