Hardware security module access management in a cloud computing environment

Patent metadata

Field	Value
Publication number	US-9928080-B2
Application number	US-201414501238-A
Country	US
Kind code	B2
Filing date	Sep 30, 2014
Priority date	Sep 30, 2014
Publication date	Mar 27, 2018
Grant date	Mar 27, 2018

Abstract

Trusted firmware on a host server is used for managing access to a hardware security module (HSM) connected to the host server. The HSM stores confidential information associated with an operating system. As part of access management, the firmware detects a boot device identifier associated with a boot device configured to boot the operating system on the host server. The firmware then receives a second boot device identifier from the HSM. The boot device identifier and the second boot device identifier are then compared by the firmware. Based on the comparison, the firmware determines that the boot device identifier matches with the second boot device identifier. Based on this determination, the firmware grants the operating system access to the HSM.

First claim

What is claimed is:

1. A computer program product for managing access to a hardware security module (HSM) connected to a host server, the HSM having confidential information associated with an operating system stored thereon, the computer program product comprising a non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to:
detect a boot device identifier associated with a boot device configured to boot the operating system on the host server;
receive a second boot device identifier from the HSM;
compare the boot device identifier to the second boot device identifier;
determine, based on the comparing, that the boot device identifier matches with the second boot device identifier; and
grant, subsequent to the determining, the operating system access to the HSM.

2. The computer program product of claim 1 , wherein the program instructions are executable by the computer to further cause the computer to:
detect a third boot device identifier associated with a second boot device configured to boot a second operating system on the host server;
compare the second boot device identifier to the third boot device identifier;
determine, based on the comparing the second boot device identifier to the third boot device identifier, that the second boot device identifier does not match with the third boot device identifier; and
deny, subsequent to the determining that the second boot device identifier does not match with the third boot device identifier, the second operating system access to the HSM.

3. The computer program product of claim 2 , wherein the program instructions are executable by the computer to further cause the computer to:
receive a fourth boot device identifier from a second HSM connected to the host server, the second HSM having second confidential information associated with the second operating system stored thereon;
compare the third boot device identifier to the fourth boot device identifier;
determine, based on the comparing the third boot device identifier to the fourth boot device identifier, that the third boot device identifier matches with the fourth boot device identifier; and
grant, subsequent to the determining that the third boot device identifier matches with the fourth boot device identifier, the second operating system access to the second HSM.

4. The computer program product of claim 3 , wherein the HSM and the second HSM are contained on a single card as partitioned portions.

5. The computer program product of claim 1 , wherein the operating system is an instance i of a guest operating system running on the host server, and wherein the program instructions are executable by the computer to further cause the computer to:
boot, prior to the detecting, the guest operating system on the host server using the boot device.

6. A system for managing access to a hardware security module (HSM) connected to a host server, the HSM having confidential information associated with an operating system stored thereon, the system comprising one or more circuits configured to perform a method comprising:
detecting a boot device identifier associated with a boot device configured to boot the operating system on the host server;
receiving a second boot device identifier from the HSM;
comparing the boot device identifier to the second boot device identifier;
determining, based on the comparing, that the boot device identifier matches with the second boot device identifier; and
granting, subsequent to the determining, the operating system access to the HSM.

7. The system of claim 6 , wherein the one or more circuits are further configured to perform the method comprising:
detecting a third boot device identifier associated with a second boot device configured to boot a second operating system on the host server;
comparing the second boot device identifier to the third boot device identifier;
determining, based on the comparing the second boot device identifier to the third boot device identifier, that the second boot device identifier does not match with the third boot device identifier; and
denying, subsequent to the determining that the second boot device identifier does not match with the third boot device identifier, the second operating system access to the HSM.

8. The system of claim 7 , wherein the one or more circuits are further configured to perform the method comprising:
receiving a fourth boot device identifier from a second HSM connected to the host server, the second HSM having second confidential information associated with the second operating system stored thereon;
comparing the third boot device identifier to the fourth boot device identifier;
determining, based on the comparing the third boot device identifier to the fourth boot device identifier, that the third boot device identifier matches with the fourth boot device identifier; and
granting, subsequent to the determining that the third boot device identifier matches with the fourth boot device identifier, the second operating system access to the second HSM.

9. The system of claim 6 , wherein the operating system is an instance of a guest operating system running on the host server, and wherein the one or more circuits are further configured to perform the method further comprising:
booting, prior to the detecting, the guest operating system on the host server using the boot device.

10. The system of claim 6 , wherein the comparing is performed by a device selected from the group consisting of firmware running on the host server and a hypervisor.

11. The system of claim 8 , wherein the HSM and the second HSM are contained on a single card as partitioned portions.

12. The system of claim 6 , wherein the one or more circuits are further configured to perform the method further comprising:
storing the confidential information combined with the second boot device identifier on the HSM via a secure protocol.

13. The system of claim 6 , wherein the second boot device identifier is in the form of a hash value of data stored on the boot device.

14. The system of claim 6 , wherein the HSM comprises an adapter card with a crypto co-processor.

15. The system of claim 6 , wherein the operating system is a guest operating system.

16. The system of claim 6 , wherein the second boot device identifier is a copy of the boot device identifier.

Assignees

• IBM

Inventors

• Boenisch Volker M M
• Buendgen Reinhard
• Geisert Franziska
• Lang Jakob C
• Lattermann Mareike
• Nunez Mencias Angel

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/4408 Primary

  Boot device selection · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06F21/575

  Secure boot · CPC title