Techniques for attesting data processing systems

Patent metadata

Field	Value
Publication number	US-9489232-B2
Application number	US-201113988051-A
Country	US
Kind code	B2
Filing date	Sep 20, 2011
Priority date	Nov 18, 2010
Publication date	Nov 8, 2016
Grant date	Nov 8, 2016

Abstract

A technique for attesting a plurality of data processing systems includes generating a logical grouping for a data processing system. The logical grouping is associated with a rule that describes a condition that must be met in order for the data processing system to be considered trusted. A list of one or more children associated with the logical grouping is retrieved. The one or more children are attested to determine whether each of the one or more children is trusted. In response to the attesting, the rule is applied to determine whether the condition has been met in order for the data processing system to be considered trusted. A plurality of logical groupings is associated to determine whether an associated plurality of data processing systems can be considered trusted.

First claim

What is claimed is:

1. An apparatus configured to attest a plurality of data processing systems included in a datacenter, comprising:
logic configured to generate respective logical groupings for each of the data processing systems, wherein the logical groupings are associated with a rule that describes a condition that must be met in order for the data processing systems to be considered trusted, and wherein the datacenter includes a plurality of machine pools each of which includes two or more of the data processing systems, where each of the plurality of data processing systems includes a plurality of virtual machines each of which has an associated platform configuration register (PCR) that stores a measurement value;
logic configured to retrieve a list of one or more children associated with each of the logical groupings;
logic configured to attest the one or more children in order to determine whether each of the one or more children is trusted, wherein the attesting includes comparing the measurement value to an expected attestation value;
logic configure to, subsequent to the attesting, apply the rule to determine whether the condition has been met in order for the data processing systems to be considered trusted, wherein based on the rule a first one of the logical groupings is deemed trusted when all of the children of the first one of the logical groupings have a same untrusted state or a same trusted state, and wherein a child is associated with a PCR or a further logical grouping and when the child is associated with the further logical grouping the retrieving is repeated until another child associated with the PCR is found, where the apparatus is a data processing system.

2. The apparatus of claim 1 , wherein the logical groupings are associated with at least one of a physical hierarchy and a functional dependency.

3. The apparatus of claim 1 , wherein the attesting logic further comprises logic configured to determine either a trusted state or an untrusted state for a PCR in accordance with the expected attestation value or a trusted value.

4. The apparatus of claim 1 , wherein a managing system is operable to maintain data associated with the logical groupings.

5. The apparatus of claim 1 , wherein a managing system is configured with the logic configured to generate, retrieve, attest, and apply.

6. The apparatus of claim 1 , wherein each of the data processing systems represent a managed system.

7. A computer program product, comprising:
a computer-readable storage device; and
computer program code stored on the computer-readable storage device, wherein the computer program code, when executed by a data processing system, configures the data processing system to:
generate respective logical groupings for a plurality of data processing systems in a datacenter, wherein the logical groupings are associated with a rule that describes a condition that must be met in order for the data processing systems to be considered trusted, and wherein the datacenter includes a plurality of machine pools each of which includes two or more of the data processing systems, where each of the plurality of data processing systems includes a plurality of virtual machines each of which has an associated platform configuration register (PCR) that stores a measurement value;
retrieve a list of one or more children associated with each of the logical groupings;
attest the one or more children to determine whether each of the one or more children is trusted, wherein the attesting includes comparing the measurement value to an expected attestation value;
subsequent to the attesting, apply the rule to determine whether the condition has been met in order for the data processing systems to be considered trusted, wherein based on the rule a first one of the logical groupings is deemed trusted when all of the children of the first one of the logical groupings have a same untrusted state or a same trusted state, and wherein a child is associated with a PCR or a further logical grouping and when the child is associated with the further logical grouping the retrieving is repeated until another child associated with the PCR is found.

Assignees

• Haikney David
• Mackintosh David Nigel
• Perez Jose Juan Palacios
• IBM

Inventors

• Haikney David
• Mackintosh David Nigel
• Perez Jose Juan Palacios

Classifications

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F9/46 Primary

  Multiprogramming arrangements · CPC title