Patent ID: 8627414

Claim:
A computer, comprising: a processor; memory connected to the processor and including computer-readable instructions which, when executed by the processor, cause the processor to create a computing platform having: a select guest having a privilege level and an identity, said select guest to be kept secure from other parts of said computer; a legacy guest having a privilege level, said legacy guest not assumed to be secure; a hypervisor, wherein: the hypervisor supports both the select guest and the legacy guest; the hypervisor has a privilege level that is more privileged than the privilege level of the select guest; the hypervisor has a privilege level that is more privileged than the privilege level of the legacy guest; the hypervisor partitions a unique portion of the memory for the exclusive use of the select guest; the hypervisor partitions a unique portion of memory for the exclusive use of the legacy guest; the hypervisor partitions a unique portion of memory for the exclusive use of the hypervisor; a verification device connected to the processor and including a processor and memory, wherein the memory of the verification device includes computer-readable instructions and wherein the memory of the verification device includes a policy for the select guest; wherein the computer-readable instructions in the memory of the computer, when executed by the processor of the computer, cause the processor of the computer to perform the steps of: receiving a signal indicative of a request to execute the select guest; authenticating a secure connection between the hypervisor and the verification device after receiving the signal indicative of the request to execute the select guest; measuring the identity of at least a portion of the select guest before the select guest executes any instruction; sending a measurement of the identity of the select guest to the verification device; wherein the computer-readable instructions in the memory of the verification device, when executed by the processor in the verification device, cause the processor in the verification device to perform the steps of: receiving the measurement of the select guest from the processor in the computer; comparing the policy stored in the verification device with the measurement of the select guest received by the verification device; wherein the steps of authenticating, measuring, sending, receiving the measurement, and comparing are performed after receiving the signal indicative of the request to execute the select guest and without rebooting the computer.