International Business Machines Corporation

Richard Victor Kisley

Todd Weston Arnold

Elizabeth A Dames

Carsten D Frehr

Eric David Rossman

Eric B Smith

Michael J Miele

Kenneth B Kerr

Michael James Kelly

Philip Douglas Knight

Mark Charles Davis

Volker Urban

Jimmie Ray Mayfield

Charles D Helfenberger

Gregg Steven Lucas

Reinhard Theodor Buendgen

Aaron Roger Cox

Silvio Dragone

Louis P Gomes

John Michael Lake

Thomas J Dewkett

Mark D Marik

Harald Freudenberger

Durga Devi Mannaru

Matthew J Kalos

Jonathan D Bradbury

Damian Leo Osisek

John Charles Elliott

Tamas Visegrady

Michael D Hocker

Klaus Werner

Richard John Moore

James W Sweeny

David Wayne Glass

James Richard Coon

David Howard Evans

Jonathan William Edwards

Clifford L Hansen

Surya V Duggirala

Gerald K Boyter

Torsten Hendel

Michael Ordway Tingey, Jr

Benedikt Klotz

Markus Selve

A method, a computer program product, and a system are provided that handles host requests on a hardware security module (HSM). The method includes selecting a domain with a longest wait time with a host request for the HSM and selecting an oldest host request requested by the domain. The method also includes determining a hardware engine type required to process the oldest host request and determining a saturation level of the hardware engine type exceeds a saturation threshold. The method further includes selecting a second host request requested by the domain that uses a different hardware engine type based on the saturation level exceeding the saturation threshold and processing the second host request using the different hardware engine type of the HSM. The method further includes selecting unprocessed host requests of the domains to continuously provide efficient selection of those host requests to the HSM.

Smart round robin delivery for hardware security module host requests

Aspects of the invention include a computer-implemented method of executing a hybrid quantum safe key exchange system. The computer-implemented method includes initially retrieving an authenticated random value from a trusted source, generating a first Z value using a first elliptic curve (EC) private key and a first certified form of an EC public key with an EC Diffie-Hellman (ECDH) algorithm, deriving a shared key using the authenticated random value and the first Z value with a key derivation function, decrypting the authenticated random value using a quantum safe algorithm (QSA) private key, generating a second Z value using a second EC private key and a second certified form of the EC public key with the ECDH algorithm and deriving the shared key using the authenticated random value and the second Z value with the key derivation function.

Quantum safe key exchange scheme

A message limit value to be used in enqueuing one or more messages on a queue of a device of the computing environment is obtained. The message limit value indicates whether an extended maximum message length is supported by the device. The extended maximum message length is different from a default maximum message length supported by the device. Based on determining that the extended maximum message length is supported and that the obtained message limit value has a defined relationship with a select value, at least one message of an extended length is enqueued on the queue of the device.

Adjunct processor extended message limit facility

Processing within a computing environment is facilitated by generating a hybrid security certificate using multiple cryptosystems. The generating includes obtaining data for inclusion in the hybrid security certificate, and generating a first digital signature associated with a first cryptosystem to cover the data, and a second digital signature associated with a second cryptosystem to cover the data. The generating further includes providing the hybrid security certificate, where the hybrid security certificate includes the data, the first digital signature associated with the first cryptosystem, and the second digital signature associated with the second cryptosystem, and where the first digital signature has no dependency on a key of the second cryptosystem or the second digital signature, and the second digital signature has no dependency on a key of the first cryptosystem or the first digital signature.

Generating a hybrid security certificate using multiple cryptosystems

Aspects of the invention include providing a clear key with an attribute that controls usage of the clear key. The clear key includes key data in at least a first 8-byte section and second and third 8-byte sections and a wrapping key for wrapping the clear key. The computer-implemented method further includes chaining the first, second and third 8-byte sections together with zeroes for those 8-byte sections that are unpopulated into chained key data, deriving encryption and authentication keys from the wrapping key, calculating an authentication code over the clear key and the attribute using the authentication key, executing encryption over the chained key data using the encryption key to generated encrypted chained key data and adding the authentication code, the attribute and the encrypted chained key data to form a key block.

Key block enhanced wrapping

At least one secure object of a security module is bound to a secure guest. A trusted component determines whether metadata of the secure guest includes a confidential binding attribute for the security module. Based on determining that the metadata includes the confidential binding attribute, the trusted component configures the security module for the secure guest in a select mode. The select mode prevents certain operations from being intercepted by a hypervisor associated with the secure guest. The trusted component intercepts a security module communication and performs a cryptographic operation on one or more secure objects of the security module communication using the confidential binding attribute to provide a cryptographic result. An outcome of the security module communication, which includes the cryptographic result, is provided to a receiver.

Binding secure objects of a security module to a secure guest

An adjunct processor dynamically determines, on a per-command basis, whether commands obtained by the adjunct processor are to be processed by the adjunct processor. The adjunct processor obtains a command request of a requester. The command request includes at least one filtering indicator indicating at least one valid command type for processing by the adjunct processor for the requester. The adjunct processor determines using the at least one filtering indicator whether a command of the command request is valid for processing by the adjunct processor for the requester. Based on determining that the command is valid for processing by the adjunct processor, the command is processed by the adjunct processor.

Command-type filtering based on per-command filtering indicator

A security module, such as a cryptographic adapter, is reserved for a secure guest of a computing environment. The reserving includes binding one or more queues of the security module to the secure guest. The one or more queues are then managed based on one or more actions relating to the reservation.

Reserving one or more security modules for a secure guest

Embodiments are directed to a computer-implemented method and system, and for setting a minimum key strength in a key hierarchy. The method and system can include the use of a key strength keyword that set a minimum key strength for a plurality of key classes. The setting of a key strength lower than that set forth in the key strength command is prohibited. The key classes can include DES keys, AES keys, HMAC keys, RSA PKI keys, RSA usage keys, RSA key generation keys, ECC PKI keys, ECC usage keys, and ECC key generation keys. A multi-dimension key hierarchy, including a master key and a key that is derived through the use of a key derivation function is also described herein.

Keyword to set minimum key strength

Embodiments are directed to a computer-implemented method and system for generating a transport key. A method can include generating, using a processor, a key agreement pair comprising a public agreement key and a private agreement key in a second element. Thereafter, generating, using the processor, a transport key based on the public agreement key in a first element. Then sending, using the processor, an information blob to the second element. Finally, independently generating, using the processor, the transport key in the second element using the information blob and the private agreement key. The transport key can thereafter be used to send information securely between the first and second elements.

Key exchange process

Embodiments are directed to a computer-implemented method, computer system, and computer program product for creating a public key token. A public key and private key are generated, using a master key. A set of permissions is received for the public key and private key that note the allowable uses for the public key and private key. Thereafter, the set of permissions, encrypted public key, and other associated information is placed in a public key token.

Integrity protected trusted public key token with performance enhancements

Embodiments include method, systems and computer program products for secure logging of host security module. In some embodiments, an event may be received. The event may include data to be written to a secure log file. A hash may be generated using data of the event. The hash may be stored in a first field of an event record associated with the event. The event record may be stored in the secure log file. The hash may be stored in a second field of a next event record in the secure log file.

Secure logging for host security module

Method, apparatus and program storage device that provides a distributed file serving architecture with metadata storage virtualization and data access at the data server connection speed is provided. A host issues a file access request including data target locations. The file access request including data target locations is processed. Remote direct memory access (RDMA) channel endpoint connection are issued in response to the processing of the file access request. An RDMA transfer of the file-block data associated with the file access request is made directly between a memory at the host and a data server.

Distributed file serving architecture system with metadata storage virtualization and data access at the data server connection speed

Growing community of inventors

Charlotte, NC, United States of America

Richard Victor Kisley