Secure server on a system with virtual machines

1. A computer-implemented method for providing secure computing environment on a computer processor, comprising:

initializing a hypervisor on the computer processor;

establishing a first virtual machine under control of the hypervisor; and

executing code for a secure zone on the first virtual machine, including:

verifying an administrative task;

executing the administrative task, wherein the executing comprises:

establishing a connection with an administrator device;

requesting an attestation certificate from the administrator device;

verifying that the attestation certificate is issued by a trusted attestation service provider;

receiving a command through the connection with the administrator device;

in response to the command, executing on a second virtual machine a task that calls a subtask, wherein the second virtual machine is established under control of the hypervisor; and suspending execution of the task according to one or more time slices apportioned to the first virtual machine by the hypervisor while the subtask is executed by the second virtual machine;

establishing a connection to a client device;

verifying that the client device is allowed to establish a connection to the task executing on the second virtual machine; and

passing the established connection to the client device to the task executing on the second virtual machine.

2. The computer-implemented method of claim 1 , wherein executing the administrative task further comprises verifying that the administrator device contains a private key that corresponds to a public key of a set of public keys.

3. The computer-implemented method of claim 2 , wherein the set of public keys are stored within data of the first virtual machine.

4. The computer-implemented method of claim 1 , wherein executing the administrative task further comprises ensuring that a client administrative task running on the administrator device is one of a set of valid client administrative tasks.

5. The computer-implemented method of claim 4 , wherein ensuring the client administrative task running on the administrator device is one of a set of valid client administrative tasks comprises:

receiving a hash value of the client administrative task running on the administrator device; and

checking the received hash value against a list of hash values of valid client administrative tasks.

6. The computer-implemented method of claim 1 , wherein the computer processor is coupled to a non-volatile storage exclusively accessible by the secure zone, and wherein verifying the administrative task comprises calculating a checksum of the administrative task and verifying the calculated checksum using information from the non-volatile storage.

7. The computer-implemented method of claim 6 , wherein the checksum is a secure hash.

8. The computer-implemented method of claim 1 , wherein the computer processor is coupled to a non-volatile storage exclusively accessible by the secure zone, and wherein executing the administrative task further comprises generating and permanently saving information about a system configuration in the non-volatile storage and using the information on system start.

9. The computer-implemented method of claim 1 , wherein verifying the administrative task further comprises:

verifying that the administrative task is signed by a signature as an administrator task; and

verifying the signature of the administrative task.

10. An apparatus for providing a secure computing environment, comprising:

a communication port; and

a computer processor coupled to the communication port and configured to:

initialize a hypervisor;

establish a first virtual machine under control of the hypervisor; and

execute code for a secure zone on the first virtual machine, including:

verify an administrative task;

execute the administrative task, wherein to execute the

administrative task the computer processor is further configured to:

establish a connection with an administrator device;

request an attestation certificate from the administrator device;

verify that the attestation certificate is issued by a trusted attestation service provider;

receive a command through the connection with the administrator device;

in response to the command, execute on a second virtual machine a task that calls a subtask, wherein the second virtual machine is established under control of the hypervisor; and

suspend execution of the task according to one or more time slices apportioned to the first virtual machine by the hypervisor while the subtask is executed by the second virtual machine;

establish a connection to a client device;

verify that the client device is allowed to establish a connection to the task executed on the second virtual machine; and

pass the established connection to the client device to the task executed on the second virtual machine.

11. The apparatus of claim 10 , wherein to execute the administrative task the computer processor is further configured to verify that the administrator device contains a private key that corresponds to a public key of a set of public keys.

12. The apparatus of claim 11 , wherein the set of public keys are stored within data of the first virtual machine.

13. The apparatus of claim 10 , wherein to execute the administrative task the computer processor is further configured to ensure that a client administrative task running on the administrator device is one of a set of valid client administrative tasks.

14. The apparatus of claim 13 , wherein to ensure that the client administrative task running on the administrator device is one of a set of valid client administrative tasks, the computer processor is further configured to:

receive a hash value of the client administrative task running on the administrator device; and

check the received hash value against a list of hash values of valid client administrative tasks.

15. The apparatus of claim 10 , wherein the apparatus further comprises a non-volatile storage exclusively accessible by the secure zone, and to verify the administrative task the computer processor is further configured to calculate a checksum of the administrative task and to verify the calculated checksum using information from the non-volatile storage.

16. The apparatus of claim 15 , wherein the checksum is a secure hash.

17. The apparatus of claim 1 , wherein the apparatus further comprises a non-volatile storage exclusively accessible by the secure zone, and to execute the administrative task the computer processor is further configured to generate and permanently save information about a system configuration in the non-volatile storage and use the information on system start.

18. The apparatus of claim 10 , wherein to verify the administrative task the computer processor is further configured to:

verify that the administrative task is signed by a signature as an administrator task; and

verify the signature of the administrative task.

19. A system for providing a secure computing environment, comprising:

an administrator device comprising a secure zone configured to execute a client administrative task;

an apparatus, comprising:

a communication port; and

a computer processor coupled to the communication port and configured to:

initialize a hypervisor;

establish a first virtual machine under control of the hypervisor; and

execute code for a secure zone on the first virtual machine, including:

verify an administrative task,

execute the administrative task, wherein to execute the administrative task the computer processor is further configured to:

 establish a connection with the administrator device;

 request an attestation certificate from the administrator device;

 verify that the attestation certificate is issued by a trusted attestation service provider;

 receive a command through the connection with the administrator device;

 in response to the command, execute on a second virtual machine a task that calls a subtask, wherein the second virtual machine is established under control of the hypervisor; and

 suspend execution of the task according to one or more time slices apportioned to the first virtual machine by the hypervisor while the subtask is executed by the second virtual machine;

establish a connection to a client device;

verify that the client device is allowed to establish a connection to the task executed on the second virtual machine; and

pass the established connection to the client device to the task executed on the second virtual machine;

wherein to execute the client administrative task, the secure zone of the administrator device is further configured to:

establish the connection with the apparatus; and

send the command through the connection with the apparatus.

20. The system of claim 19 , wherein to execute the administrative task the computer processor is further configured to verify that the administrator device contains a private key that corresponds to a public key of a set of public keys.

21. The system of claim 20 , wherein the set of public keys are stored within data of the first virtual machine.

22. The system of claim 19 , wherein to execute the administrative task the computer processor is further configured to ensure that the client administrative task executed on the administrator device is one of a set of valid client administrative tasks.

23. The system of claim 22 , wherein to ensure that the client administrative task executed on the administrator device is a one of set of valid client administrative tasks, the administrator device is configured to report a hash value of the administrative task executed on the administrator device and the computer processor is further configured to:

receive the hash value of the client administrative task executed on the administrator device; and

check the received hash value against a list of hash values of valid client administrative tasks.

24. The system of claim 19 , wherein the apparatus further comprises a non-volatile storage exclusively accessible by the secure zone on the first virtual machine, and to verify the administrative task the computer processor is further configured to calculate a checksum of the administrative task and to verify the calculated checksum using information from the non-volatile storage.

25. The system of claim 24 , wherein the checksum is a secure hash.

26. The system of claim 19 , wherein the apparatus further comprises a non-volatile storage exclusively accessible by the secure zone on the first virtual machine, and to execute the administrative task the computer processor is further configured to generate and permanently save information about an apparatus configuration in the non-volatile storage and use the information on apparatus start.

27. The system of claim 19 , wherein to verify the administrative task the computer processor is further configured to:

verify that the administrative task is signed by a signature as an administrator task; and

verify the signature of the administrative task.