Encryption and decryption of data owned by a guest operating system

1. A method, comprising:

executing a host operating system and a guest operating system on one or more processor cores;

providing, by the host operating system, a digital certificate including a public key for the host to the guest operating system;

receiving, by the host operating system, a public key for the guest operating system from the guest operating system;

assigning, by the host operating system, the process identifier to the guest operating system;

establishing a secure channel between the host operating system and the guest operating system using the public key for the host operating system and the public key for the guest operating system;

informing the guest operating system of the process identifier assigned to the guest operating system over the secure channel;

receiving, by the host operating system, an encryption key from the guest operating system over the secure channel for use in encrypting and decrypting data for the guest operating system;

storing the process identifier assigned to the guest operating system in association with the encryption key received from the guest operating system in a trusted key store, wherein the encryption key received from the guest operating system is not accessible to the host operating system;

encrypting data owned by the guest operating system using the encryption key received from the guest operating system and storing the encrypted data on a memory module in response to a write command from the guest operating system, wherein the encrypted data is stored on the memory module in association with the process identifier assigned to the guest operating system; and

decrypting encrypted data owned by the guest operating system using the encryption key received from the guest operating system and providing the decrypted data to the guest operating system in response to a read command from the guest operating system.

2. The method of claim 1 , further comprising:

verifying that the read command is from the guest operating system.

3. The method of claim 2 , wherein verifying that the read command is from the guest operating system, includes determining that the read command includes a process identifier that matches the process identifier stored on the memory module in association with the encrypted data.

4. The method of claim 2 , further comprising:

preventing decryption of a requested portion of the encrypted data stored on the memory module in response to receiving a read request from a process having a process identifier that does not match the process identifier stored in the memory module along with the requested portion of the encrypted data.

5. The method of claim 1 , wherein the process identifier is a plurality of tag bits.

6. The method of claim 5 , further comprising:

the one or more processor cores associating the tag bits of a process with all instructions of the guest operating system and all data owned by the guest operating system.

7. The method of claim 1 , wherein data owned by the guest operating system includes data owned by any application being run on the guest operating system.

8. The method of claim 1 , further comprising;

encrypting data owned by the guest operating system using the encryption key received from the guest operating system and storing the encrypted data on a data register of the one or more processor cores, wherein the encrypted data is stored on the data register in association with the process identifier of the guest operating system; and

decrypting encrypted data stored on the data register and owned by the guest operating system using the encryption key received from the guest operating system and providing the decrypted data to the guest operating system.

9. The method of claim 1 , further comprising:

receiving, by the host operating system, the guest operating system in an encrypted form; and

decrypting the guest operating system using the encryption key received from the guest operating system.

10. A computer program product comprising a non-volatile computer readable storage medium that is not a transitory signal and non-transitory program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:

executing a host operating system and a guest operating system on one or more processor core;

providing, by the host operating system, a digital certificate including a public key for the host to the guest operating system; receiving, by the host operating system, a public key for the guest operating system from the guest operating system;

assigning, by the host operating system, the process identifier to the guest operating system;

establishing a secure channel between the host operating system and the guest operating system using the public key for the host operating system and the public key for the guest operating system; informing the guest operating system of the process identifier assigned to the guest operating system over the secure channel;

receiving, by the host operating system, an encryption key from the guest operating system over the secure channel for use in encrypting and decrypting data for the guest operating system;

storing the process identifier assigned to the guest operating system in association with the encryption key received from the guest operating system in a trusted key store, wherein the encryption key received from the guest operating system is not accessible to the host operating system;

encrypting data owned by the guest operating system using the encryption key received from the guest operating system and store the encrypted data on a memory module in response to a write command from the guest operating system, wherein the encrypted data is stored on the memory module in association with the process identifier of the guest operating system; and

decrypting encrypted data owned by the guest operating system using the encryption key received from the guest operating system and provide the decrypted data to the guest operating system in response to a read command from the guest operating system.

11. The computer program product of claim 10 , the operations further comprising:

verifying that the read command is from the guest operating system.

12. The computer program product of claim 11 , wherein verifying that the read command is from the guest operating system, includes determining that the read command includes a process identifier that matches the process identifier stored on the memory module in association with the encrypted data.

13. The computer program product of claim 11 , the operations further comprising:

preventing decryption of a requested portion of the encrypted data stored on the memory module in response to receiving a read request from a process having a process identifier that does not match the process identifier stored in the memory module along with the requested portion of the encrypted data.

14. The computer program product of claim 10 , wherein the process identifier is a plurality of tag bits.

15. The computer program product of claim 14 , the operations further comprising:

the one or more processor cores associating the tag bits of a process with all instructions of the guest operating system and all data owned by the guest operating system.

16. The computer program product of claim 10 , wherein data owned by the guest operating system includes data owned by any application being run on the guest operating system.

17. The computer program product of claim 10 , the operations further comprising;

encrypting data owned by the guest operating system using the encryption key received from the guest operating system and storing the encrypted data on a data register of the one or more processor cores, wherein the encrypted data is stored on the data register in association with the process identifier of the guest operating system; and

decrypting encrypted data stored on the data register and owned by the guest operating system using the encryption key received from the guest operating system and providing the decrypted data to the guest operating system.

18. The computer program product of claim 10 , the operations further comprising:

receiving, by the host operating system, the guest operating system in an encrypted form; and

decrypting the guest operating system using the encryption key received from the guest operating system.