Trusted platform module (TPM) assisted data center management

摘要

Techniques for trusted platform module (TPM) assisted data center management are provided. A data center registers TPM remote attestations for physical processing environments of physical devices within a data center. Each time a physical processing environment is established; a new TPM remote attestation is generated and validated against the registered TPM remote attestation. Additionally, during registration other identifying information is supplied to the physical processing environments that permit each physical processing environment to be authenticated, validated, and controlled via unique identities. Inter-data center communication is established for sharing virtual processing environments and administrative operations are authenticated within each of the data centers perform any administrative operation is permitted to process within a particular data center.

主权项

1. A machine-implemented method implemented as instructions within a non-transitory computer-readable medium for a trusted platform module (TPM) enabled orchestration service that when executed performs the method, comprising:
initiating a physical processing environment configured for hosting virtual processing environments associated with virtual machines on a physical device and encrypting the virtual processing environments with keys that just the physical processing environment has and can process for decrypting the virtual processing environments, permitting the virtual processing environments to be pinned to a physical machine having the physical processing environment once delivered to the physical processing environment; receiving front the physical device a TPM remote attestation for a configuration of the physical processing environment on the physical device, the TPM remote attestation is a signed hash of software resources and the configuration for the physical processing environment including a hash of the Basic Input/Output System (BIOS) of the physical machine and the Operating System (OS) of the physical processing environment, the TPM remote attestation signed with a private key of a TPM protected area, the TPM remote attestation processed as an authentication credential for validating the physical processing environment each time the physical device communicates with the TPM enabled orchestration service, wherein the TPM remote attestation is initially registered with the TPM enabled orchestration service, and wherein the physical device includes a generic platform module (GPM) equipped within firmware of the physical device that provides the TPM protected area, the GPM including an unchanging serial number to uniquely identify the GPM and a sealed storage area that releases the private key for use within the TPM protected area upon providing a secret paraphrase, the TPM protected area is a less capable instantiation of the GPM, and the private key is stored within and never provided outside a context of the sealed storage area and TPM protected area, the GPM providing cryptographic functions that operate within the TPM protected area to gain access to the private key from the sealed storage via presentation the secret paraphrase, and wherein the physical processing environment validates underlying hardware of the physical processing environment each time the physical processing environment initiates on that underlying hardware by checking a previously used subnet of the physical processing environment against a current subnet that is used each time the physical processing environment initiates; and supplying identifying information back to the physical device and the physical processing environment in response to the TPM remote attestation, wherein the physical device and the physical processing environment subsequently use the identifying information to authenticate to and securely interact with a data center.