Patent ID: 8549288

Claim:
A computer-implemented method performed by a data processing system for dynamic creation and hierarchical organization of trusted platform modules, the method comprising: the data processing system creating a trusted platform module domain, wherein a privileged trusted platform module of the trusted platform module domain is operable to dynamically create one or more virtual trusted platform modules in the trusted platform module domain, wherein a trusted platform module is a piece of hardware that provides security and cryptographic functionality to the data processing system, wherein the trusted platform module domain is associated with a given partition of the data processing system having multiple partitions, wherein the given partition of the multiple partitions has a given instance of an operating system running within the given partition, wherein the one or more virtual trusted platform modules are each a software-instantiation of the trusted platform module that provides security and cryptographic functionality for the trusted platform module domain, and wherein the privileged trusted platform module certifies at the privileged trusted platform module a public key part of an endorsement key of a virtual trusted platform module by signing over at the privileged trusted platform module the endorsement key of the virtual trusted platform module using the privileged trusted platform module's own endorsement key, attestation identity key or a general signing key; creating the one or more virtual trusted platform modules in the trusted platform module domain by the privileged trusted platform module; sending an array of PCR register indices and hash values of the virtual trusted platform module to a creating trusted platform module, which may either be a virtual trusted platform module or a trusted platform module; and storing string identifiers and the array of PCR register indices and hash values in the virtual trusted platform module to form stored information, wherein the stored information is made available to an operating system associated with the virtual trusted platform module, and wherein each hash value of the hash values is used to extend the PCR registers that are referenced through the indices.