Patent ID: 7269702

Claim:
A trusted data store for use with a trusted element of a trusted operating system on a computing machine, the trusted data store comprising: a storage medium for storing data in a pre-determined arrangement, the data including trusted data from the trusted element of the trusted operating system on the computing machine, and also including other data from other elements of a non-trusted operating system of the computing machine; an access controller by which data including the trusted data and the other data is written to the storage medium and by which data including the trusted data and the other data is read from the storage medium; and a trust controller interposed between the trusted element and the access controller, the trust controller for allowing only the trusted element to perform operations on the trusted data thereof on the storage medium and for prohibiting other elements of the non-trusted operating system from performing operations on the trusted data of the trusted element on the storage medium, the trust controller for receiving a command with respect to the trusted data of the trusted element from the computing machine and for forwarding the command to the access controller only if the command is from the trusted element and not from any other element, whereby the trust controller ensures that only the trusted element may access the trusted data thereof as stored at the storage medium, wherein the trust controller allows the trusted element to perform operations on the trusted data thereof on the storage medium if the trusted element authenticates itself to the trust controller, wherein the trust controller receives from the trusted element as authentication a digital signature, and wherein the trust controller authenticates the trusted element by verifying the received signature based on a verification token from the trusted element, the trusted data store for use with a plurality of trusted elements, wherein the storage medium is divided into a number of logical units, and the access controller receives and responds to commands on a logical unit by logical unit basis, wherein the trust controller for each trusted element seizes logical units of the storage medium on behalf of and for exclusive use by the trusted element and not for use by any other trusted element, and wherein the trusted data store includes an ownership list that specifies for each logical unit of the storage medium at most a single trusted element that has seized such logical unit.