Patent ID: 8477946

Claim:
A digital data processing system, comprising: a memory having a plurality of addressable locations for storing data; at least one processor, each said at least one processor for executing instructions stored at addressable locations in said memory; a logical partitioning facility which enforces logical partitioning of said computer system into a plurality of logical partitions, each logical partition for executing a respective set of tasks on behalf of respective one or more users on a respective at least one of said at least one processor, wherein tasks executing in each said logical partition generate effective addresses exclusively within a respective partition address space, said effective addresses being mapped to corresponding real addresses in said memory by said logical partitioning facility, wherein a first non-empty subset of real addresses in said memory are real addresses to which no effective address in any said partition address space correspond, said logical partitioning facility maintaining a respective encryption key for each of a plurality of said logical partitions at a respective real address in said first non-empty subset of real addresses in said memory, each said encryption key being inaccessible to tasks executing in the respective logical partition; and a data transformation facility shared by multiple said logical partitions which performs data transformations on behalf of at least some said tasks executing in respective said logical partitions, each data transformation on behalf of a respective task being performed by accessing a respective encryption key for the partition in which the respective task is executing and using the encryption key to perform the data transformation, said data transformation facility performing each data transformation on respective untransformed input data stored in said memory at a respective first addressable location accessible to the respective task to produce respective transformed output data, said transformed output data being stored in said memory at a respective second addressable location accessible to the respective task, without providing said respective encryption key to the respective task.