Seamless data migration

1. A method capable of migrating data, comprising:

sealing, using a computer including a processor, contents of a data store to one or more registers, wherein the contents are encrypted;

in response to determining that secure backup is enabled, storing the platform metrics from the one more registers in a private store;

receiving an out-of-band request for the contents of the data store; and

responding to the out-of-band request by:

in response to the out-of-band request being an out-of-band restore request to replace the contents of the data store with new, encrypted contents that have been received from a remote agent,

sealing the new, encrypted contents using the stored platform metrics; and

storing the new, encrypted contents.

2. The method of claim 1 , wherein sealing the contents further comprises:

generating a sealed message by selecting a range of register values and using a key to asymmetrically encrypt both the register values and the contents; and

associating the sealed message with the platform metrics.

3. The method of claim 1 , wherein the out-of-band request is an out-of-band update request to update the contents of the data store with new contents that have been received from the remote agent and further comprising:

decrypting a portion of the contents;

updating the decrypted contents; and

re-encrypting the updated contents.

4. The method of claim 1 , wherein the out-of-band request is an out-of-band remote backup request from the remote agent for a copy of the contents for storing a backup copy and further comprising:

determining whether a platform configuration state matches the platform metrics associated with the sealed contents;

in response determining that the platform configuration state matches the platform metrics associated with the sealed contents, unsealing the contents using the stored platform metrics; and

returning the unsealed contents in response to the out-of-band remote backup request.

5. The method of claim 1 , further comprising:

determining whether this is an authenticated boot; and

in response to determining that this is an authenticated boot,

measuring BIOS components and firmware to generate a hash value; and

storing the hash value in at least one of the one or more registers.

6. A system for migrating data, comprising:

a data store storing contents;

one or more registers;

a private store;

a motherboard; and

an out-of-band management agent;

wherein the out of band management agent is operable to:

seal the contents of the data store to the one or more registers, wherein the contents are encrypted;

in response to determining that secure backup is enabled, store the platform metrics from the one more registers in the private store;

receive an out-of-band request for the contents of the data store; and

respond to the out-of-band request by:

in response to the out-of-band request being an out-of-band restore request to replace the contents of the data store with new, encrypted contents that have been received from a remote agent,

sealing the new, encrypted contents using the stored platform metrics; and

storing the new, encrypted contents.

7. The system of claim 6 , wherein to seal the contents, the out of band management agent is operable to:

generate a sealed message by selecting a range of register values and using a key to asymmetrically encrypt both the register values and the contents; and

associate the sealed message with the platform metrics.

8. The system of claim 6 , wherein the out-of-band request is an out-of-band update request to update the contents of the data store with new contents that have been received from the remote agent and wherein the out of band management agent is operable to:

decrypt a portion of the contents;

update the decrypted contents; and

re-encrypt the updated contents.

9. The system of claim 6 , wherein the out-of-band request is an out-of-band remote backup request from the remote agent for a copy of the contents for storing a backup copy and wherein the out of band management agent is operable to:

determine whether a platform configuration state matches the platform metrics associated with the sealed contents;

in response determining that the platform configuration state matches the platform metrics associated with the sealed contents, unseal the contents using the stored platform metrics; and

return the unsealed contents in response to the out-of-band remote backup request.

10. The system of claim 6 , wherein the out of band management agent is operable to:

determine whether this is an authenticated boot; and

in response to determining that this is an authenticated boot,

measure BIOS components and firmware to generate a hash value; and

store the hash value in at least one of the one or more registers.

11. An article of manufacture for migrating data, wherein the article of manufacture comprises a computer readable medium storing instructions, and wherein the article of manufacture is operable to:

seal contents of a data store to one or more registers wherein the contents are encrypted;

in response to determining that secure backup is enabled, store the platform metrics from the one more registers in a private store;

receive an out-of-band request for the contents of the data store;

respond to the out-of-band request by:

in response to the out-of-band request being an out-of-band restore request to replace the contents of the data store with new, encrypted contents that have been received from a remote agent,

sealing the new, encrypted contents using the stored platform metrics; and

storing the new, encrypted contents.

12. The article of manufacture of claim 11 , wherein to seal the contents, wherein the article of manufacture is operable to:

generate a sealed message by selecting a range of register values and using a key to asymmetrically encrypt both the register values and the contents; and

associate the sealed message with the platform metrics.

13. The article of manufacture of claim 11 , wherein the out-of-band request is an out-of-band update request to update the contents of the data store with new contents that have been received from the remote agent and wherein the article of manufacture is operable to:

decrypt a portion of the contents;

update the decrypted contents; and

re-encrypt the updated contents.

14. The article of manufacture of claim 11 , wherein the out-of-band request is an out-of-band remote backup request from the remote agent for a copy of the contents for storing a backup copy and wherein the article of manufacture is operable to:

determine whether a platform configuration state matches the platform metrics associated with the sealed contents;

in response determining that the platform configuration state matches the platform metrics associated with the sealed contents, unseal the contents using the stored platform metrics; and

return the unsealed contents in response to the out-of-band remote backup request.

15. The article of manufacture of claim 11 , wherein the article of manufacture is operable to:

determine whether this is an authenticated boot; and

in response to determining that this is an authenticated boot,

measure BIOS components and firmware to generate a hash value; and

store the hash value in at least one of the one or more registers.

16. A system for migrating data, comprising:

a data store storing contents;

a root of trust agent including one or more registers;

an out-of-band management agent coupled to the root of trust agent; and

a private store coupled to the out-of-band management agent;

wherein the out of band management agent is operable to:

seal the contents of the data store to the one or more registers, wherein the contents are encrypted by the root of trust agent;

in response to determining that secure backup is enabled, store the platform metrics from the one more registers in the private store;

receive an out-of-band request for the contents of the data store;

respond to the out-of-band request by:

in response to the out-of-band request being an out-of-band restore request to replace the contents of the data store with new, encrypted contents that have been received from a remote agent,

sealing the new, encrypted contents using the stored platform metrics; and

storing the new, encrypted contents.