Back to results
US 10,871,984 B2Granted
Secure service hosted in a virtual security environment
AssigneeMicrosoft Technology Licensing, LLC
InventorsMalcolm E. Pearson, Tolga Acar, Rahul Verma
Life of this patent
Estimating the term…
Abstract
An execution environment has a deployed virtual machine image. The virtual machine image provides a service that is identified by a role. The execution environment generates a measurement of the virtual machine image and provides it to a key service to request role keys that enable operation of the virtual machine image in the execution environment. The key service determines whether the virtual machine image is mapped to the role and, if so, returns the role keys to the requesting execution environment.
Claims20
A method performed by a computing system, the method comprising:
- receiving a request to deploy a computing service in an execution environment of the computing system;
- prior to execution of at least a portion of the computing service in the execution environment,
- applying, in the execution environment, a measurement function to a virtual machine (VM) image, that defines the computing service, deployed in the execution environment,
- generating, by the computing system, a VM image measurement based on the application of the measurement function;
- sending, by the computing system to a key service, a key request including an indication of the computing service and the VM image measurement, and
- obtaining, from the key service in response to the key request, a key representing a determination that the VM image measurement is mapped to the computing service, wherein the key enables the execution environment to execute the portion of the computing service;
- and
- executing the portion of the computing service in the execution environment using the key.
5 more elements
A computing system comprising:
- at least one processor;
- and
- memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
- receive a request to deploy a computing service in an execution environment of the computing system;
- prior to execution of at least a portion of the computing service in the execution environment,
- apply, in the execution environment, a measurement function to a virtual machine (VM) image, that defines the computing service, deployed in the execution environment,
- generate, by the computing system, a VM image measurement based on the application of the measurement function,
- send, by the computing system, to a key service, a key request including an indication of the computing service and the VM image measurement, and
- receive, from the key service in response to the key request, a key representing a determination that the VM image measurement is mapped to the computing service, wherein the key enables the execution environment to execute the portion of the computing service;
- and
- execute the portion of the computing service in the execution environment using the key.
8 more elements
A computing system comprising:
- at least one processor;
- and
- memory storing instructions executable by the at least one processor, wherein the instructions, when executed, provide:
- a measurement system configured to:
- prior to execution of at least a portion of a computing service in an execution environment,
- apply, in the execution environment, a measurement function to a virtual machine (VM) image, that defines the computing service, deployed in the execution environment;
- obtain a virtual machine (VM) image measurement based on the application of the measurement function to the VM image;
- and
- send a key request to a key service, the key request including an indication of the computing service and the VM image measurement;
- and
- an execution environment configured to:
- receive a role key from the key service based on a determination that the VM image measurement is mapped to a role corresponding to the computing service, wherein the role key enables the execution environment to execute of at least a portion of the computing service, and
- execute the portion of the computing service in the execution environment using the role key.
10 more elements
Dependencies are inferred from the claim text.