Enforcing locational restrictions on stateless transactions

1. A method comprising:

creating new data of an Attestation Identity Key pair (AIK pair) from data of a hardware identifier of a hardware machine and data of a geographical location, the new data comprising a private AIK and a public AIK;

changing a state of a data storage device associated with a repository by storing the public AIK and the geographical location in the repository;

matching the public AIK with a key used to sign a data request;

executing a geographical restriction policy corresponding to the geographical location associated with the public AIK;

instructing, responsive to the geographical restriction policy determining that a type of the data request corresponds to an authorized request type from the geographical location, a service to process the data request.

2. The method of claim 1 , further comprising:

failing to match any public AIK in the repository with a second key used to sign a second data request;

executing a second geographical restriction policy corresponding to requests lacking location information;

instructing, responsive to the second geographical restriction policy determining that a type of the second data request corresponds to a request type that is authorized without the location information, the service to process the second data request.

3. The method of claim 1 , further comprising:

failing to match any public AIK in the repository with a second key used to sign a third data request;

executing a third geographical restriction policy corresponding to requests lacking location information;

instructing, responsive to the third geographical restriction policy determining that a type of the third data request does not correspond to any request type that are authorized without the location information, the service to deny the third data request.

4. The method of claim 1 , further comprising:

matching a fourth public AIK in the repository with a fourth key used to sign a fourth data request;

executing a fourth geographical restriction policy corresponding to a fourth geographical location associated with the fourth public AIK;

instructing, responsive to the fourth geographical restriction policy determining that a type of the fourth data request does not correspond to any request type that are authorized from the fourth geographical location, the service to deny the fourth data request.

5. The method of claim 1 , further comprising:

modifying an original keypair generation service, forming a modified keypair generation service, to generate the new data of the AIK pair, wherein the original keypair service only creates a pair comprising a public key and a private key, and wherein the modified keypair generation service further forms an association between the geographical location and the public key to form the public AIK.

6. The method of claim 5 , wherein the geographical location is encoded in the public AIK.

7. The method of claim 1 , further comprising:

configuring the hardware machine with the hardware identifier at a time of manufacturing the hardware machine, the hardware identifier being immutable; and

associating a location of provisioning the hardware machine with the hardware identifier as the geographical location.

8. The method of claim 7 , further comprising:

configuring the hardware machine with a Trusted Platform Module (TPM), wherein the hardware identifier is an endorsement key of the TPM.

9. The method of claim 1 , further comprising:

signing, using the private AIK, the data request, wherein the data request originates in the hardware machine.

10. The method of claim 1 , further comprising:

encrypting, using the private AIK, the data request, wherein the data request originates in the hardware machine.

11. A computer usable program product comprising a computer-readable storage device, and program instructions stored on the storage device, the stored program instructions comprising:

program instructions to create new data of an Attestation Identity Key pair (AIK pair) from data of a hardware identifier of a hardware machine and data of a geographical location, the new data comprising a private AIK and a public AIK;

program instructions to change a state of a data storage device associated with a repository by storing the public AIK and the geographical location in the repository;

program instructions to match the public AIK with a key used to sign a data request;

program instructions to execute a geographical restriction policy corresponding to the geographical location associated with the public AIK;

program instructions to instruct, responsive to the geographical restriction policy determining that a type of the data request corresponds to an authorized request type from the geographical location, a service to process the data request.

12. The computer usable program product of claim 11 , further comprising:

program instructions to fail to match any public AIK in the repository with a second key used to sign a second data request;

program instructions to execute a second geographical restriction policy corresponding to requests lacking location information;

program instructions to instruct, responsive to the second geographical restriction policy determining that a type of the second data request corresponds to a request type that is authorized without the location information, the service to process the second data request.

13. The computer usable program product of claim 11 , further comprising:

program instructions to fail to match any public AIK in the repository with a second key used to sign a third data request;

program instructions to execute a third geographical restriction policy corresponding to requests lacking location information;

program instructions to instruct, responsive to the third geographical restriction policy determining that a type of the third data request does not correspond to any request type that are authorized without the location information, the service to deny the third data request.

14. The computer usable program product of claim 11 , further comprising:

program instructions to match a fourth public AIK in the repository with a fourth key used to sign a fourth data request;

program instructions to execute a fourth geographical restriction policy corresponding to a fourth geographical location associated with the fourth public AIK;

program instructions to instruct, responsive to the fourth geographical restriction policy determining that a type of the fourth data request does not correspond to any request type that are authorized from the fourth geographical location, the service to deny the fourth data request.

15. The computer usable program product of claim 11 , further comprising:

program instructions to modify an original keypair generation service, forming a modified keypair generation service, to generate the new data of the AIK pair, wherein the original keypair service only creates a pair comprising a public key and a private key, and wherein the modified keypair generation service further forms an association between the geographical location and the public key to form the public AIK.

16. The computer usable program product of claim 15 , wherein the geographical location is encoded in the public AIK.

17. The computer usable program product of claim 11 , further comprising:

program instructions to configure the hardware machine with the hardware identifier at a time of manufacturing the hardware machine, the hardware identifier being immutable; and

program instructions to associate a location of provisioning the hardware machine with the hardware identifier as the geographical location.

18. The computer usable program product of claim 11 , wherein the computer usable code is stored in a computer readable storage device in a data processing system, and wherein the computer usable code is transferred over a network from a remote data processing system.

19. The computer usable program product of claim 11 , wherein the computer usable code is stored in a computer readable storage device in a server data processing system, and wherein the computer usable code is downloaded over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system.

20. A computer system comprising a processor, a computer-readable memory, and a computer-readable storage device, and program instructions stored on the storage device for execution by the processor via the memory, the stored program instructions comprising:

program instructions to create new data of an Attestation Identity Key pair (AIK pair) from data of a hardware identifier of a hardware machine and data of a geographical location, the new data comprising a private AIK and a public AIK;

program instructions to change a state of a data storage device associated with a repository by storing the public AIK and the geographical location in the repository;

program instructions to match the public AIK with a key used to sign a data request;

program instructions to execute a geographical restriction policy corresponding to the geographical location associated with the public AIK;

program instructions to instruct, responsive to the geographical restriction policy determining that a type of the data request corresponds to an authorized request type from the geographical location, a service to process the data request.