Updating Secure Guest Images and Secure Guest Metadata

Abstract

The secure guest generates an updated image of the secure guest and computes one or more measurements of the updated image. The secure guest provides the one or more measurements to the trusted execution environment and obtains metadata for the updated image from the trusted execution environment. The metadata is generated based on the metadata of the secure guest and obtaining the one or more measurements.

Description

Technical Field

[0001] One or more aspects generally relate to facilitating processing within a computing environment, and more particularly to improving such processing.

Background Art

[0002] A computing environment may support virtualization, in which a hypervisor or virtual machine manager of the computing environment hosts various guests such as virtual machines or virtual servers of the computing environment. A virtual machine has access to system resources and can execute an operating system such as a guest operating system. Various guests can be owned by various owners, and some of these guests can be secure guests.

[0003] Conventional hypervisors have complete control over the hosted guests. In particular, a hypervisor even has the ability to inspect and modify the memory of the hosted guests. However, a secure guest is a guest that can be hosted by a hypervisor that is not fully trustworthy. The image of such a secure guest is protected when loaded, and the protection of the contents of the resources (e.g., memory, CPU registers) allocated to the guest is maintained throughout the lifetime of the guest. The protection of the guest includes at least integrity protection (e.g., the hypervisor cannot maliciously change the state of any guest), and in addition, can include maintaining the confidentiality of the initial image, code, and data being executed in the secure guest.

[0004] Processing associated with a secure guest, including the image or metadata or both of the secure guest, should be facilitated.

Summary of the Invention

[0005] The provision of computer program products that facilitate processing within a computing environment overcomes the shortcomings of prior art and brings additional advantages. A computer program product includes one or more computer-readable storage media and program instructions collectively stored in the one or more computer-readable storage media to perform a method. This method includes a secure guest generating an updated image of the secure guest and calculating one or more measurements of the updated image. The secure guest provides one or more measurements to a trusted execution environment and retrieves metadata for the updated image from the trusted execution environment. This metadata is generated based on the secure guest's metadata and the acquisition of one or more measurements. With respect to a running secure guest, changes to the secure guest (e.g., applying security fixes, updating configurations) may be made by generating an updated secure guest image and retrieving the metadata associated with that secure guest image, and these changes will be available to the secure guest at the next boot, providing flexibility, improvement, or both.

[0006] In one example, a secure guest obtains an image update request structure indicating that an updated image should be generated. This image update request structure is provided to a trusted execution environment, and based on the structure, a request handle is obtained from the trusted execution environment. This request handle is then used to generate the updated image.

[0007] In one example, generating an updated image involves using a request handle to request an encryption key from a trusted execution environment, constructing an updated plaintext image of the secure guest, encrypting the updated plaintext image using the encryption key, and obtaining the encrypted image. The encrypted image is the updated image.

[0008] For example, calculating one or more measurements involves updating one or more initial measurements of an updated plaintext image based on an encrypted image and obtaining one or more measurements to be provided to a trusted execution environment. For example, one or more measurements are provided using a request handle.

[0009] In one example, the encryption key is a protected key obtained from a trusted execution environment. The protected key can, for example, be used exclusively by an instance of a secure guest that invokes the trusted execution environment, and the plaintext value of the encryption key is unknown to the secure guest. Using a protected key provides security to the data and processing.

[0010] For example, an updated plain text image contains multiple pages of memory, and encrypting the updated plain text image involves encrypting those multiple pages of memory using a protected key.

[0011] In one example, retrieving metadata for an updated image is based on calling a function in a trusted execution environment to create metadata for the updated image, which provides a request handle and one or more measurements as arguments. For example, the arguments may further include other metadata for the updated image.

[0012] For example, an image update request structure includes integrity-protected, encrypted portions and is exclusively interpretable by a trusted execution environment. This protection ensures that the request structure cannot be altered during transmission from the secure guest to the trusted execution environment, that the data within the encrypted portions of the request structure remains confidential during transmission, and that the plaintext values ​​of the encrypted data can only be accessed by the trusted execution environment.

[0013] In one example, the encrypted portion of the image update request structure contains data derived from sensitive data within the encrypted portion of the secure guest metadata issuing the image update request. A trusted execution environment can use this data from the image update request structure to verify that the creator of the request structure has knowledge that is assumed to be limited only to the owner of the secure guest image.

[0014] Furthermore, in one example, based on providing the image update request structure to a trusted execution environment, an issue regarding the image update request structure is obtained from the trusted execution environment. This issue is based, for example, on sensitive data obtained from an encrypted portion of the image update request structure. The secure guest obtains a response to the issue from a selected entity and provides the response to the issue to the trusted execution environment. Based on providing a response to the issue, an indication of whether the issue was successful is obtained from the trusted execution environment. Based on the issue being successful, the generation of the updated image proceeds. This issue protects the image update request structure from vulnerabilities.

[0015] In one example, an image update request structure includes one or more instructions and data specifying one or more changes to the previous secure guest metadata, which are used to calculate the metadata of the updated image.

[0016] For example, the updated image of the secure guest and its metadata are stored on the boot device. This allows the updated image and metadata to be available during the boot process.

[0017] Computer implementation methods and systems related to one or more embodiments are also described and claimed herein. Furthermore, services related to one or more embodiments may also be described and claimed herein.

[0018] Further features and advantages are realized by the technologies described herein. Other embodiments and aspects are described in detail herein and are considered to be part of the claimed embodiments.

[0019] One or more embodiments are specifically pointed out and expressly claimed as examples in the claims at the end of this specification. The foregoing, as well as the purposes, features, and advantages of one or more embodiments, will become apparent from the following detailed description, made in conjunction with the accompanying drawings. [Brief explanation of the drawing]

[0020] [Figure 1] This figure shows one example of a computing environment for using one or more embodiments of the present invention. [Figure 2] This figure shows one example of a secure guest image and secure guest metadata used to initiate a secure guest according to one or more aspects of the present invention. [Figure 3] This figure shows one example of a description related to an image update request structure used according to one or more aspects of the present invention. [Figure 4] This figure shows one example of generating an updated image of a secure guest and associated metadata according to one or more aspects of the present invention. [Figure 5A]A diagram showing an example of a generation process for generating an updated secure guest image and updated secure guest metadata according to one or more aspects of the present invention. [Figure 5B] A diagram showing an example of a generation process for generating an updated secure guest image and updated secure guest metadata according to one or more aspects of the present invention. [Figure 6A] A diagram showing an example of facilitating processing within a computing environment according to one or more aspects of the present invention. [Figure 6B] A diagram showing an example of facilitating processing within a computing environment according to one or more aspects of the present invention. [Figure 6C] A diagram showing an example of facilitating processing within a computing environment according to one or more aspects of the present invention. [Figure 7A] A diagram showing another example of a computing environment for incorporating and using one or more aspects of the present invention. [Figure 7B] A diagram showing further details of the memory of FIG. 7A according to one or more aspects of the present invention. [Figure 8] A diagram showing one embodiment of a cloud computing environment according to one or more aspects of the present invention. [Figure 9] A diagram showing an example of an abstract model layer according to one or more aspects of the present invention.

Best Mode for Carrying Out the Invention

[0021] <统一码: One or more aspects of the present invention provide the ability to facilitate processing within a computing environment. For example, this ability includes enabling a secure guest to create updated metadata for the updated secure guest image, in addition to an updated image of the secure guest. This may be useful, for example, in applying security fixes affecting the secure guest image, in customizing a general secure guest image using sensitive data belonging to the new owner of a customized secure guest image, or for other reasons, or a combination thereof. As used herein, updated image or updated metadata means an updated image or a new image or metadata. The term “updated” is used for convenience.

[0022] One embodiment of a computing environment for using one or more aspects of the present invention is described with reference to Figure 1. As an example, the computing environment is based on the z / Architecture(R) instruction set architecture provided by International Business Machines Corporation (Armonk, New York). One embodiment of the z / Architecture instruction set architecture is described in the published document “z / Architecture Principles of Operation,” IBM Publication No. SA22-7832-12, Thirteenth Edition, September 2019. However, the z / Architecture instruction set architecture is only one exemplary architecture, and other architectures or other types of computing environments of International Business Machines Corporation or other entities, or both, may include, use, or both, one or more aspects of the present invention. z / Architecture and IBM are trademarks or registered trademarks of International Business Machines Corporation in at least one jurisdiction.

[0023] Referring to Figure 1, in one example, the computing environment 100 includes a central processor complex (CPC) 102. The central processor complex 102 is, for example, an IBM Z(R) server (or other server or machine provided by International Business Machines Corporation or other entity) and includes several components, such as one or more processor units (also called processors) 110 and memory 104 (also called system memory, main memory, primary memory, central memory, or storage) coupled to an input / output (I / O) subsystem 111. Examples of processor units 110 include one or more general-purpose processors (also known as central processors or central processing units (CPUs)) or one or more other processors or both. IBM Z is a trademark or registered trademark of International Business Machines Corporation in at least one jurisdiction.

[0024] The I / O subsystem 111 may be part of the central processing unit complex or it may be separate from the central processing unit complex. The I / O subsystem 111 directs the flow of information between the main memory 104 and the input / output control unit 108 and input / output (I / O) devices 106 which are coupled to the central processing unit complex.

[0025] Many types of I / O devices may be used. One particular type is a data storage device 140. The data storage device 140 can store one or more programs 142, one or more computer-readable program instructions 144, or data, or a combination thereof. The computer-readable program instructions may be configured to perform functions of embodiments of the present invention.

[0026] The central processing unit complex 102 may include, or be coupled to, a removable / non-removable, volatile / non-volatile computer system storage medium, or both. For example, the central processing unit complex 102 may include, or be coupled to, a magnetic disk drive for reading and writing to a non-removable, non-volatile magnetic medium (commonly called a “hard drive”), a removable, non-volatile magnetic disk (e.g., a “floppy disk”), or an optical disk drive for reading or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM, or other optical medium, or a combination thereof, or both. It should be understood that other hardware components or software components, or both, may be used in conjunction with the central processing unit complex 102. Examples include, but are not limited to, microcode or millicode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems.

[0027] Furthermore, the central processing unit complex 102 can be operated in a number of other general-purpose or dedicated computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with the central processing unit complex 102 include, but are not limited to, personal computer (PC) systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, microcomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of these systems or devices.

[0028] The central processing unit complex 102 supports virtualization in one or more embodiments, and virtualization support includes, for example, memory 104, one or more virtual machines 112 (also called guests), a virtual machine manager such as a hypervisor 114 that manages the virtual machines, a trusted execution environment 115 (also called an ultravisor), and processor firmware 116. One example of a hypervisor 114 is the z / VM(R) hypervisor provided by International Business Machines Corporation (Armonk, New York). A hypervisor is sometimes referred to as a host. z / VM is a trademark or registered trademark of International Business Machines Corporation in at least one jurisdiction.

[0029] In one or more embodiments, the trusted execution environment 115 may be at least partially implemented in hardware or firmware, or both, configured to run processes such as those described herein. The trusted execution environment is trusted firmware or hardware, or both, that implements memory protection using memory protection hardware. The guest owner can securely pass information to the trusted execution environment (e.g., using IBM Secure Execution) by using a public host key embedded in a host key document. To process sensitive information, the trusted execution environment uses a matching private host key. The private host key is unique to the server (e.g., an IBM Z(R) server) and is hardware protected.

[0030] The processor firmware 116 includes, for example, the processor's microcode or millicode. The processor firmware 116 also includes, for example, hardware-level instructions or data structures, or both, used in the implementation of higher-level machine code. In one embodiment, the processor firmware 116 includes, for example, proprietary code that controls the operating system's access to the system's hardware, typically provided as microcode or millicode specific to the underlying hardware, including trusted software.

[0031] The Central Processing Unit's support for virtual machines provides the ability to operate a large number of virtual machines 112, each virtual machine 112 which can run with a different program 120 and execute a guest operating system 122 such as the Linux(R) operating system. Each virtual machine 112 can function as a separate system; that is, each virtual machine can be reset independently, execute a guest operating system, and run with a different program. An operating system or application program running within a virtual machine appears to have access to the entire system, but in reality, only a portion of it is available. While z / VM(R) and Linux are provided as examples, other virtual machine managers and / or operating systems may be used according to one or more aspects of the present invention. The registered trademark Linux(R) is used in accordance with a sublicense from the Linux Foundation (exclusive licensee of Linus Torvalds, the worldwide trademark owner).

[0032] In one embodiment, one or more guests 112 are secure guests. Referring to Figure 2, the secure guest 200 is started by a hypervisor (e.g., hypervisor 114) in a manner that prevents the hypervisor from observing the state of the secure guest (e.g., memory, registers, etc.). For example, in one embodiment of confidential computing, the hypervisor can start / stop the secure guest, and the hypervisor identifies where the data used to start the secure guest is located, but cannot see inside the running secure guest. The data used to load / start the secure guest may be encrypted in a manner that prevents the hypervisor from seeing the secure guest. The owner of the secure guest image places the confidential data in the secure guest metadata and then generates the secure guest image with the secure guest metadata. After the secure guest is loaded, all information exchange with the state of the secure guest is handled by a trusted execution environment, such as a trusted execution environment 115.

[0033] In one embodiment, to start a secure guest, the hypervisor passes a secure guest image 210 and secure guest metadata 220 to a trusted execution environment 115. This metadata is integrity-protected, at least partially confidential, and interpreted only by the trusted execution environment. The trusted execution environment then enforces the integrity of the secure guest image loaded into memory based on the information in the secure guest metadata, protects the secure guest memory containing the loaded image from becoming accessible by the hypervisor, and, if applicable, can decrypt the secure guest image before starting the secure guest.

[0034] The secure guest image and secure guest metadata are cryptographically linked, for example, so that only those with knowledge of the sensitive data protected by the secure guest metadata can perform any valid modifications to the secure guest image. The secure guest metadata is designed to be exclusively interpretable by a trusted execution environment.

[0035] According to one or more aspects of the present invention, a secure guest image (for example, used to boot a secure guest) and its associated metadata may be updated. For example, the image and metadata may be updated to apply fixes affecting the secure guest image (e.g., security fixes) so that the secure guest image can be booted with the fixes applied the next time, or to customize a general secure guest image with sensitive data belonging to the new owner of a customized secure guest image so that a customized secure guest image can be booted. Examples of updating a secure guest image and its associated metadata are provided, but additional examples, fewer examples, other examples, or combinations thereof may be provided.

[0036] In one example, updating a secure guest image and its associated metadata is based on a request provided, for example, via an update request structure, an example of which is further described below. The update request structure (hereinafter also referred to herein as the image update request structure or request structure) may be, for example, integrity-protected, and one or more parts of the request structure may be confidential, for example, by a request structure protection key. For example, the request structure may be AES-GCM (Advanced Encryption Standard-Galois Counter Mode) protected by a request structure protection key. The request structure may be integrity-protected by a set of key slots representing a request structure protection key, for example, a customer-selected CPK (customer public key) (a public EDCH (Elliptic-curve Diffie-Hellman) key from a pair of temporary keys) and the same customer-selected request structure protection key (for example, a request structure protection key used to AES-GCM protect the request structure).

[0037] The request structure is exclusively interpretable by a trusted execution environment (for example, the trusted execution environment exclusively verifies the integrity of the request structure, and the encrypted portion of the request structure is exclusively decrypted by the trusted execution environment). The request structure may include, for example, one or more key slots, each containing the host key of the target host / a request structure protection key (RPK) protected by the trusted execution environment; instructions on whether to use the key used to encrypt the original (pre-update) secure guest image or a new random key (the option to use the original key may be limited to requests that choose to use a protected key for image encryption); instructions on whether the image encryption key provided by the trusted execution environment function should be a plaintext key or a protected key (for example, a key token containing plaintext values ​​not visible to the secure guest but which can be interpreted as an encryption key by a function provided by the system's trusted hardware / firmware); or information on which secure guest metadata attributes or sensitive data should be changed and how they should be changed, or a combination thereof. The request structure may contain additional data / attributes, fewer data / attributes, other data / attributes, or a combination thereof. Many possibilities exist.

[0038] One specific example of a description related to an image update request structure is illustrated with reference to Figure 3. As shown in Figure 3, in one example, a description 300 related to a request structure (also referred to herein as the request structure description 300) includes a number of entries 302, each entry 302 including, for example, a name 310, an abbreviation (abbreviation) 312, and a brief description (content) 314 of the entry, in addition to a protection instruction (protection) 316 indicating whether the content (e.g., content 314) is integrity protected or whether it is both integrity protected and confidential (e.g., encrypted) by a request protection key that can only be obtained by the target system. In one example, content 314 includes data / attributes of the request structure, and the name 310, abbreviation 312, and protection instruction 316 provide information related to content 314.

[0039] For example, one entry 318 of the request structure description contains the customer public key (provided by the requesting entity), and one or more other entries 320 contain key slots 1 to N, each containing the host key of the target host / request structure protection key protected by a trusted execution environment. The customer public key and key slots are used to securely transmit the request protection keys (e.g., using the Diffie-Hellman technique (elliptic curve)) for a set of possible target systems to a trusted execution environment, with each key slot specifying the address of one target system.

[0040] One or more other entries 302 include, for example, the following data (entries 322, 324, and 326) encrypted with a request protection key:

[0041] Entry 322 includes one or more request flags (abbreviated as RF) that can provide specific instructions, such as task instructions (described below). In one example, the encrypted portion of the request includes authentication data (for example, data generated based on sensitive data from the encrypted portion of secure guest metadata).

[0042] Entry 324 includes one or more modification instructions (e.g., one or more bits in a bitmap) that provide one or more types of modification (e.g., using a new random image cryptographic key, replacing other sensitive data in the original (pre-updated) secure guest metadata, changing control flags in the original secure guest metadata, etc.).

[0043] Entry 326 contains change data that provides specific encrypted data in response to the change instructions (for example, a key that should replace a key from the original secure guest metadata).

[0044] Additional information, less information, or other information, or a combination thereof, may be included in the image update request structure description 300. Additional entries, less entries, or other entries, or a combination thereof, may be provided, or each entry may contain additional information, less information, or other information, or a combination thereof, or both. Furthermore, the update request structure (e.g., content 314) may contain additional data / attributes, less data / attributes, or other data / attributes, or a combination thereof. Many possibilities exist.

[0045] A request structure is used to generate an updated secure guest image and associated updated metadata according to one or more aspects of the present invention. One example of this process is illustrated with reference to Figure 4. In one example, the secure guest 400 issues a call to a trusted execution environment, such as a generate secure guest metadata-initialize call 402, to initialize the updating of the metadata associated with the image to be updated. This initialization call includes, for example, a request structure 404 (containing content similar to, for example, content 314), which is prepared outside the secure guest by, for example, the secure guest owner 410 and obtained by the secure guest (e.g., provided, received, extracted, retrieved, etc.). The call to the trusted execution environment returns a request handle to the secure guest 400 and optionally returns a request validity issue. The issue received by the secure guest from the trusted execution environment is forwarded to the secure guest owner (412). The secure guest owner calculates a response 414 to the issue based on their knowledge of the owner of the secure guest metadata and request structure, as described below, and sends this response to the secure guest. The secure guest receives the response from the secure guest owner and responds to the issue by calling the trusted execution environment (416). If the issue fails, the update is rolled back. For example, the secure guest rolls back the update by calling the trusted execution environment, for example, using a metadata generation rollback call 440. However, if the issue succeeds, the trusted execution environment changes to a state that allows it to handle further image update request functions associated with the request handle, and the image and metadata updates continue using the validated request handle.

[0046] To continue the update, in one example, secure guest 400 requests an image cryptographic key (e.g., a protected key) from a trusted execution environment for a request handle (418). The trusted execution environment provides, for example, a protected key that is used exclusively by the instance of the secure guest calling the trusted execution environment. In this example, the plaintext value of the cryptographic key is unknown to the secure guest.

[0047] Furthermore, in one example, the updated image is generated within the secure guest, and this image is encrypted using the updated image encryption key. To update the image, in one example, the secure guest provides updates to the secure guest (e.g., security fixes, configuration changes, etc.) using update technology (e.g., using the Red Hat Package Manager (RPM) update function), and then extracts the updated image using a standard image generation tool (e.g., Dracut). The updated image is, for example, encrypted and written to disk or a boot partition so that it can be used to boot the secure guest based on the updated secure guest image.

[0048] As part of the update, in one example, pack operation 420 is performed for each page 422 (or other unit) of memory that is part of the updated secure guest image. For each page, the pack operation includes, for example, encrypting the page using an image encryption key (e.g., a protected key), accumulating the metrics of the updated secure guest image (e.g., integrity metrics such as hashes, verification codes (e.g., message authentication codes), and signatures, calculated based on currently known or future technologies), and updating other metadata of the updated secure guest image (e.g., the starting address of the updated secure guest image, the number of pages in the updated secure guest image, etc.).

[0049] Furthermore, the secure guest issues a new secure guest metadata generation completion call 430 to a trusted execution environment, which takes selected data as input, including the measurement results of the updated secure guest image and other metadata 432 of the secure guest image, and returns the updated secure guest metadata 434.

[0050] In one example, the updated secure guest image, along with the updated secure guest metadata, is stored on the boot device, replacing the old image and metadata.

[0051] Further details of one embodiment that generates an updated image and updated metadata are described with reference to Figures 5A and 5B. Referring first to Figure 5A, the secure guest owner generates a secure guest image update request structure containing, for example, content similar to content 314, and sends this request structure to the secure guest (500). The secure guest receives the request structure and uses the request structure as an argument to invoke a trusted execution environment function called a secure guest metadata generation initialization call. The trusted execution environment takes this call (e.g., receive, provide, retrieve, extract, etc.) and returns a request handle (502). Optionally, the trusted execution environment may return an issue that can affect the validity of the request handle so that the owner of the secure guest can demonstrate the validity of the request.

[0052] To further illustrate, in one embodiment, an initialization function is callable from a secure guest (e.g., only secure guests) and takes a secure guest image update request structure as an argument, as shown. This call is made to a trusted execution environment and, based on this call, unpacks (e.g., decrypts) the request structure using, for example, the customer public key (e.g., described in entry 318) and one or more key slots (e.g., described in entry 320) of the request structure. This call derives a request structure protection key, decrypts the request structure using the request structure protection key, and verifies the integrity of the request structure (using one or more measures, such as computing a hash, message authentication code, cryptographic signature, etc.). If the original image requires authentication for the calculation of secure guest metadata, the authentication data is verified using sensitive data (e.g., keys, passwords, etc.) from the original (e.g., pre-update) secure guest metadata.

[0053] The issue function is requested (504) if the initialization function indicates that an issue should be executed. If an issue is selected optionally, the trusted execution environment returns an issue instruction and a wait for the issue status is associated with the request handle. The issue may include, for example, a nonce, a hash of the host's public host key, a request timestamp, a timestamp of the secure guest boot time (verification of the unpacked image), and data specific to the secure guest image or secure guest. One embodiment of executing an issue is described with reference to Figure 5B.

[0054] Referring to Figure 5B, in one embodiment, the issue processing process 550 includes, for example, a secure guest owner receiving an issue from a secure guest (552). The secure guest owner uses the sensitive data (e.g., keys, passwords, etc.) from the original (e.g., pre-update) secure guest metadata to compute a response to the issue (554). The secure guest owner sends the response to the issue to the secure guest (556). The secure guest receives the response to the issue and invokes a trusted execution environment function called Response to Issue, which returns a return code indicating whether the issue was successfully validated by the trusted execution environment (558). In one example, the Response to Issue function is callable from the guest, and this call includes a request handle and the response to the issue as arguments. The trusted execution environment uses the sensitive data from the original secure guest metadata to evaluate whether the response is equal to the encryption of the issue, and if it is, an initialized state is associated with the request handle.

[0055] The secure guest determines whether the task failed, and if it did, it undoes the update of the secure guest image (560). For example, the secure guest invokes a trusted execution environment function called secure guest metadata generation undo. In one example, this function is callable from the secure guest and takes a request handle as an argument. The undo operation invalidates the request handle.

[0056] If any tasks are encountered, after their successful execution, the process returns to generating the secure guest image and secure guest metadata shown in Figure 5A. Based on the successful execution of the tasks, or if no tasks are selected, the initialized state is associated with the request handle.

[0057] The secure guest uses a request handle to invoke a trusted execution environment function called Image Cryptographic Key Acquisition, which, for example, causes a protected image cryptographic key to be provided. In one example, the Image Cryptographic Key Acquisition function is callable from the secure guest and takes a request handle as an argument. The trusted execution environment evaluates whether the request referenced by the request handle is in a state where a protected image cryptographic key can be returned (e.g., the task has passed). Depending on the request, the trusted execution environment either fetches the old image cryptographic key or generates a new one (e.g., a random key). If a protected key (e.g., a key as a protected key usable by CPACF (Central Processor Assist for Cryptographic Functions) on an IBM Z computer) should be used, the image cryptographic key should be converted to a protected key usable by the invoking secure guest. The image cryptographic key (e.g., a protected key) is returned.

[0058] The secure guest constructs an updated plain text secure guest image (510) and initializes the measurements of the updated secure guest image (512). The secure guest image contains one or more pages (or other units) of memory, and for each page, the secure guest encrypts the page of the updated secure guest image using a protected image encryption key and updates the measurements of the updated secure guest image (514).

[0059] The secure guest invokes a trusted execution environment function called New Secure Guest Metadata Generation Termination, which takes a request handle, the measurement results for the updated secure guest image, and optionally metadata for other secure guest images as arguments, and returns the updated secure guest metadata (516). The updated secure guest metadata may include, for example, a new version if requested, a new random initialization value, replacement of the secure guest image measurement results, replacement of the image key if requested, and replacement of previous secure guest metadata.

[0060] The secure guest stores the updated secure guest image and secure guest metadata on the boot device (518), replacing all old images and metadata.

[0061] As described herein, in one or more embodiments, the process for updating a secure guest image includes, for example, the secure guest receiving an update request from a secure guest image owner; the secure guest invoking a trusted execution environment function to initialize the image update request; optionally, the secure guest receiving a task from the trusted execution environment function regarding the image update request provided to the secure guest owner; the secure guest receiving a response from the secure guest owner and providing this response to the trusted execution environment function, which then verifies the image update request based on this response; the secure guest generating an updated secure guest image based on the successful verification of the image update request; performing measurements on the updated secure guest image; encrypting the updated secure guest image using an encryption key; invoking a trusted execution environment to generate updated secure guest metadata based on the measurements of the updated secure guest; and storing the encrypted updated secure guest image and updated metadata on a boot device, replacing the old image.

[0062] In one example, the image update request structure provided in an update request includes an integrity-protected, encrypted portion. The image update request structure targets one or more systems, including trusted execution domains, so that only the target trusted execution environment can verify the integrity of the request structure, and only the target trusted execution environment can decrypt the encrypted portion of the request structure.

[0063] In one example, the integrity-protected metadata of a secure guest includes control information that can be used to determine whether an image update of the secure guest is permitted and to indicate the type of image update that is permitted.

[0064] One or more aspects of the present invention relate closely to computer technology and facilitate processing within a computer and improve its performance. Processing is facilitated by enabling the updating of a secure guest image from within a running secure guest and generating secure guest metadata for the updated secure guest image.

[0065] Since the processing within the computing environment is related to one or more aspects of the present invention, further details of one embodiment that facilitates such processing will be described with reference to Figures 6A to 6C.

[0066] Referring to Figure 6A, in one embodiment, the secure guest generates an updated image of the secure guest (600), and one or more measurements of the updated image are calculated (602). The secure guest provides one or more measurements to a trusted execution environment (604), and retrieves metadata for the updated image from the trusted execution environment, which is generated based on the secure guest's metadata and the acquisition of one or more measurements (606). With respect to a running secure guest, changes to the secure guest (e.g., applying security fixes, updating configurations) may be made by generating an updated secure guest image and retrieving the metadata associated with that secure guest image, and these changes will be available to the secure guest at the next boot, providing flexibility, improvement, or both.

[0067] In one example, the secure guest obtains an image update request structure indicating that an updated image should be generated (608). The image update request structure is provided to a trusted execution environment (610), and based on the image update request structure, a request handle is obtained from the trusted execution environment (612). The request handle is used to generate the updated image (614).

[0068] In one example, generating an updated image includes (616) requesting an encryption key from a trusted execution environment using a request handle, (618) constructing an updated plaintext image of a secure guest, (618) encrypting the updated plaintext image using the encryption key, and obtaining the encrypted image, wherein the encrypted image is the updated image, (620).

[0069] For example, calculating one or more measurements includes updating one or more initial measurements of an updated plain text image based on an encrypted image and obtaining one or more measurements to be provided to a trusted execution environment (622). For example, one or more measurements are provided using a request handle (624).

[0070] In one example, referring to Figure 6B, the cryptographic key is a protected key obtained from a trusted execution environment (630). The protected key can be used exclusively by, for example, an instance of a secure guest that invokes the trusted execution environment, and the plaintext value of the cryptographic key is unknown to the secure guest (632). Using a protected key provides security to the data and processing.

[0071] For example, an updated plain text image contains multiple pages of memory (634), and encrypting an updated plain text image involves encrypting multiple pages of memory using a protected key (636).

[0072] In one example, retrieving metadata for an updated image is based on calling a function in a trusted execution environment to create metadata for the updated image (638), the call providing a request handle and one or more measurements as arguments (640). For example, the arguments may further include other metadata for the updated image (642).

[0073] For example, an image update request structure includes an integrity-protected, encrypted portion that is exclusively interpretable by a trusted execution environment (644). This protection ensures that the request structure cannot be altered during transmission from the secure guest to the trusted execution environment, that the data within the encrypted portion of the request structure remains confidential during transmission, and that the plaintext values ​​of the encrypted data can only be accessed by the trusted execution environment.

[0074] In one example, referring to Figure 6C, the encrypted portion of the image update request structure contains data derived from sensitive data within the encrypted portion of the secure guest metadata issuing the image update request (660). A trusted execution environment can use this data from the image update request structure to verify that the author of the request structure has knowledge that is assumed to be limited only to the owner of the secure guest image.

[0075] Furthermore, in one example, an issue for the image update request structure is obtained from the trusted execution environment based on the provision of the image update request structure to the trusted execution environment (662). This issue is based, for example, on sensitive data obtained from an encrypted portion of the image update request structure (664). The secure guest obtains a response to the issue from a selected entity (666) and provides the response to the issue to the trusted execution environment (668). Based on the provision of a response to the issue, an indication of whether the issue was successful is obtained from the trusted execution environment (670). Based on the success of the issue, the generation of the updated image proceeds (672). In one example, the call to the trusted execution environment to provide the response may include the request handle as an additional argument. This issue protects the image update request structure from vulnerabilities. For example, if the issue fails or unless the issue is answered by a valid response, the trusted execution environment will not accept a final call to generate metadata for the updated image.

[0076] In one example, an image update request structure includes one or more instructions and data specifying one or more changes to the previous secure guest metadata, which are used to compute the metadata of the updated image (674).

[0077] For example, the updated image of the secure guest and its metadata are stored on the boot device (676). This makes the updated image and metadata available during the boot process.

[0078] Other variations and embodiments are possible.

[0079] Aspects of the present invention may be used in many types of computing environments. Another embodiment of a computing environment for using one or more aspects of the present invention is described with reference to Figure 7A. In this example, the computing environment 36 includes, for example, one or more native central processing units (CPUs) 37, memory 38, and one or more input / output devices or interfaces 39, coupled to each other via one or more buses 40 or other connections or both. For example, the computing environment 36 may include a PowerPC(R) processor provided by International Business Machines Corporation (Armonk, New York), an HP Superdome with an Intel(R) Itanium(R) II processor provided by Hewlett-Packard Corporation (Palo Alto, California), or other machines or combinations based on architectures provided by International Business Machines Corporation, Hewlett-Packard Corporation, Intel Corporation, Oracle Corporation, or other companies, or a combination thereof. PowerPC is a trademark or registered trademark of International Business Machines Corporation in at least one jurisdiction. Intel and Itanium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

[0080] The native central processing unit 37 includes one or more native registers 41, such as one or more general-purpose registers or one or more dedicated registers or both, used during processing within the environment. These registers contain information representing the state of the environment at any particular point in time.

[0081] Furthermore, the native central processing unit 37 executes instructions and code stored in memory 38. In one particular example, the central processing unit executes emulator code 42 stored in memory 38. This code allows a computing environment configured on one architecture to emulate another architecture. For example, the emulator code 42 allows machines based on architectures other than the z / Architecture instruction set architecture (such as PowerPC processors and HP Superdome servers) to emulate the z / Architecture instruction set architecture and execute software and instructions developed based on the z / Architecture instruction set architecture.

[0082] Further details relating to the emulator code 42 are described with reference to Figure 7B. The guest instructions 43 stored in memory 38 include software instructions developed to run on architectures other than the native CPU 37 architecture (e.g., those that interact with machine instructions). For example, the guest instructions 43 may be designed to run on a processor based on the z / Architecture instruction set architecture, but instead are emulated on the native CPU 37, which may be, for example, an Intel Itanium II processor. In one example, the emulator code 42 includes an instruction fetch routine 44 for retrieving one or more guest instructions 43 from memory 38 and for optionally providing local buffering of the retrieved instructions. The emulator code 42 also includes an instruction translation routine 45 for determining the type of guest instruction retrieved and for translating the guest instruction into one or more corresponding native instructions 46. This translation includes, for example, identifying the function performed by the guest instruction and selecting a native instruction to perform that function.

[0083] Furthermore, the emulator code 42 includes an emulation control routine 47 for triggering the execution of a native instruction. The emulation control routine 47 may cause the native CPU 37 to execute a native instruction routine that emulates one or more already obtained guest instructions, and upon completion of such execution, return control to the instruction fetch routine to emulate the acquisition of the next guest instruction or group of guest instructions. The execution of the native instruction 46 may include reading data from memory 38 into a register, storing data back into memory from the register, or performing some kind of arithmetic or logical operation as determined by the translation routine.

[0084] For example, each routine is implemented in software stored in memory and executed by the native central processing unit 37. In other examples, one or more routines or operations are implemented in firmware, hardware, software, or any combination thereof. Registers of the emulated processor may be emulated by using the registers 41 of the native CPU or by using locations in memory 38. In embodiments, the guest instruction 43, the native instruction 46, and the emulator code 42 may reside in the same memory or be distributed across different memory devices.

[0085] Instructions, commands, or calls that can be emulated include trusted execution environment calls described herein in accordance with one or more aspects of the present invention. Furthermore, other instructions, commands, functions, operations, or one or more aspects of the present invention, or combinations thereof, may be emulated in accordance with one or more aspects of the present invention.

[0086] The computing environments described herein are merely examples of available computing environments. Other environments may be used, including, but not limited to, undivided environments, divided environments, cloud environments, or emulated environments, or combinations thereof, and embodiments are not limited to any one of these environments. Various examples of computing environments are described herein, but one or more embodiments of the present invention may be used with many types of environments. The computing environments provided herein are merely examples.

[0087] Each computing environment can be configured to include one or more embodiments of the present invention.

[0088] One or more embodiments may relate to cloud computing.

[0089] While this disclosure includes a detailed description of cloud computing, it should be understood that implementations of the contents enumerated herein are not limited to cloud computing environments. Embodiments of the present invention may be implemented in combination with any other type of computing environment that is currently known or may be developed in the future.

[0090] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services), allowing these resources to be provisioned and released quickly with minimal administrative effort or interaction with service providers. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0091] The features are as follows:

[0092] On-demand self-service: Cloud users can unilaterally and automatically provision computing power, such as server time and network storage, as needed, without requiring human interaction with service providers.

[0093] Broad network access: The capability is available over the network and accessible through standard mechanisms, facilitating use by heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0094] Resource Pooling: A provider's computing resources are pooled and delivered to multiple users using a multi-tenant model, with various physical and virtual resources dynamically allocated and reallocated as needed. There is a sense of location independence, and users typically have neither control nor know the exact location of the resources provided, although at a higher level of abstraction, they may be able to specify a location (e.g., country, state, or data center).

[0095] Rapid Adaptability: Capabilities can be provisioned quickly and flexibly, sometimes automatically, scale out rapidly, and be released quickly to scale in rapidly. The capacity available for provisioning often appears to the user as if they can purchase any amount at any time without limit.

[0096] Measured Services: Cloud systems leverage metering capabilities to automatically control and optimize resource usage at an appropriate level of abstraction for each type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and users.

[0097] The service model is as follows:

[0098] Software as a Service (SaaS): The ability provided to the user is the use of a provider's applications running on a cloud infrastructure. These applications can be accessed from various client devices via thin-client interfaces such as web browsers (e.g., web-based email). Users do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or individual application functions, except for the possibility of making limited user-specific application configuration settings.

[0099] Platform as a Service (PaaS): The ability provided to the user is to deploy applications created or acquired by the user, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The user does not manage or control the underlying cloud infrastructure, including the network, servers, operating system, or storage, but can control the configuration of the deployed application and, in some cases, the application hosting environment.

[0100] Infrastructure as a Service (IaaS): The capability provided to users is the provisioning of processing, storage, networking, and other basic computing resources, allowing users to deploy and run any software, including operating systems and applications. Users do not manage or control the underlying cloud infrastructure, but they can control the operating system, storage, and deployed applications, and in some cases, have limited control over selected network components (e.g., host firewalls).

[0101] The deployment model is as follows:

[0102] Private Cloud: This cloud infrastructure is operated solely for the organization. It can be managed by this organization or a third party and can reside on-premises or off-premises.

[0103] Community Cloud: This cloud infrastructure is shared by multiple organizations and supports specific communities that share common interests (e.g., missions, security requirements, policies, and compliance considerations). It can be managed by these organizations or third parties and can reside on-premises or off-premises.

[0104] Public Cloud: This cloud infrastructure is available for use by general users or large industry groups and is owned by the organization that sells the cloud service.

[0105] Hybrid Cloud: This cloud infrastructure is a combination of two or more clouds (private, community, or public) that are joined together while retaining their own distinct entities, through standardized or proprietary technologies that enable the portability of data and applications (e.g., cloud bursting to adjust load balancing between clouds).

[0106] Cloud computing environments are service-oriented environments that emphasize statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure, which includes a network of interconnected nodes.

[0107] Referring now to Figure 8, an exemplary cloud computing environment 50 is shown. As illustrated, the cloud computing environment 50 includes one or more cloud computing nodes 52 on which local computing devices used by cloud users (e.g., a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automotive computer system 54N, or a combination thereof) can communicate. The nodes 52 may communicate with each other. The nodes 52 may be physically or virtually grouped within one or more networks into a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described herein (not illustrated). This allows the cloud computing environment 50 to provide infrastructure, platforms, or software, or a combination thereof, as a service, without requiring cloud users to maintain resources on their local computing devices. The types of computing devices 54A-N shown in Figure 8 are intended for illustrative purposes only, and it is understood that the computing node 52 and the cloud computing environment 50 can communicate with any type of computer-controlled device via any type of network or network-addressable connection (e.g., a connection using a web browser) or both.

[0108] Referring now to Figure 9, a set of functional abstraction layers provided by the cloud computing environment 50 (Figure 8) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 9 are intended for illustrative purposes only, and embodiments of the present invention are not limited thereto. As illustrated, the following layers and corresponding functions are provided:

[0109] The hardware and software layer 60 includes hardware components and software components. Examples of hardware components include a mainframe 61, RISC (Reduced Instruction Set Computer) architecture-based servers 62, 63, blade servers 64, storage devices 65, and networks and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0110] The virtualization layer 70 includes an abstraction layer that can provide virtual entities such as virtual servers 71, virtual storage 72, virtual networks 73 including virtual private networks, virtual applications and operating systems 74, and virtual clients 75.

[0111] In one example, the management layer 80 may provide the functions described below. Resource provisioning 81 dynamically procures computing and other resources used to perform tasks within the cloud computing environment. Measurement and pricing 82 tracks the costs of using resources within the cloud computing environment and sends invoices or bills for the use of those resources. In one example, those resources may include application software licenses. Security verifies the identities of cloud users and tasks and protects data and other resources. The user portal 83 provides users and system administrators with access to the cloud computing environment. Service level management 84 allocates and manages cloud computing resources to meet required service levels. Service Level Agreement (SLA) planning and execution 85 prepares and procures cloud computing resources in advance of anticipated future demands in accordance with the SLA.

[0112] Workload Layer 90 provides examples of capabilities available in a cloud computing environment. Examples of workloads and capabilities that may be provided from this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom education delivery 93, data analysis processing 94, transaction processing 95, and secure guest image and secure guest metadata update processing 96.

[0113] Aspects of the present invention may be systems, methods, or computer program products, or combinations thereof, at any possible level of technical detail of integration. A computer program product may include one or more computer-readable storage media containing computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0114] A computer-readable storage medium can be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exclusive list of more specific examples of computer-readable storage media includes portable floppy disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, static random access memory (SRAM), compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punched cards or grooved structures on which instructions are recorded, and any appropriate combination thereof. When used herein, computer-readable storage media should not be interpreted as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmitting media (e.g., light pulses passing through optical fiber cables), or electrical signals transmitted through wires.

[0115] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing device / processing device, or to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof). This network may include copper transmission cables, optical transmission fibers, wireless transmitters, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface within each computing device / processing device receives computer-readable program instructions from the network and transfers those computer-readable program instructions for storage on a computer-readable storage medium within each computing device / processing device.

[0116] The computer-readable program instructions for performing the operation of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuits, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk(R) and C++, and procedural programming languages ​​such as the C programming language or similar programming languages. The computer-readable program instructions may be executed as a whole on the user's computer, partially as a standalone software package on the user's computer, partially on the user's computer and a remote computer, respectively, or as a whole on a remote computer or a server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (for example, via the Internet using an Internet service provider). In some embodiments, to carry out aspects of the present invention, electronic circuits including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may be customized by executing computer-readable program instructions using state information of computer-readable program instructions.

[0117] Aspects of the present invention will be described herein by reference to flowcharts or block diagrams, or both, of methods, apparatuses (systems), and computer program products, according to embodiments of the present invention. It will be understood that each block in a flowchart or block diagram, or both, and any combination of blocks contained in a flowchart or block diagram, or both, can be implemented by computer-readable program instructions.

[0118] These computer-readable program instructions may be provided to a computer or other programmable data processing device processor to create a machine, so that instructions executed via the processor of the computer or other programmable data processing device may create means to perform functions / operations specified in one or more blocks of a flowchart or block diagram or both. These computer-readable program instructions may be stored on a computer-readable storage medium containing instructions that include a product containing instructions to perform modes of functions / operations specified in one or more blocks of a flowchart or block diagram or both, and may be used to instruct a computer, a programmable data processing device, or other device, or a combination thereof, to function in a particular manner.

[0119] Computer-readable program instructions may be read into a computer, another programmable data processing device, or other device so that instructions executed on a computer, another programmable device, or other device perform functions / operations specified in one or more blocks of a flowchart or block diagram, or both, thereby causing a series of operable steps to be executed on a computer, another programmable device, or other device that generates a computer implementation process.

[0120] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a defined logical function. In some alternative implementations, the functions shown in the blocks may occur in an order different from the order shown in the figures. For example, two consecutively shown blocks may actually be implemented as a single step, executed simultaneously, executed substantially simultaneously in a way that partially or completely overlaps in time, or possibly executed in reverse order, depending on the functions they contain. Note also that each block in the block diagram or flowchart diagram, or both, and any combination of blocks contained in the block diagram or flowchart diagram, or both, may be implemented by a dedicated hardware-based system that performs a defined function or operation, or a combination of dedicated hardware and computer instructions.

[0121] In addition to the above, one or more aspects may be provided, presented, deployed, managed, or serviced by a service provider that provides management of the customer's environment. For example, a service provider may create, maintain, and support computer code or computer infrastructure, or both, that runs one or more aspects for one or more customers. In return, the service provider may receive payment from the customer, for example, in accordance with a subscription or fee agreement, or both. As an additional or alternative, the service provider may receive payment from the sale of advertising content to one or more third parties.

[0122] In one aspect, an application may be deployed to perform one or more embodiments. As one example, the deployment of an application may include providing a computer infrastructure that functions to perform one or more embodiments.

[0123] In a further embodiment, a computing infrastructure may be deployed that includes integrating computer-readable code into a computing system, such that the code combined with the computing system can execute one or more embodiments.

[0124] In a further embodiment, a process for integrating a computing infrastructure may be provided, which includes integrating computer-readable code into a computer system. The computer system comprises a computer-readable medium, the computer medium including one or more embodiments. The code combined with the computer system can perform one or more embodiments.

[0125] Although various embodiments have been described above, these are merely examples. For example, computing environments of other architectures may be used to incorporate one or more embodiments, to use one or more embodiments, or both. Furthermore, various instructions, commands, functions, calls, or actions, or combinations thereof, may be used. Furthermore, various types of structures may be used. Many variations are possible.

[0126] Various embodiments are described herein. Furthermore, many modifications are possible without departing from the spirit of the embodiments of the present invention. It should be noted that each embodiment or feature and its variations described herein can be combined with any other embodiment or feature, insofar as they do not contradict each other.

[0127] Furthermore, other types of computing environments can benefit and be used. For example, a data processing system could be used that includes at least two processors, directly or indirectly coupled to memory elements via a system bus, suitable for storing, executing, or both program code. These memory elements include, for example, local memory used during the actual execution of program code, bulk storage, and cache memory for temporarily storing at least some program code to reduce the number of times the code must be retrieved from bulk storage during execution.

[0128] Input / output devices or I / O devices (including, but not limited to, keyboards, displays, pointing devices, DASDs, tapes, CDs, DVDs, thumb drives, and other storage media) may be coupled to the system directly or through an intermediary I / O controller. Network adapters may be coupled to the system, enabling data processing systems to be coupled to other data processing systems or remote printers or storage devices through an intermediary private or public network. Modems, cable modems, and Ethernet(R) cards are just a few of the types of network adapters that can be used.

[0129] The terms used herein are intended solely to describe specific embodiments and are not intended to be limiting. Where used herein, the singular forms “a,” “an,” and “the” are intended to include the plural form unless otherwise explicitly indicated in the context. It will be further understood that the terms “equipped with” or “possessing” or both, as used herein, indicate the presence of a described function, integer, step, operation, element, or component, or a combination thereof, but do not exclude the presence or addition of one or more other functions, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0130] All means or steps and functional elements within the following claims, along with their corresponding structures, materials, actions, and equivalents, are intended to include, if any, any structures, materials, or actions for performing a function in combination with other claimed elements, when specifically claimed. Descriptions of one or more embodiments are presented for illustrative and explanatory purposes, but are not intended to be exhaustive and are not limited to the disclosed forms. Many modifications and variations will be apparent to those skilled in the art. Embodiments have been selected and described to best illustrate various aspects and practical applications, and to enable others skilled in the art to understand the diverse embodiments with various modifications suitable for a particular intended use.

Claims

1. A computer program for facilitating processing within a computing environment, wherein the computer program is installed on a computer system. The secure guest generates an updated image of the secure guest, Calculating one or more measurement results for the updated image, The secure guest provides the one or more measurement results to a trusted execution environment. A computer program that causes a computer program to perform a method including obtaining metadata of the updated image from the trusted execution environment, wherein the metadata is generated based on obtaining the metadata of the secure guest and one or more measurement results.

2. The method described above is The secure guest obtains an image update request structure indicating that the updated image should be generated, To provide the aforementioned image update request structure to the trusted execution environment, The computer program according to claim 1, further causing the computer system to obtain a request handle from the trusted execution environment based on the image update request structure, wherein the request handle is used in generating the updated image.

3. The process of generating the updated image is as follows: Using the aforementioned request handle, request an encryption key from the trusted execution environment, This involves constructing an updated plain text image of the secure guest, Encrypting the updated plain text image using the encryption key, and obtaining the encrypted image, wherein the encrypted image is the updated image, and the acquisition is performed. The computer program according to claim 2, wherein calculating the one or more measurement results includes updating one or more initial measurement results of the updated plain text image based on the encrypted image and obtaining the one or more measurement results to be provided to the trusted execution environment, the one or more measurement results being provided using the request handle.

4. The computer program according to claim 3, wherein the encryption key is a protected key obtained from the trusted execution environment, the protected key can be used exclusively by the instance of the secure guest that invokes the trusted execution environment, and the plaintext value of the encryption key is unknown to the secure guest.

5. The computer program according to claim 4, wherein the updated plain text image comprises multiple pages of memory, and the encryption of the updated plain text image comprises encrypting the multiple pages of memory using the protected key.

6. The computer program according to claim 2, wherein obtaining the metadata of the updated image is based on calling a function in the trusted execution environment to create the metadata of the updated image, the call providing the request handle and one or more measurement results as arguments.

7. The computer program according to claim 6, wherein the argument further includes other metadata of the updated image.

8. The computer program according to claim 2, wherein the image update request structure includes an integrity-protected, encrypted portion and is exclusively interpretable by the trusted execution environment.

9. The computer program according to claim 8, wherein the encrypted portion of the image update request structure includes data derived from sensitive data in the encrypted portion of the metadata of the secure guest issuing the image update request.

10. The method described above is Based on providing the image update request structure to the trusted execution environment, the acquisition of issues related to the image update request structure from the trusted execution environment, wherein the issues are based on confidential data obtained from the encrypted portion of the image update request structure. The secure guest obtains the response to the aforementioned issue from the selected entity, To provide the response to the problem from the secure guest to the trusted execution environment, Based on providing the response to the aforementioned task, an indication of whether the task was successful is obtained from the reliable execution environment, The computer program according to claim 2, further causing the computer system to continue generating the updated image based on the success of the aforementioned task.

11. The computer program according to claim 2, wherein the image update request structure includes one or more instructions and data specifying one or more changes to previous secure guest metadata used to compute the metadata of the updated image.

12. The computer program according to any one of claims 1 to 11, wherein the method further causes the computer system to store the updated image of the secure guest and the metadata of the updated image in a boot device.

13. A computer system for facilitating processing within a computing environment, wherein the computer system is Memory and The computer system is configured to perform the method, comprising at least one processor that communicates with the memory, and the method is The secure guest generates an updated image of the secure guest, Calculating one or more measurement results for the updated image, The secure guest provides the one or more measurement results to a trusted execution environment. A computer system comprising obtaining metadata of the updated image from the trusted execution environment, wherein the metadata is generated based on obtaining the secure guest metadata and one or more measurement results.

14. The method described above is The secure guest obtains an image update request structure indicating that the updated image should be generated, To provide the aforementioned image update request structure to the trusted execution environment, The computer system according to claim 13, further comprising obtaining a request handle from the trusted execution environment based on the image update request structure, wherein the request handle is used in generating the updated image.

15. The process of generating the updated image is as follows: Using the aforementioned request handle, request an encryption key from the trusted execution environment, This involves constructing an updated plain text image of the secure guest, Encrypting the updated plain text image using the encryption key, and obtaining the encrypted image, wherein the encrypted image is the updated image, and the acquisition is performed. The computer system according to claim 14, wherein calculating the one or more measurement results includes updating one or more initial measurement results of the updated plain text image based on the encrypted image and obtaining the one or more measurement results to be provided to the trusted execution environment, the one or more measurement results being provided using the request handle.

16. The computer system according to claim 14, wherein obtaining the metadata of the updated image is based on calling a function in the trusted execution environment to create the metadata of the updated image, the call providing the request handle and one or more measurement results as arguments.

17. A computer implementation method for facilitating processing within a computing environment, wherein the computer implementation method is The secure guest generates an updated image of the secure guest, Calculating one or more measurement results for the updated image, The secure guest provides the one or more measurement results to a trusted execution environment. A computer implementation method comprising obtaining metadata of the updated image from the trusted execution environment, wherein the metadata is generated based on obtaining the secure guest metadata and one or more measurement results.

18. The secure guest obtains an image update request structure indicating that the updated image should be generated, To provide the aforementioned image update request structure to the trusted execution environment, The computer implementation method according to claim 17, further comprising obtaining a request handle from the trusted execution environment based on the image update request structure, wherein the request handle is used in generating the updated image.

19. The process of generating the updated image is as follows: Using the aforementioned request handle, request an encryption key from the trusted execution environment, This involves constructing an updated plain text image of the secure guest, Encrypting the updated plain text image using the encryption key, and obtaining the encrypted image, wherein the encrypted image is the updated image, and the acquisition is performed. The computer implementation method according to claim 18, wherein calculating the one or more measurement results includes updating one or more initial measurement results of the updated plain text image based on the encrypted image and obtaining the one or more measurement results to be provided to the trusted execution environment, the one or more measurement results being provided using the request handle.

20. The computer implementation method according to claim 18, wherein obtaining the metadata of the updated image is based on calling a function in the trusted execution environment to create the metadata of the updated image, the call providing the request handle and one or more measurement results as arguments.

Images