VM Identity Establishment via Pre-Injected Cryptographic Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for establishing a provable identity for virtual machines (VMs) in server farms are time-consuming, which is problematic in dynamic environments like the Microsoft Azure cloud computing platform where VMs have short lifespans and are frequently recreated, leading to significant time occupation during the identity establishment process.
Innovation Solution
A method and system that utilize a controller, such as the Azure Fabric Controller, to inject cryptographic data into VM images, allowing the security token service to generate and verify identity claims efficiently, enabling rapid and secure identity establishment across space and time, even during VM re-deployment or migration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional identity establishment methods are used for VMs, then security and reliability are improved, but time consumption increases significantly
Solution Approach 1:
The system performs preliminary actions by pre-establishing trust relationships between the fabric controller and security token service before VM deployment. The fabric controller pre-generates security tokens and embeds them in VM images during creation, so that when the VM starts, the identity establishment is already prepared and requires minimal additional time, resolving the contradiction between reliable identity verification and time consumption.
2Stability of the object's composition
If VMs are frequently destroyed and recreated to prevent drift, then system stability is improved, but identity establishment overhead increases
Solution Approach 1:
The system creates a template or image containing the pre-established security token and identity information. When VMs are destroyed and recreated, they are instantiated from this template, which already contains the necessary identity credentials. This copying approach allows rapid VM recreation without repeating the full identity establishment process, maintaining machine state consistency while minimizing identity establishment overhead and maximizing operational time.
3Reliability
If comprehensive identity verification is performed, then security is improved, but VM lifecycle efficiency deteriorates
Solution Approach 1:
The fabric controller performs comprehensive identity verification and security token generation in advance during VM image creation, before the VM enters its functional lifecycle. The security token is embedded in the VM image, so when the VM starts, the heavy verification work is already complete. This preliminary action ensures security is established upfront, allowing the VM to spend maximum time in functional state without repeated verification overhead during its operational lifetime.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An invention is described for securely deploying a provable identity for virtual machines (VMs) in a dynamic environment. In an embodiment, a fabric controller instructs a VM host to create a VM and sends that VM a secret. The fabric controller sends that same secret (or a second secret, such as the private key of a public/private key pair) to the security token service along with an instruction to make an account for the VM. The VM presents proof that it possesses the secret to the security token service and in return receives a full token. When a client connects to the deployment, it receives the public key from the security token service, which it trusts, and the full token from the VM. It validates the full token with the public key to determine that the VM has the identity that it purports to have.