International Business Machines Corporation

William Lee Terrell

Steven A Bade

Andrew Gregory Kegel

James Patrick Hoff

Michael James Kelly

Ryan Charles Catherman

Linda Nancy Betz

Hira Advani

A method, an apparatus, a system, and a computer program product is presented for virtualizing trusted platform modules within a data processing system. A virtual trusted platform module along with a virtual endorsement key is created within a physical trusted platform module within the data processing system using a platform signing key of the physical trusted platform module, thereby providing a transitive trust relationship between the virtual trusted platform module and the core root of trust for the trusted platform. The virtual trusted platform module can be uniquely associated with a partition in a partitionable runtime environment within the data processing system.

Method and system for virtualization of trusted platform modules

An architecture for a distributed data processing system comprises a system-level service processor along with one or more node-level service processors; each are uniquely associated with a node, and each is extended to comprise any components that are necessary for operating the nodes as trusted platforms, such as a TPM and a CRTM in accordance with the security model of the Trusted Computing Group. These node-level service processors then inter-operate with the system-level service processor, which also contains any components that are necessary for operating the system as a whole as a trusted platform. A TPM within the system-level service processor aggregates integrity metrics that are gathered by the node-level service processors, thereafter reporting integrity metrics as requested, e.g., to a hypervisor, thereby allowing a large distributed data processing system to be validated as a trusted computing environment while allowing its highly parallelized initialization process to proceed.

Method and system for hierarchical platform boot measurements in a trusted computing environment

A process for the modification of device configuration in a computer system is designed to be easy-to-use by the user of the computer system yet allow the user flexibility in the specification of device configuration. The computer system stores parameter values of various default devices and devices already installed in the computer system. When the user invokes an 'ADDDEV' command, the system prompts the user to enter one of a plurality of commands such as add, change or delete. Assuming the user enters the add command, the system prompts the user to enter the name of a default device or a similar device already installed in the system. When that information is entered by the user, the system determines from the stored parameters for the default or similar device which parameters must be re-specified by the user for the device to be added to the system. The system then prompts the user to enter only those parameters requiring respecification. Once those parameters have been respecified, the system stores the respecified parameters together with those parameters common to both the default or similar device and the added device thereby installing the added device in the computer system. The procedure not only simplifies the installation process by the user, but also minimizes the possibility that errors will be made in the installation of the added device. Further, the system allows for the possibility of optionally changing parameters that do not require re-specification or the parameters of devices already installed in the system.

Modification of device configuration wherein the system specifies and

A screen-oriented process is used for configuring devices in an open computer system. The computer system includes an operating system having device drivers, and the operating system can be run as a virtual machine on a virtual resource manager wherein a procedure is used to bind the device drivers of the operating system and the virtual resource manager and an attached device on a particular port of an adapter using device dependent information. The configuring process initially requires the creation of device dependent information files for a plurality of devices and device types, and these files are installed in the computer system. Each file includes adpater specific information and device specific information consolidated in a single file. The user may invoke a configuration command, and the system responds by displaying a plurality of commands such as add, change, delete and show and prompts the user to choose a command. If the add command is chosen, the system displays a list of predefined devices and adapters of the device type specified by the user and prompts the user to choose from among the predefined devices and adapters in the list. When the user makes a choice, the system then asks the user whether the device dependent information for the chosen device and adapter should be displayed so that the user has the option of changing either or both the adapter specific information and the device specific information in one step. Similarly, if the change command is chosen, the information for the previously installed device specified by the user is displayed so that the user has the option of changing either or both the adapter specific information and the device specific information in one step.

Growing community of inventors

Austin, TX, United States of America

William Lee Terrell