Encrypted Virtual Machine Secure Boot via TPM Key Sealing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, securely provisioning and booting virtual machines (VMs) in a potentially unsecure environment is challenging due to the need for encrypted VMs with unique keys, especially when trust in datacenter staff is limited, and existing solutions do not adequately address cryptographic hygiene and tampering concerns.
Innovation Solution
A method involving a target machine initiating a boot process, contacting a secure infrastructure for provisioning data, verifying identity, establishing a unique key, and decrypting encrypted provisioning data to ensure secure booting, utilizing components like initialization managers, Key Distribution Services, and Trusted Platform Modules (TPMs) to maintain cryptographic integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted VMs with unique keys are created from encrypted templates, then security and cryptographic hygiene are improved, but the complexity of the provisioning process increases
Solution Approach 1:
The system performs preliminary actions by pre-establishing trusted relationships between the secure infrastructure and target machines before VM provisioning. The secure infrastructure is pre-configured with information about authorized target machines, enabling automated verification and key establishment during the boot process without requiring complex manual security configurations.
Solution Approach 2:
The patent introduces a secure infrastructure as an intermediary between the encrypted templates and target machines. This intermediary manages the provisioning data, verifies identity claims, and handles key distribution, thereby simplifying the overall provisioning process while maintaining high security standards through centralized trust management.
2Reliability
If identity verification and key establishment are performed during boot process, then tampering prevention is improved, but the boot time increases
Solution Approach 1:
Identity verification and key establishment are performed as preliminary actions during the early boot process before the operating system fully loads. By completing these security-critical operations early, the system ensures tampering prevention while minimizing the impact on overall boot time, as subsequent OS operations can proceed in parallel.
Solution Approach 2:
The target machine performs self-verification by presenting its identity claim and establishing its own key with the secure infrastructure during boot. This self-service approach reduces the need for external intervention and allows the security operations to be integrated efficiently into the boot process without significant time penalties.
3Reliability
If provisioning data is encrypted and stored externally, then data integrity is improved, but the access complexity increases
Solution Approach 1:
The secure infrastructure acts as an intermediary that manages encrypted provisioning data storage and retrieval. It handles the complexity of encryption, decryption, and secure data transmission, allowing target machines to access their provisioning data through simplified authentication mechanisms while maintaining high data integrity through external encrypted storage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Booting a machine in a secure fashion in a potentially unsecure environment. The method includes a target machine beginning a boot process. The method further includes the target machine determining that it needs provisioning data to continue booting. The target machine contacts a secure infrastructure to obtain the provisioning data. The target machine provides an identity claim that can be verified by the secure infrastructure. As a result of the secure infrastructure verifying the identity claim, the target machine receives a request from the secure infrastructure to establish a key sealed to the target machine. The target machine provides the established key to the secure infrastructure. The target machine receives the provisioning data from the secure infrastructure. The provisioning data is encrypted to the established key. The target machine decrypts the encrypted provisioning data, and uses the provisioning data to finish booting.