Hardware-based root of trust for cloud environments

摘要

Apparatuses, computer readable media, methods, and systems are described for generating and communicating a create measured virtual machine (VM) request, the request comprising a network address of a boot server, initiating establishment of a secure tunnel with a measured VM, receiving a quote from the measured VM, and determining, by a processor, whether the measured VM is authentic based on the quote.

主权项

1. An apparatus comprising:
at least one processor; and at least one memory storing computer executable instructions that, when executed by the at least one processor, cause the apparatus at least to:
initiate creation of a measured virtual machine (VM) associated with a virtualization platform provided by a cloud provider;initiate establishment of a secure tunnel for communication with the measured VM;receive a quote generated by a trusted protection module (TPM) included in physical infrastructure associated with the virtualization platform, the quote being generated based on a measurement of the measured VM, wherein the quote is uniquely tied to hardware included in the physical infrastructure, and the cloud provider creates an association between the TPM and the quote for confirming authenticity of the physical infrastructure associated with the virtualization platform; anddetermine whether the measured VM is authentic based on the quote and the association between the TPM and the quote created by the cloud provider.