International Business Machines Corporation

Jakob Christopher Lang

Angel Nunez Mencias

Reinhard Theodor Buendgen

Franziska Geisert

Volker Boenisch

Christine Axnix

Thomas Pohl

Mareike Lattermann

Martin Troester

Ute Gaertner

Jochen Schweflinghaus

Angel Nunez-Mencias

Albert Schirmer

Rene Trumpp

Marco Kraemer

Klaus Werner

Joerg Schmidbauer

Volker M M Boenisch

Budy D Notohardjono

Victor Rafael Escobar Olmos

Sven Sterbling

Andreas Maier

Franz Hardt

Benno Schuepferling

Tomas Libal

Fabian Romanowski

Martin Recktenwald

Christoph Raisch

Ulrich Mayer

Marco H Kroll

Michael Holzheu

Dirk Bolte

Stefan Roscher

Brian D Valentine

Gerd Konrad Bayer

James Richard Coon

Garry Joseph Sullivan

Christopher S Smith

Victor M Lourenco

Richard J Gusefski

Dennis Zeisberg

Natalie Speiser

Christoph Vincent Schlameuss

Fabian Kulmann

Roger D Krsnak

Jan Schneider

Cedric Lichtenau

Utz Bacher

Kenneth Alan Goldman

Carsten Otte

Martin Schwidefsky

Christian Borntraeger

David G Chapman

Herwig Gustav Elfering

Stefan Usenbinz

Eberhard Pasch

Martin Tröster

Karsten Graul

Robert Kieninger

Reinard T Buendgen

Victor Rafael Escobar-Olmos

Andreas O Loesche

Florian Schaefer

Angel N Mencias

A computer-implemented method of using a workload management system designed for workloads of a first computing architecture as well as for workloads of a second computing architecture is disclosed. The method comprises deploying a workload management control plane under a first computing architecture, identifying, by the workload management control plane, a requested remote workload only available for the second computing architecture, creating, by the workload management control plane, a proxy compute resource as interface for the requested remote workload, starting, by the proxy compute resource, the remote workload, controlling, by the proxy compute resource, an operation of the remote workload in a 1:1 relationship, by: upon receiving a termination signal, terminating the remote workload by the proxy compute resource and self-terminating the proxy compute resource, and upon a termination of the remote workload terminate the proxy compute resource.

Managing workloads in a container orchestration system

A computer-implemented method, computer system and a computer program product schedule a secure code segment on a processor core of a processing unit between threads, wherein the processing unit is executing a program code of operating instructions of a thread on the at least one processor core. The method comprises a first thread requesting exclusive secure execution of a secure code segment of the program code on the at least one processor core. The method also comprises checking the request based on a secure-operation parameter that controls a request for exclusive secure execution of a secure code segment. The method further comprises, if the secure-operation parameter is below a predefined threshold value, setting the at least one processor core to exclusive secure execution for the secure code segment and periodically resetting the secure-operation parameter. If the secure-operation parameter is not below the threshold, then the method switches to another thread.

Scheduling a secure code segment on a processor core of a processing unit

Multiple work requests from different applications are queued to be processed subsequently without interruption by a crypto device. A prediction table is generated for each application to be processed by the crypto device. An initial credit value is determined for each incoming work request. The work request is an entry in an ordered queue in the order of time using respective time stamps. The next work request to be processed is selected from the entries in the queue by using the first entry in the queue for which the credit values for the corresponding application is greater than or equal to the predicted execution time for the corresponding request type in the prediction table. The selected next work request is processed.

Crypto device operation

A method for sharing secret data between multiple containers. In response to the initial booting of an operating system instance in a container, a unique operating system identifier is generated for the operating system instance. A grant authority stores the unique operating system identifier in a reserved area of a secure storage device. In response to a request from the operating system instance to access secret data in the secure storage device, the grant authority determines whether the unique operating system identifier is stored in the secure storage device. The operating system instance may be granted access to secret data in the non-reserved area of the secure storage device.

Sharing secret data between multiple containers

Provided is a method and system for protecting the integrity of a computing system. The system may initialize a plurality of trusted platform modules (TPMs) within the computing system. The system may read a unique identifier corresponding to each TPM of the plurality of TPMs to determine a system state. The system may write the system state to platform configuration registers (PCRs) of each of the plurality of TPMs. The system may load a sealed private owner key part into each TPM of the plurality of TPMs. The plurality of TPMs may determine if a predetermined number of unique identifiers have been processed by validating a value of the PCRs to meet an owner key policy. The plurality of TPMs may unseal the private owner key part in each TPM where the value of the PCRs meets the owner key policy.

Trusted platform module swarm

An aspect includes receiving a software image file set and a capacity requirement at a software image distribution system. A software image is generated based on the software image file set. A license record is generated based on the capacity requirement. The software image and the license record are provided to an external interface of the software image distribution system. An installation action is triggered by the software image distribution system on to a machine based on a request of an ordering system.

Processing unit subtype configuration

An example operation may include one or more of receiving a unique identifier and a security value from an object, retrieving a previously stored security value of the object from a database based on the received unique identifier, determining that the object is verified based on the received security value and the previously stored security value, and modifying the previously stored security value to generate a modified security value and transmitting the modified security value to the database.

Tracking and verification of physical assets

Technology for decrypting and using a security module in a processor cache in a secure mode such that dynamic address translation prevents access to portions of the volatile memory outside of a secret store in a volatile memory.

Computer system software/firmware and a processor unit with a security module

Auditably proving a usage history of an asset, in which the asset includes a hardware security module with at least a public key and a private key. A client application logs hash values of a pair of request data and response data. Usage history of the asset is proved. The proving includes verifying, using the public key, a signature of other hash values of the pair of request data and response data. The other hash values are signed with the private key. The proving further includes comparing the hash values logged by the client application with the other hash values.

Auditably proving a usage history of an asset

A computer-implemented method for distributing computing tasks to individual computer systems from a first pool of first computer systems, characterized by controllers executing a specific firmware with a gateway to receive commands via a network and an orchestration unit, whereby in response to a request to perform a computing task, an available and suitable first computer system is selected. An available second computer system is selected from a second pool. A firmware image corresponding to a requested controller firmware level is selected, using a gateway connector to send commands to the gateways. A network connection is established between the gateway in the controller of the first computer system and the gateway connector in the second computer system. Execution of the firmware image is triggered.

Distributing computing tasks to individual computer systems

A cloud computing system includes a virtual server outputs non-encrypted data and receives encrypted data in response to receiving a write request signal and a read request signal. A hosting server hypervisor receives the write request signal and the read request signal. In response to receiving the write request signal the hosting server hypervisor writes encrypted data corresponding to the write request signal into a storage device. In response to receiving the read request signal the hosting server hypervisor obtains encrypted data corresponding to a data read request signal from the storage device and outputs the encrypted data. A secure channel sub-system is installed between the at least one virtual server and the hosting server hypervisor. The secure channel sub-system stores a virtual device key in a key storage unit and prevents the virtual server and the hosting server hypervisor from accessing the key

I/O encryption device protected against malicious hypervisors

A computer-implemented method, for booting a computer system, that provides a list with entries of startup processes. Each startup process defines a resource of the computer system. For each startup process a requirement is defined. The method further comprises fetching one of the entries of the list with entries of startup processes; determining whether the requirement is satisfied for the one of the entries of the list with entries of startup processes; fetching, in case the requirement is not fulfilled, a next one of the entries of the list with entries of startup processes; starting, in case the required resource is fulfilled, the startup process; and repeating the fetching a next one of the entries, the determining and the starting until all startup processes of the list of startup processes have been started.

Resource-based boot sequence

According to one or more embodiments of the present invention, an example computer-implemented method for measuring concurrent updates in a security coprocessor includes using a first set of platform configuration registers of the security coprocessor to store and extend measurement of a code-load used during a boot sequence of a computing device. The method further includes using a second set of platform configuration registers of the security coprocessor to store and extend measurement of configuration parameters of the code-load used during the boot sequence. The method further includes using a third set of platform configuration registers of the security coprocessor to store and extend measurements of a concurrent update that changes the code-load that was used during the boot sequence.

Handling of remote attestation and sealing during concurrent update

In an approach to grouping related tasks, one or more computer processors receive a first task initialization by a first user. The one or more computer processors determine whether one or more additional tasks contained in one or more task groups are in use by the first user. Responsive to determining one or more additional tasks contained in one or more task groups are in use, the one or more computer processors determine whether the first task is related to at least one task of the one or more additional tasks. Responsive to determining the first task is related to at least one task of the one or more additional tasks, the one or more computer processors add the first task to the task group containing the at least one related task of the one or more additional tasks.

Task grouping by context

An aspect includes receiving a request to boot a software image on a machine including a plurality of processing units having different characteristics. A processing unit subtype identifier is extracted from a license record for the machine. The processing unit subtype identifier includes a software image type and an allocation of the processing units of the processing unit subtype. A processing unit capability of the machine is queried. The software image is enabled with the allocation of the processing units based on verifying that a software image identifier of the software image matches the software image type from the processing unit subtype identifier, and the processing unit capability of the machine meets the allocation of the processing units from the processing unit subtype.

Growing community of inventors

Altdorf, Germany

Jakob Christopher Lang