Confidential VM Root Disk Attestation During On-the-Fly Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing environments lack the tools to securely transform regular virtual machine (VM) images into confidential VM images that can be deployed within a trusted execution environment (TEE) without compromising cryptographic assurance, as they are constrained by the cloud provider's deployment processes and lack efficient methods to verify the integrity and provenance of plain text disk images.
Innovation Solution
A method is introduced to create and manage confidential virtual machine images by encrypting plain text disk images using an image encryption service (IES) within a confidential environment, ensuring integrity through cryptographic signatures and attestation, and deploying them within a trusted execution environment (TEE) to maintain data confidentiality and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud computing environments use centralized repositories for disk images, then availability and security are improved, but cryptographic assurance is compromised due to constraints by cloud provider's deployment processes
Solution Approach 1:
The patent introduces an Image Encryption Service (IES) as an intermediary component that operates within the cloud provider's environment but maintains cryptographic independence. The IES acts as a mediator between the cloud provider's deployment processes and the confidential VM requirements, enabling encrypted disk image storage while preserving cryptographic assurance through proper key management and encryption protocols.
2Reliability
If cloud computing environments provide centralized repositories for disk images, then availability is improved, but integrity verification of plain text disk images becomes difficult
Solution Approach 1:
The patent implements preliminary integrity verification by having the IES verify the integrity of plain text disk images before encryption and storage in the centralized repository. This preliminary action ensures that only intact, unmodified disk images are stored, and the verification process is built into the deployment workflow, making it automatic and difficult to bypass.
3Reliability
If cloud computing environments use centralized repositories for disk images, then security is improved, but transformation of regular VM images into confidential VM images becomes complex
Solution Approach 1:
The patent merges the image encryption and verification operations into a unified IES component that handles both tasks. By combining these functions into a single service that operates within the cloud provider's environment, the patent simplifies the transformation process from regular to confidential VM images while maintaining the security benefits of centralized repositories.
Data Source
AI summary
A method is described including signing a concatenation of an image signature, a public key associated with the image signature, and a full disk encryption (FDE) header to obtain an image encryption service (IES) signature. The method also includes writing the IES signature to an extensible firmware interface system partition (ESP) of an encrypted confidential virtual machine (CVM) disk image.