Binding secure keys of secure guests to a hardware security module

    公开(公告)号:IL285112A

    公开(公告)日:2021-09-30

    申请号:IL28511221

    申请日:2021-07-25

    Abstract: A method, computer program product, and a system where a secure interface control configures a hardware security module for exclusive use by a secure guest. The secure interface control (“SC”) obtains a configuration request (via a hypervisor) to configure the hardware security module (HSM), from a given guest of guests managed by the hypervisor. The SC determines if the HSM is already configured to a specific guest of the one or more guests, but based on determining that the HSM is not configured to the and is a secure guest the SC forecloses establishing a configuration of the HSM by limiting accesses by guests to the HSM exclusively to the given guest. The SC logs the given guest into the HSM by utilizing a secret of the given guest. The SC obtains, from the HSM, a session code and retains the session code.

    Methods and systems for starting computerized system modules

    公开(公告)号:GB2531586A

    公开(公告)日:2016-04-27

    申请号:GB201418870

    申请日:2014-10-23

    Applicant: IBM

    Abstract: A computer-implemented method for starting a module of a computerized system comprises: receiving graph data of a direct acyclic graph, DAG, describing the module by way of nodes connected by edges, where at least some nodes are submodule nodes SN, corresponding to submodules of the module, connected via one or more edges reflecting a data dependency between the corresponding submodules, each of which is a hardware module or a software submodule capable of producing and/or consuming data; starting asynchronous execution of two submodules corresponding to two submodule nodes located in independent branches of the DAG, such as one of SN0, SN1, and SN2 together with SN3; determining a third submodule node SN5 that is a descendant of each of the two submodule nodes, according to an outcome of the execution of one or each of the corresponding two submodules, and starting execution of a third submodule corresponding to the third submodule node determined, in view of completing the starting of the module. The DAG may further comprise control nodes VN. Asynchronously executing the submodules may exploit parallelism, to save time at start up. A computer-implemented method for creating graph data of a direct acyclic graph is also provided.

    System for enablng digital signature auditing

    公开(公告)号:GB2501645B

    公开(公告)日:2014-08-27

    申请号:GB201313687

    申请日:2012-02-22

    Applicant: IBM

    Abstract: A computer method, computer system, and article for enabling digital signature auditing. The method includes the steps of: receiving at least one signature request issued by at least one application, forwarding a first data corresponding to the received at least one signature request to at least one signing entity for subsequent signature of the first data, storing an updated system state that is computed using a function of: i) a reference system state and ii) a second data corresponding to the received at least one signature request, where the reference system state and the updated system state attest to the at least one signature request, and repeating the above steps, using the updated system state as a new reference system state, where the steps of the method are executed at a server of a computerized system.

Patent Agency Ranking