Operating a secure storage device with a non-volatile memory

Patent metadata

Field	Value
Publication number	US-10685126-B2
Application number	US-201815876502-A
Country	US
Kind code	B2
Filing date	Jan 22, 2018
Priority date	Jan 22, 2018
Publication date	Jun 16, 2020
Grant date	Jun 16, 2020

Abstract

A method for operating a secure storage device with a non-volatile memory on a computer system which executes multiple operating system instances. The non-volatile memory comprises one or more domains which are used by the operating system instances. A separate trusted key entry system is used to configure secret data of an operating system instance stored in the non-volatile memory. The method comprises setting a domain to either secure or non-secure mode; generating a unique identifier of the operating system instance; generating a secure hash for the operating system instance; and storing the secure hash in the domain.

First claim

The invention claimed is:

1. A method for operating a secure storage device with a non-volatile memory on a computer system which executes multiple operating system instances, the method comprising:
setting a domain to either secure mode or non-secure mode in response to a corresponding request from a trusted key entry system, wherein setting the domain further comprises:
defining, by a hardware management console, an image activation profile comprising a number of logical partitions and a number of processors;
establishing firmware control blocks in hardware secure architecture storage comprising an identity of a logical partition within the number of logical partitions and cryptographic configuration data; and
configuring at least one cryptographic card as a hardware security module in a secure boot process;

generating a unique identifier of an operating system instance;
generating a secure hash for the operating system instance based on the unique identifier and domain specific cryptographic configuration data;
storing, in response to a request from a system administrator to configure the secure storage device for use, the secure hash in a domain of non-volatile memory when the domain is in non-secure mode, and otherwise generating an error condition;
generating, in response to a request from the system administrator to access secret data stored in the domain of the non-volatile memory, an error condition if a secure hash, sent with the request to the secure storage device, is not found in the domain or does not match with the stored secure hash,
wherein the non-volatile memory comprises one or more domains which are used by operating system instances, and wherein a separate trusted key entry system is used to configure secret data of an operating system instance stored in the non-volatile memory.

2. The method according to claim 1 , wherein the operating system instances are active on different logical partitions.

3. The method according to claim 1 , wherein the secret data is stored in different domains.

4. The method according to claim 1 , wherein a system firmware key is used for generating the secure hash.

5. The method according to claim 1 , wherein the non-volatile memory is implemented on hardware security modules as the secure storage device.

6. The method according to claim 1 , wherein a trusted key entry flag is set in case the domain is attributed to the operating system instance via the secure hash.

7. The method according to claim 1 , wherein cryptographic configuration data of a logical partition is stored as secure hash in the domain of the non-volatile memory.

8. The method according to claim 1 , wherein the trusted key entry flag indicates for a specific logical partition if an attributed domain is in secure mode.

9. The method according to claim 1 , further comprising deleting secret data in case of changing the cryptographic configuration data.

10. The method according to claim 1 , further comprising deleting secret data in case of removing the secure storage device from the computer system.

11. The method according to claim 1 , wherein the trusted key entry flag indicates for a specific logical partition to delete secret data in case of removing the secure storage device from the computer system.

12. The method according to claim 3 , wherein one or more a domains are attributed to a single operating system instance.

13. The method according to claim 6 , wherein the trusted key entry flag determines whether configuration changes of the logical partitions are allowed.

14. The method according to claim 7 , wherein the cryptographic configuration data is checked in case configuration of the logical partition is changed.

15. A computer program product to operate a secure storage device having computer instructions embodied therewith, the computer instructions executable to perform a method comprising:
setting a domain to either secure mode or non-secure mode in response to a corresponding request from a trusted key entry system, wherein setting the domain further comprises:
defining, by a hardware management console, an image activation profile comprising a number of logical partitions and a number of processors;
establishing firmware control blocks in hardware secure architecture storage comprising an identity of a logical partition within the number of logical partitions and cryptographic configuration data; and
configuring at least one cryptographic card as a hardware security module in a secure boot process;

generating a unique identifier of an operating system instance;
generating a secure hash for the operating system instance based on the unique identifier and domain specific cryptographic configuration data;
storing, in response to a request from a system administrator to configure a secure storage device for use, the secure hash in a domain of non-volatile memory when the domain is in non-secure mode, and otherwise generating an error condition;
generating, in response to a request from the system administrator to access secret data stored in the domain of the non-volatile memory, an error condition if a secure hash, sent with the request to the secure storage device, is not found in the domain or does not match with the stored secure hash,
wherein the non-volatile memory comprises one or more domains which are used by operating system instances, and wherein a separate trusted key entry system is used to configure secret data of an operating system instance stored in the non-volatile memory.

16. A computer system operating a secure storage device, the computer system comprising:
one or more computer processors, one or more computer-readable storage media, and program instructions stored on one or more of the computer-readable storage media for execution by at least one of the one or more processors, the program instructions, when executed, perform a method, the method comprising:
setting a domain to either secure mode or non-secure mode in response to a corresponding request from a trusted key entry system, wherein setting the domain further comprises:
defining, by a hardware management console, an image activation profile comprising a number of logical partitions and a number of processors;
establishing firmware control blocks in hardware secure architecture storage comprising an identity of a logical partition within the number of logical partitions and cryptographic configuration data; and
configuring at least one cryptographic card as a hardware security module in a secure boot process;

generating a unique identifier of an operating system instance;
generating a secure hash for the operating system instance based on the unique identifier and domain specific cryptographic configuration data;
storing, in response to a request from a system administrator to configure a secure storage device for use, the secure hash in a domain of non-volatile memory when the domain is in non-secure mode, and otherwise generating an error condition;
generating, in response to a request from the system administrator to access secret data stored in the domain of the non-volatile memory, an error condition if a secure hash, sent with the request to the secure storage device, is not found in the domain or does not match with the stored secure hash,
wherein the non-volatile memory comprises one or more domains which are used by operating system instances, and wherein a separate trusted key entry system is used to configure secret data of an operating system instance stored in the non-volatile memory.

Assignees

• IBM

Inventors

• Lang Jakob C
• Schmidbauer Joerg
• Werner Klaus

Classifications

• G06F21/80

  in storage media based on magnetic or optical technology, e.g. disks with sectors (preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00) · CPC title

• G06F3/0623

  in relation to content · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F3/0673

  Single storage device · CPC title