Method and apparatus for migrating software-based security coprocessors
A first processing system determines whether a second processing system provides a trustworthy state for supporting a virtual security coprocessor. In response to determining that the second processing system provides a trustworthy state for supporting the virtual security coprocessor, the first processing system transfers the virtual security coprocessor to the second processing system. In one embodiment, the first processing system receives a key and proof of bindings of the key from the second processing system. The first processing system may determine whether the second processing system provides a trustworthy state for migration of the virtual security coprocessor, based at least in part on the proof of bindings received from the second processing system. After the second processing system receives the virtual security coprocessor, the virtual security coprocessor may be removed from the first processing system. Other embodiments are described and claimed.
1. A method comprising:
receiving, at a first processing system, a key and proof of bindings of the key from a second processing system;
determining, at the first processing system, whether the second processing system provides a trustworthy state for supporting a virtual security coprocessor, based at least in part on the proof of bindings received from the second processing system; and
in response to determining that the second processing system provides a trustworthy state for supporting the virtual security coprocessor, transferring the virtual security coprocessor from the first processing system to the second processing system.
2. A method according to claim 1 , further comprising:
removing the virtual security coprocessor from the first processing system.
3. A method comprising:
transmitting, from a first processing system to a second processing system, proof that the first processing system provides a trustworthy state for supporting a virtual security coprocessor, including transmitting a key and proof of bindings of the key from the first processing system to the second processing system; and
after transmitting the proof to the second processing system, receiving the virtual security coprocessor at the first processing system from the second processing system.
4. A method according to claim 3 , further comprising:
using the virtual security coprocessor received from the second processing system to provide attestation for the first processing system.
5. A method according to claim 3 , further comprising:
using the virtual security coprocessor received from the second processing system to encrypt data for the first processing system.
6. An apparatus comprising:
a storage medium; and
instructions stored in the storage medium, wherein the instructions, when executed by a first processing system, cause the first processing system to perform operations comprising:
receiving a key and proof of bindings of the key from a second processing system; determining whether the second processing system provides a trustworthy state for supporting a virtual security coprocessor, based at least in part on the proof of bindings received from the second processing system; and
in response to determining that the second processing system provides a trustworthy state for supporting the virtual security coprocessor, transferring the virtual security coprocessor from the first processing system to the second processing system.
7. An apparatus according to claim 6 , wherein the instructions cause the first processing system to perform operations comprising:
removing the virtual security coprocessor from the first processing system.
8. An apparatus comprising:
a storage medium; and
instructions stored in the storage medium, wherein the instructions, when executed by a first processing system, cause the first processing system to perform operations comprising:
transmitting, to a second processing system, proof that the first processing system provides a trustworthy state for supporting a virtual security coprocessor, including transmitting a key and proof of bindings of the key; and
after transmitting the proof to the second processing system, receiving the virtual security coprocessor at the first processing system from the second processing system.
9. An apparatus according to claim 8 , wherein the instructions cause the first processing system to perform operations comprising:
using the virtual security coprocessor received from the second processing system to provide attestation for the first processing system.
10. An apparatus according to claim 8 , wherein the instructions cause the first processing system to perform operations comprising:
using the virtual security coprocessor received from the second processing system to encrypt data for the first processing system.
11. A processing system comprising:
a processor;
a storage medium communicatively coupled to the processor; and
instructions stored in the storage medium, wherein the instructions, when executed by a first processing system, cause the first processing system to perform operations comprising:
receiving a key and proof of bindings of the key from a second processing system; determining whether the second processing system provides a trustworthy state for supporting a virtual security coprocessor, based at least in part on the proof of bindings received from the second processing system; and
in response to determining that the second processing system provides a trustworthy state for supporting the virtual security coprocessor, transferring the virtual security coprocessor from the first processing system to the second processing system.
12. A processing system according to claim 11 , wherein the instructions perform further operations comprising:
removing the virtual security coprocessor from the first processing system.
13. A processing system comprising:
a processor;
a storage medium communicatively coupled to the processor; and
instructions stored in the storage medium, wherein the instructions, when executed by a first processing system, cause the first processing system to perform operations comprising:
transmitting, to a second processing system, proof that the first processing system provides a trustworthy state for supporting a virtual security coprocessor, including transmitting a key and proof of bindings of the key to the second processing system; and
after transmitting the proof to the second processing system, receiving the virtual security coprocessor at the first processing system from the second processing system.
14. A processing system according to claim 13 , wherein the processing system is to perform at least one operation from the group of operations consisting of:
using the virtual security coprocessor received from the second processing system to provide attestation for the processing system; and
using the virtual security coprocessor received from the second processing system to encrypt data for the processing system.
15. A processing system according to claim 13 , wherein:
the processing system further comprises a physical trusted platform module (TPM) communicatively coupled to the processor; and
the processing system uses the physical TPM to support the virtual security coprocessor.