Method for protecting data from unauthorised access

The present invention relates to a method for protecting user data from unauthorized access, the method comprising the steps of, on a data processing system:

TECHNICAL FIELD

The present invention relates to a method for protecting data of a user of a data processing system from unauthorized access by another user of that data processing system.

BACKGROUND OF THE INVENTION

Grid computing and utility computing provides remote users with resources that are shared among multiple users. One problem that has restricted the use of grids, especially beyond a single enterprise's intra-grid, is that the data from a computation at a grid node could be readable by a subsequent user of the same grid resource, in particular in the case where a grid node or a logical partition, such as a virtual machine, of a grid node is sequentially allocated and used by different users. A desirable security feature is to clear a resource of confidential data when switching from user to user. It would be useful if no information about a computation of a user is leaked to a next user that acquires the same resource.

The Trusted Computing Group (TCG) Specification Architecture Overview Revision 1.2, 28 Apr. 2004, gives an introduction to TCG goals and architecture. It defines anticipated scenarios for use of Trusted Platform Modules (TPM) enabled platforms, compliance procedures and anticipated implications on manufacturing and support processes.

Accordingly, it is desirable to provide a method that renders the data of one user of a data processing system screened from and unavailable to another user of the system.

SUMMARY OF THE INVENTION

According to an embodiment of an aspect of the present invention, there is provided a method for protecting user data from unauthorized access, the method comprising the steps of, on a data processing system: maintaining the user data in encrypted form stored on a second storage, when loading an operating system using an operating system loader: receiving in a first disk key transmission step from a first user system a symmetric user key that is only accessible by the data processing system if the operating system loader has been started on behalf of the first user system, wherein the symmetric user key is received sealed to a combination of the operating system loader and a user identifier corresponding to the first user system in the first disk key transmission step; accessing the symmetric user key, if the operating system loader has been started on behalf of the first user system; decrypting in a user data decryption step the user data using the symmetric user key, maintaining the symmetric user key in a volatile memory. This method is advantageous in that the user data are transmittable in an encrypted form whereby unauthorized access is hampered. The symmetric user key is protected by a mechanism that necessitates a configuration of the operating system loader being started for the user who is authorized to access the user data. This allows the data processing system to run operating systems for multiple users while access by those users to the user data of the other users is hampered. It also is operable to allow startup of the operating system by the user but also by the operator system that controls the data processing system. Such operator system-driven startup could be useful, for instance, for providing the functionality of loadbalancing.

Preferably, an embodiment of the present invention further comprises a user data transmission step for receiving from the user system the user data. In this way, the user may transmit its user image to any data processing system to initialize the operating system for that user system.

Desirably, an embodiment of the present invention further comprises a key agreement protocol step for agreeing with the user an updated user key. In this way, both the user system and the data processing system possess the updated user key.

Preferably, the operating system loader comprises a bootloader.

Desirably, in an embodiment of the present invention, in the first disk key transmission step, the sealing is created in a first sealing step by use of a first trusted platform module in accordance with the TCG specification architecture.

Preferably, an embodiment of the present invention further comprises a second sealing step for sealing the symmetric user key to a combination of the operating system loader and the user identifier corresponding to the first user system. Desirably, a second disk key transmission step is performed for transmitting to an operator system the symmetric user key sealed to the combination of the operating system loader and the user identifier. Preferably, a startup command step is performed for receiving from an operator system the user key sealed to the combination of the operating system loader and the user identifier. In this way, the data processing system shuts down and reboots, upon initialization by an operating system coupled thereto, so that the scope of visibility of user data received from a user system is reduced to other user systems.

Desirably, a user reboot command step is performed for rebooting upon a reboot command from the first user system. When the first user system initialises the reboot, it starts here with the user image being encrypted by a sealed user key. In this way, a reboot may be performed for a previous user of the data processing system in a way that confidential data received from that user is not visible to other users.

Preferably, an operator reboot command step is performed for rebooting upon a reboot command from the operator system. When the operating system issues a reboot command to the data processing system, it also communicates to the data processing system the sealed user key. Since the user key can only be unpacked if the configuration to which the key has been sealed and which corresponds to a specific user is loaded on the data processing system, user data encrypted with the key may not be accessed by other users.

According to a further embodiment of the present invention, there is provided a method for protecting user data from unauthorized access, the method comprising the step of, on a first user system: transmitting in a first disk key transmission step to a data processing system a symmetric user key that is only accessible by the data processing system if an operating system loader has been started on behalf of the first user system, the symmetric user key being transmitted sealed to a combination of the operating system loader and a user identifier corresponding to the first user system in the first disk key transmission step, such that the data processing system accesses the symmetric user key if the operating system loader has been started on behalf of the first user system, decrypts in a user data decryption step the user data using the symmetric user key, maintains the user data in encrypted form stored on a second storage, and maintains the symmetric user key in a volatile memory.

According to an embodiment of a further aspect of the present invention, there is provided a computer program product comprising a computer-readable medium embodying program instructions executable by a processor to perform a method as hereinbefore described.

The advantages of the further aspect of the invention correspond to the advantages of the first aspect of the invention.

DETAILED DESCRIPTION OF THE DRAWINGS

FIG. 1is a schematic diagram illustrating a data processing system20coupled to a first user system10and an operator system30. The first user system10comprises a first processor12that is connected to a first controller unit11and a first storage unit13in which a sealed key14is stored. The first processor12is coupled to a second processor22that is a part of the data processing system20via a first network connection1. The second processor22is connected to a second controller unit21, a RAM24and a second storage23. The second storage23comprises a first user image25and a second user image26. The data processing system20is coupled to a third processor32via a second network connection2. The third processor32is a part of the operator system30and is connected to a third storage33in which a sealed key34is stored. On the data processing system20, an embodiment of the present invention can be executed for protecting user data from unauthorized access.

An embodiment of the present invention can leverage a TCG service.

The first service is called “attestation”. Attestation allows a user to remotely verify the integrity of a configuration. Attestation can hence be used to verify that a configuration holds only encrypted data on a harddisk such that a shutdown enforces that the key is lost.

The second service is sealing. Sealing is an operation provided by a computing platform that enables to seal confidential information to a configuration that has been loaded on this computing platform. In other terms the confidential information is only accessible if the configuration that it has been sealed to is actually present on the computing platform. This feature can be used to guarantee that the confidential information is not obtained by another configuration during startup, such as a different user.

The main mechanisms to protect sequential confidentiality is to encrypt the harddisk using a key and while keeping any image that is booted on that harddisk, the key is only kept in volatile memory. Once the machine is shut down, the key will be erased from the volatile memory. As a consequence, the data on the disk will not be visible to a subsequent user.

A user has a personal configuration image, for example, comprising an encrypted partition including OS, applications, and data, that is encrypted. This image is only startable if the customer agrees and the base configuration, such as hardware, BIOS, boot loader, of the system is verified to provide certain integrity guarantees, for example, the image is started on “pure” hardware and not on a simulator. This may include starting the same image on different data processing systems. In order to facilitate serial reuse, and later reuse by the same user, the data processing system can provide logical encrypted disk partitions assigned to the different users. The mapping of users to partitions can be public, and determined by a user ID to disk partition index, but the access to the partition would require the key, and is controlled by the above described methods. The price charged to a user could then be a function of the usage time and the time and size for retaining a secure disk partition.

An embodiment of the present invention can leverage the services of the TPM to enhance data security while booting. This includes:User is talking to “his” data processing system;The data processing system boots the encrypted OS;Only the data processing system obtains the key Ku1;The data processing system does not store the key Ku1on the harddisk or other non-volatile memory;Optionally, the data processing system only starts an OS image when the user approves this.

InFIG. 2, the steps of an installation method are illustrated. The operator system30issues a startup command in a startup command step50to the data processing system20. The first user system10possesses a private and public key pair, comprising a public key pubU1and a private key privU1. The first user system10sends in a public key transmission step51its public key pubU1to the data processing system20. This step could be initiated by the data processing system20informing the first user system10about the startup command received. It is also possible that the first user system10has instructed the operator system30to issue the startup command and thereafter sends the public key pubU1. The first user system10also sends in a user image transmission step52user data DU1, also referred to as first user image25, to the data processing system20. Having received the public key pubU1and the user data DU1the data processing system20performs an operating system loading step53using an operating system loader, for example, a boot loader BL1. The boot loader BL1can be available from a public source. In this way, an operating system for the first user system10is started up using the received user data DU1. The result of the operating system loading step53is a running operating system image OSU1(D), with the first user image25being stored in the second storage23. The operating system image OSU1(D) has been customized with the first user image25. Thereafter the data processing system20performs a disk key generation step54. Therein the operating system image OSU1(D) generates a symmetric key KU1and encrypts this key KU1using the received public key pubU1of the first user system10. The resulting encrypted symmetric key KU1is then sent in a first disk key transmission step55to the first user system10, where it can be unpacked in a disk key decryption step61using its private key privU1. The operating system image OSU1(D) operates while encrypting its second storage23in a first disk encryption step56using the symmetric key KU1. Since the user data DU1has been stored in that second storage23it is also encrypted with the symmetric key KU1. The symmetric key KU1is kept in the RAM24.

The operator system30can at any later point in time execute a shutdown command step57wherein it sends a shutdown command to the data processing system20. Thereupon the data processing system20performs a shutdown step58performing a shutdown, in the course of which the operating system image OSU1(D) is stopped, and the content of the RAM24is deleted. Thereafter the data processing system20no longer has access to the symmetric key KU1. However, the first user system10has access to the symmetric key KU1which means that only the first user system10can access the operating system image OSU1(D) by using the received and unpacked symmetric key KU1. This also is the case if the data processing system20breaks down or is hibernated.

This method bears the risk that the operating system image OSU1(D) could be accessible by the operator system30or by a second user. Such a second user could access the user data DU1during the user image transmission step52because that user data DU1is transmitted without cryptographic protection.

At any later point in time the operator system30can execute an operator reboot command step59by sending a reboot command to the data processing system20whereupon it can receive from the first user system10the symmetric key KU1in a second disk key transmission step60. This step can again be either executed by the first user system10on request by the data processing system20or by the first user system10after that first user system10has initiated the rebooting operation by requesting the operator system30to execute the operator reboot command step59. Then, the data processing system20performs a disk decryption step62wherein it uses the received symmetric key KU1to decrypt the second storage23and hence obtain the decrypted operating system image OSU1(D). Thereby the data processing system20can restart the operating system image OSU1(D) for the first user system10.

InFIG. 3, a method is illustrated for installation of an operating system image using a sealed symmetric key KU1.

In a first sealing step48the first user system10generates a symmetric key KU1and seals that symmetric key KU1to the configuration BL1+U1. This step48effectuates that the symmetric key KU1can only be accessed if the boot loader BL1is started for the first user system10. Herefore a mechanism of the TPM specification can be used that is referred to as sealing. It is hence advantageous to equip the first user system10with a TPM module that is able to perform such sealing. The result of this step48is the sealed symmetric key KU1, which is in the following also referred to as sealed message. Then the first user system10sends in a first disk key transmission step49this sealed message to the operator system30.

Once the operator system30performs the startup command step50it forwards the sealed message to the data processing system20. There the sealed message is opened in an unsealing step63by satisfying the configuration of starting the boot loader BL1for the first user system10. As a result the data processing system20obtains the symmetric key KU1. In other words the data processing system20starts a boot loader BL1which again could be available from a public source, for the first user system10.

The first user system10also uses the symmetric key KU1for encrypting the user image DU1. For having the data processing system20startup an operating system for the first user system10the first user system10sends the encrypted user image DU1to the data processing system20.

Once the first user system10has, in an encrypted user image transmission step64, transmitted the encrypted user image DU1to the data processing system20, the data processing system20performs a user data decryption step65, using the unsealed symmetric key KU1, thereby obtaining the decrypted user image DU1. In a user image storing step66the data processing system20stores the user image DU1in the second storage23and in a first disk key encryption step56encrypts the user image DU1using the symmetric key KU1.

Since the user image DU1has been transmitted in an encrypted form this user image DU1can contain confidential information which is not visible to or accessible by a second user without the symmetric key KU1. The result is again a running operating system image OSU1(D), with the first user image25being stored in the second storage23. The operating system image OSU1(D) has been customized with the first user image25.

The above booting process is referred to inFIG. 3with roman number I.

Roman number II refers to an optional process of generating a session key kU1′, also referred to as updated user key. The symmetric session key kU1′can be generated by making use of a key agreement protocol in a key agreement protocol step67. As a result thereof both, the first user system10, and the data processing system20possess the symmetric session key kU1′. At the data processing system20the boot loader BL1encrypts the user image DU1using the symmetric session key kU1′.

InFIG. 4, the process of shutdown and rebooting the operating system image OSU1(D) upon initialization by the operator system30is illustrated. It is desired to enable the data processing system20for any user system10that has previously used the data processing system20, to reboot in a way that the visibility of user data DU1received from that user system10to other user systems is reduced.

The operator system30can execute a shutdown command step57wherein it sends a shutdown command to the data processing system20. The data processing system20here starts the shutdown process in a state where it has the user image DU1stored in the second storage23, wherein the user image DU1has been encrypted by the symmetric session key kU1′. If the key agreement protocol step67has not been used before, the user image DU1has been encrypted by the symmetric user key kU1.

In a second sealing step69the boot loader BL1seals the symmetric session key kU1′to the configuration of BL1+U1, i.e. that symmetric session key kU1′is only accessible if the boot loader BL1is started for the first user system10. In a second sealed disk key transmission step70the boot loader BL1of the data processing system20hands the sealed symmetric session key kU1′over to the operator system30. This shutdown process is denoted with roman number III inFIG. 4.

Next, the rebooting of the operating system image OSU1(D) upon initialization by the operator system30is described, as denominated by roman number IV inFIG. 4. There might be arrangements where the data processing system20can choose what image to start without asking the first user system10. For instance in a networked environment wherein several user systems run several operating system images on several data processing systems the operator system for that networked environment can in an effort to perform load balancing decide to redistribute the load on the various data processing systems. In such case, the number of running operating system images for one user can be reduced, for example, if that user has less processes actively running, while the number of operating system images for another user system can be increased, for example, if that user needs more operating system images to operate its processes. This kind of loadbalancing would be conducted without involvement of the user systems, i.e. autonomously by the operator system.

When the operator system30decides to reboot the boot loader BL1, it starts here with the encrypted second storage23containing the user image DU1, wherein the user image DU1has been encrypted by the symmetric session key kU1. The symmetric session key kU1′has been sealed to BL1+U1and the seal can be maintained in the PCR, i.e. platform configuration register, of the operator system30. Having added the identity of the user U1as a component of the seal to the PCR ensures that the operator system30can obtain the user identity at any time. Since the symmetric session key kU1′can only be retrieved/unsealed if BL1+U1are correctly stored in the PCR, the operator system30can also ask for the corresponding PCR value and thus validate/obtain the user ID U1that has been stored in the PCR. In this way, the operator system30can identify the user at any time when this is desired.

The operator system30issues a startup command in the startup command step50to the data processing system20. The operator system30also communicates to the data processing system20the symmetric session key kU1′sealed to (BL1+U1). There the sealed symmetric session key kU1′is opened in the unsealing step63by satisfying the configuration of starting the boot loader BL1for the first user system10. As a result the data processing system20obtains the symmetric session key kU1′. In other words the data processing system20starts a boot loader BL1which again could be available from a public source, for the first user system10.

The data processing system20performs a user data decryption step65, using the unsealed symmetric session key kU1′, thereby obtaining the decrypted user image DU1.

FIG. 5is a schematic illustration of a boot method initiated by a user system. The goal is to enable the data processing system20to reboot for any user U that has previously used the data processing system20in a way that confidential data received from that user U is not visible to other users. Roman numerals Va and Vb inFIG. 5respectively denote alternative boot methods initiated by a user system.

When the first user system10initialises the reboot, it starts here with the encrypted second storage23containing the user image DU1, wherein the user image DU1has been encrypted by the symmetric session key kU1′. The symmetric session key kU1′has been sealed to BL1+U1and the seal can be maintained in the PCR, i.e. platform configuration register, of the operator system30.

With reference to the method denoted by roman numeral Va, a reboot command is initiated at the first user system10and transmitted therefrom in a reboot command step71to the operating system30. In response, the operating system30issues a reboot command in the reboot command step59to the data processing system20. The operating system30also communicates to the data processing system20the symmetric session key kU1′sealed to (BL1+U1). There, the sealed symmetric session key kU1′is unpacked in the unsealing step63by satisfying the configuration of starting the boot loader BL1for the first user system10. The data processing system20performs a user data decryption step66, using the unsealed symmetric session key kU1′, thereby obtaining the decrypted user image DU1.

With reference to the method denoted by roman numeral Vb, when the data processing system20is rebooted, a sealing parameter c is initiated and transmitted to the user system10in a sealing parameter broadcast step73. In response, the user system10executes a third sealing step74in which the sealing parameter c is used to seal symmetric session key kU1′, which is sealed to the configuration (BL1+U1+c). When a reboot command is initiated by the user system10and transmitted to the operating system30in the reboot command step71as hereinbefore described with reference to the method denoted by roman numeral Va, the sealed symmetric session key kU1′is also transmitted to the operating system30. In response, the operating system30issues a reboot command in the reboot command step59to the data processing system20. The operating system30also communicates to the data processing system20the symmetric session key kU1′sealed to (BL1+U1+c). There, the sealed symmetric session key kU1′is opened in the unsealing step63by satisfying the configuration of starting the boot loader BL1for the first user system10. The data processing system20performs a user data decryption step66, using the unsealed symmetric session key kU1′, thereby obtaining the decrypted user image DU1. In this case, the operating system30cannot seal the symmetric session key kU1′to the configuration (BL1+U1+c) even if it has the sealing parameter (c) since it only has the symmetric session key kU1′in a sealed configuration and no means to open that seal.

An embodiment of the present invention may be used for individual data processing systems as described above, or for logical partitions of a data processing system that are secure from other logical partitions running on the same data processing system. Each logical partition uses one of the methods described above, and sequential reuse is of a logical partition.

An embodiment of the present invention may also be generalized to a case where the user accesses a set of data processing systems for the purpose of parallel computation. The set of data processing systems then comprise a set of secure data processing systems. In this case, for accessing user data, a central “customer control” data processing system may be used. Confidential information pertaining to unlocking the set of data processing systems in order to access user data may be stored on the customer control data processing system. From a broader view, the user may unlock his control data processing system while this control data processing system then unlocks the computing data processing systems on behalf of the user.

Another generalization is that of providing a safe suspend operation at a data processing system, where the user's private data is written to disk, and the private data is cleared from memory, all information on the keys are removed from memory, and the data processing system or logical partition can then be serially reused for another user using the same OS. This can be done by storing in a predetermined portion of memory pseudo-random data and then verifying that the data processing system can retrieve this data.

An embodiment of the present invention has been described with reference being made to the operating system loader being implemented as a bootloader BL1. The present invention is, of course, not limited thereto and any other appropriate operating system loader may be selected for this purpose.

An embodiment of the present invention may be implemented in part or as a whole in software or hardware or a combination thereof. It may, implemented in hardware, be performed by an apparatus for protecting data from unauthorized access. It may, implemented in software, be performed by a computer program product. The computer program product may be provided on a computer readable medium embodying software instructions executable by a computer to perform the steps of an embodiment of the method aspect of the present invention. The computer-readable medium may, for example, be a CD-ROM, a DVD, a flash memory card, a hard disk, or any suitable computer-readable medium, e.g. a storage medium within a network.

The present invention has been described above purely by way of example and modifications of detail can be made within the scope of the present invention.