Patent ID: 8839450

Claim:
A method comprising: controlling, by an operating system running on a suitably programmed computer, operation of a kernel or application component in a first virtual execution environment; registering the component at an integrity services module in a management module; authenticating and verifying the integrity of the component, performed by an integrity measurement module running in a second virtual execution environment; partitioning off a portion of the component to control access by the operating system to the portion of the component; allowing the component to request lock or unlock service of the portion of the component, wherein said allowing the component to request lock service of the portion of the component comprises: passing a data blob to the management module wherein the data blob is to be locked in the portion of the component; deriving a unique key for the portion of the component, wherein the unique key is derived from a key of the management module; encrypting the data blob; storing the encrypted data blob in the portion of the component; and creating a token to be used by the component to gain access to the encrypted data blob, wherein the token to include a reference to a manifest for verification when unlocking the portion of the component.