Secure service hosted in a virtual security environment
AssigneeMicrosoft Technology Licensing, LLC
InventorsMalcolm E. Pearson, Tolga Acar, Rahul Verma
Life of this patent
Estimating the term…
Abstract
An execution environment has a deployed virtual machine image. The virtual machine image provides a service that is identified by a role. The execution environment generates a measurement of the virtual machine image and provides it to a key service to request role keys that enable operation of the virtual machine image in the execution environment. The key service determines whether the virtual machine image is mapped to the role and, if so, returns the role keys to the requesting execution environment.
Claims20
A computing system, comprising:
- at least one processor;
- and
- memory storing instructions executable by the at least one processor, wherein the instructions, when executed, provide:
- a policy engine configured to:
- receive a role identifier identifying a role that represents a service to be hosted by an execution environment,
- receive a virtual machine (VM) image measurement indicative of a virtual machine image deployed in the execution environment,
- determine, based on a measurement-to-role mapping, whether the VM image measurement is mapped to the role, and
- generate an evaluation signal indicative of the determination;
- a key wrapping cryptographic engine configured to:
- based on the evaluation signal indicating that the VM image measurement is mapped to the role, wrap a set of role keys that:
- correspond to the role, and
- enable the execution environment to execute the service;
- and
- a key service configured to provide the execution environment with the set of wrapped role keys.
A method performed by a computing system, the method comprising:
- identifying a service associated with an execution environment configured to execute the service;
- identifying a virtual machine (VM) image measurement, indicative of a virtual machine image deployed in the execution environment;
- determining, based on a measurement-to-role mapping, whether the VM image measurement is mapped to the service;
- generating an evaluation signal indicative of the determination;
- obtaining, in response to the evaluation signal indicating that the VM image measurement is mapped to the service, a set of role keys that:
- correspond to the service, and
- enable the execution environment to execute the service;
- encrypting the role keys in the set of role keys;
- and
- providing the execution environment with the set of encrypted role keys.
A computing system, comprising:
- at least one processor;
- and
- memory storing instructions executable by the at least one processor, wherein the instructions, when executed, configure the computing system to:
- execute a service represented by a deployed virtual machine (VM) image, and identified by a role;
- apply a hash function to the VM image to generate a VM image measurement;
- provide the role and the VM image measurement to a key service to request a set of role keys;
- receive a set of wrapped role keys from the key service;
- decrypt the set of wrapped role keys to obtain the requested set of role keys;
- and
- execute the service using the requested role keys.
Dependencies are inferred from the claim text.