Patent ID: 7996687
Filing Date: 2011-08-09
Classification: G06F,H04L

Abstract:
1. A computer program product for implementing a trusted computing environment within a data processing system, said data processing system including a single hardware trusted platform module (TPM), the computer program product comprising: computer readable storage device having computer readable program code embodied therewith, the computer readable program code configured to: provide a plurality of logical partitions and a host partition in said data processing system, wherein said host partition is not included in said plurality of logical partitions, and wherein said TPM does not include said plurality of logical partitions or said host partition; generate, by said host partition, a unique context for each one of said plurality of logical partitions, said unique context required to be stored in said hardware TPM when one of said plurality of logical partitions requires access to said hardware TPM, wherein each said unique context includes persistent TPM state information and runtime TPM state for one of said plurality of logical partitions for which said unique context was generated; associate, by a context manager that is included in said host partition, each one of said partitions with one of a plurality of context storage slots in said hardware TPM, at least one of said plurality of context slots being simultaneously associated with more than one of said plurality of logical partitions; encrypt, by said context manager, said unique context that was generated for each one of said plurality of logical partitions to form an encrypted context; store, by said context manager, said encrypted context that was generated for each one of said plurality of logical partitions in non-volatile storage in said host partition when said encrypted context is not stored in said hardware TPM; include, within said host partition, a TPM physical device driver; include in each one of said plurality of logical partitions a separate virtual TPM device driver; present, by said host partition, a separate virtual TPM to each one of said plurality of logical partitions, wherein each one of said plurality of logical partitions cannot access said hardware TPM directly and must use said virtual TPM that is presented to each one of said plurality of logical partitions to access said hardware TPM; and swap contexts into and out of said hardware TPM during runtime of said data processing system when one of said plurality of partitions require access to said hardware TPM, contexts associated with said one of said plurality of partitions being physically stored in said hardware TPM.