Trusted boot of a virtual machine

Patent metadata

Field	Value
Publication number	US-9898609-B2
Application number	US-201514867265-A
Country	US
Kind code	B2
Filing date	Sep 28, 2015
Priority date	Jun 29, 2012
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

A method, system and program product for performing a trusted boot of a virtual machine comprises the steps of executing, in turn, a series of components of the trusted boot, performing a function on each component prior to the execution of the respective component, storing the output of the functions in a virtual trusted platform module, detecting that the virtual trusted platform module has not responded to the storing of the output of a function in the virtual trusted platform module, and generating a request that the virtual trusted platform module be disabled.

First claim

The invention claimed is:

1. A method of performing a trusted boot of a virtual machine, the method comprising the steps of:
executing, in turn, a series of components of the trusted boot;
performing a function on each respective component of the series of components prior to the execution of the respective component when attempting to establish a chain of trust for the series of components;
storing an output of the function in a virtual trusted platform module;
detecting that the virtual trusted platform module has not responded to the storing of the output of the function in the virtual trusted platform module;
generating a request that the virtual trusted platform module be disabled; and
transmitting the generated request to a hypervisor and disabling the virtual trusted platform module using a command from the hypervisor.

2. A method according to claim 1 , wherein the step of detecting that the virtual trusted platform module has not responded to the storing of the output of the function in the virtual trusted platform module comprises waiting for a predetermined time period.

3. A method according to claim 1 , and further comprising transmitting the generated request to a hypervisor and disabling the virtual trusted platform module using a command from the hypervisor.

4. A method according to claim 1 , wherein the step of performing a function on each component prior to the execution of the respective component comprises performing a predefined hashing function on the respective component.

5. A method according to claim 1 , wherein the step of performing a function on each component prior to the execution of the respective component is performed by the previously loaded component.

6. The method according to claim 1 , wherein the request is generated responsive to detecting that the virtual trusted platform module has not responded to the storing of the output of the function in the virtual trusted platform module.

7. The method according to claim 1 , and further comprising executing a hypervisor to supervise a plurality of logical, partitionable runtime environments within the server, reserve a logical partition for a hypervisor-based trusted platform module, and present the hypervisor-based trusted platform module to another logical partition as the virtual trusted platform module.

Assignees

• IBM

Inventors

• Sherwood David
• Walker James W
• Walton Travis

Classifications

• G06F21/575 Primary

  Secure boot · CPC title

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F2009/45575

  Starting, stopping, suspending or resuming virtual machine instances · CPC title