Automated secure data and firmware migration between removable storage devices that supports boot partitions and replay protected memory blocks

1. A method comprising:

detecting a data migration request;

conducting a first transfer, via a trusted execution environment, of storage context information from a first removable storage device to a secure memory region of a system in response to the data migration request; and

conducting a second transfer, via the trusted execution environment, of the storage context information from the secure memory region to a second removable storage device, wherein the storage context information includes factory data, security data and boot firmware.

2. The method of claim 1 , wherein the storage context information further includes an operating system (OS) image, an OS recovery image and user data, and wherein conducting the second transfer includes:

writing the factory data to a factory partition in the second removable storage device;

writing the security data to a security partition in the second removable storage device;

writing the boot firmware to a boot partition in the second removable storage device; and

writing the OS image, the OS recovery image and the user data to one or more remaining partitions in the second removable storage device.

3. The method of claim 2 , further including creating the factory partition in the second removable storage device.

4. The method of claim 1 , wherein conducting the second transfer includes instructing the trusted execution environment to provision the second removable storage device with a replay protected memory block.

5. The method of claim 1 , further including:

confirming a completion of the first transfer; and

generating a user prompt to connect the second removable storage device to the system in response to the completion of the first transfer.

6. The method of claim 1 , further including:

confirming a completion of the second transfer;

invalidating the storage context information in the secure memory region in response to the completion of the second transfer; and

triggering a cold reboot of the system in response to the completion of the second transfer.

7. At least one non-transitory computer readable storage medium comprising a set of instructions, which when executed by a computing system, cause the computing system to:

detect a data migration request;

conduct a first transfer, via a trusted execution environment, of storage context information from a first removable storage device to a secure memory region of the computing system; and

conduct a second transfer, via the trusted execution environment, of the storage context information from the secure memory region to a second removable storage device, wherein the storage context information is to include factory data, security data and boot firmware.

8. The at least one non-transitory computer readable storage medium of claim 7 , wherein the storage context information is to further include an operating system (OS) image, an OS recovery image and user data, and wherein the instructions, when executed, cause the computing system to:

write the factory data to a factory partition in the second removable storage device;

write the security data to a security partition in the second removable storage device;

write the boot firmware to a boot partition in the second removable storage device; and

write the OS image, the OS recovery image and the user data to one or more remaining partitions in the second removable storage device.

9. The at least one non-transitory computer readable storage medium of claim 8 , wherein the instructions, when executed, cause the computing system to create the factory partition in the second removable storage device.

10. The at least one non-transitory computer readable storage medium of claim 7 , wherein the instructions, when executed, cause the computing system to instruct the trusted execution environment to provision the second removable storage device with a replay protected memory block.

11. The at least one non-transitory computer readable storage medium of claim 7 , wherein the instructions, when executed, cause the computing system to:

confirm a completion of the first transfer; and

generate a user prompt to connect the second removable storage device to the system in response to the completion of the first transfer.

12. The at least one non-transitory computer readable storage medium of claim 7 , wherein the instructions, when executed, cause the computing system to:

confirm a completion of the second transfer;

invalidate the storage context information in the secure memory region in response to the completion of the second transfer; and

trigger a cold reboot of the system in response to the completion of the second transfer.

13. An apparatus comprising:

a mode switch, implemented at least partly in the one or more of configurable logic or fixed functionality logic hardware, to detect a data migration request;

a backup controller, implemented at least partly in the one or more of configurable logic or fixed functionality logic hardware, communicatively coupled to the mode switch, the backup controller to conduct a first transfer, via a trusted execution environment, of storage context information from a first removable storage device to a secure memory region of a system; and

a migration controller, implemented at least partly in the one or more of configurable logic or fixed functionality logic hardware, to conduct a second transfer, via the trusted execution environment, of the storage context information from the secure memory region to a second removable storage device, wherein the storage context information is to include factory data, security data and boot firmware.

14. The apparatus of claim 13 , wherein the storage context information is to further include an operating system (OS) image, an OS recovery image and user data, and wherein the migration controller is to write the factory data to a factory partition in the second removable storage device, write the security data to a security partition in the second removable storage device, write the boot firmware to a boot partition in the second removable storage device, and write the OS image, the OS recovery image and the user data to one or more remaining partitions in the second removable storage device.

15. The apparatus of claim 14 , wherein the migration controller is to create the factory partition in the second removable storage device.

16. The apparatus of claim 13 , wherein the migration controller is to instruct the trusted execution environment to provision the second removable storage device with a replay protected memory block.

17. The apparatus of claim 13 , further including:

a transfer monitor, implemented at least partly in the one or more of configurable logic or fixed functionality logic hardware, to confirm a completion of the first transfer; and

a notification controller, implemented at least partly in the one or more of configurable logic or fixed functionality logic hardware, communicatively coupled to the transfer monitor, the notification component to generate a user prompt to connect the second removable storage device to the system in response to the completion of the first transfer.

18. The apparatus of claim 13 , further including:

a transfer monitor, implemented at least partly in the one or more of configurable logic or fixed functionality logic hardware, to confirm a completion of the second transfer;

an integrity controller, implemented at least partly in the one or more of configurable logic or fixed functionality logic hardware, communicatively coupled to the transfer monitor, the integrity controller to invalidate the storage context information in the secure memory region in response to the completion of the second transfer; and

a reboot controller, implemented at least partly in the one or more of configurable logic or fixed functionality logic hardware, communicatively coupled to the transfer monitor, the reboot controller to trigger a cold reboot of the system in response to the completion of the second transfer.

19. A system comprising:

a system memory device including a secure memory region;

a trusted execution environment; and

a data migration management apparatus communicatively coupled to the trusted execution environment, the data migration management apparatus including:

a mode switch to detect a data migration request,

a backup controller communicatively coupled to the mode switch, the backup controller to conduct a first transfer, via the trusted execution environment, of storage context information from a first removable storage device to the secure memory region, and

a migration controller to conduct a second transfer, via the trusted execution environment, of the storage context information from the secure memory region to a second removable storage device, wherein the storage context information is to include factory data, security data and boot firmware.

20. The system of claim 19 , wherein the storage context information is to further include an operating system (OS) image, an OS recovery image and user data, and wherein the migration controller is to write the factory data to a factory partition in the second removable storage device, write the security data to a security partition in the second removable storage device, write the boot firmware to a boot partition in the second removable storage device, and write the OS image, the OS recovery image and the user data to one or more remaining partitions in the second removable storage device.

21. The system of claim 20 , wherein the migration controller is to create the factory partition in the second removable storage device.

22. The system of claim 19 , wherein the migration controller is to instruct the trusted execution environment to provision the second removable storage device with a replay protected memory block.

23. The system of claim 19 , wherein the data migration management apparatus further includes:

a transfer monitor to confirm a completion of the first transfer; and

a notification controller communicatively coupled to the transfer monitor, the notification component to generate a user prompt to connect the second removable storage device to the system in response to the completion of the first transfer.

24. The system of claim 19 , wherein the data migration management apparatus further includes:

a transfer monitor to confirm a completion of the second transfer;

an integrity controller communicatively coupled to the transfer monitor, the integrity controller to invalidate the storage context information in the secure memory region in response to the completion of the second transfer; and

a reboot controller communicatively coupled to the transfer monitor, the reboot controller to trigger a cold reboot of the system in response to the completion of the second transfer.