International Business Machines Corporation

Volker M M Boenisch

Jakob Christopher Lang

Franziska Geisert

Mareike Lattermann

Reinhard Theodor Buendgen

Angel Nunez Mencias

Budy D Notohardjono

Angel Nunez-Mencias

Angel N Mencias

Reinard T Buendgen

Embodiments include method, systems and computer program products for extracting entropy from mobile devices to generate random numbers. In some embodiments, first vibration data may be received from a first device. Second vibration data may be received from a second device. A first piece of entropy data may be generated using the first vibration data and a second piece of entropy data may be generated using the second vibration data. The first piece of entropy data and the second piece of entropy data may be aggregated. The first piece of entropy data and the second piece of entropy data may be stored in an entropy pool.

Extracting entropy from mobile devices to generate random numbers

Methods are provided for using a hardware module connectable to multiple computer systems, where the multiple computer systems are connectable to a server within a common network. The method includes: providing a network address of the server in persistent memory of the hardware security module; providing an encrypted secret entity in the persistent memory of the hardware security module; providing a private key in the persistent memory of the hardware security module; and based on the hardware security module being connectable to one of the computer systems, the method includes: establishing a secure connection between the hardware security module and the server; retrieving, via the secure connection, a wrapping key from the server and storing it in volatile memory of the hardware security module; and decrypting the encrypted secret entity with the wrapping key and storing the decrypted secret entity in the volatile memory of the hardware security module.

Controlled use of a hardware security module

Trusted firmware on a host server is used for managing access to a hardware security module (HSM) connected to the host server. The HSM stores confidential information associated with an operating system. As part of access management, the firmware detects a boot device identifier associated with a boot device configured to boot the operating system on the host server. The firmware then receives a second boot device identifier from the HSM. The boot device identifier and the second boot device identifier are then compared by the firmware. Based on the comparison, the firmware determines that the boot device identifier matches with the second boot device identifier. Based on this determination, the firmware grants the operating system access to the HSM.

Hardware security module access management in a cloud computing environment

At least one hardware security module out of a plurality of hardware security modules is assigned to a guest system. The at least one hardware security module out of the plurality of hardware security modules is configured with a master key. A data pattern is used for a challenge protocol adapted to prove that the at least one hardware security module out of the plurality of hardware security modules is configured with the master key. The at least one hardware security module including the master key is assigned to the guest system based on a positive outcome of the challenge protocol.

Growing community of inventors

Boeblingen, Germany

Volker M M Boenisch