# US 10,871,984 B2 · Secure service hosted in a virtual security environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,871,984 B2
- Document ID: US10871984B2
- Status: Granted
- Kind: B2
- Application number: 16/386,842
- Filed: 2019-04-17
- Published: 2019-08-08
- Granted: 2020-12-22
- Earliest claimed: 2016-10-25
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Malcolm E. Pearson; Tolga Acar; Rahul Verma
- Web page: https://patentgrep.com/patent/US10871984B2

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0822: {using key encryption key}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- H04L 2463/041: using an encryption or decryption engine integrated in transmitted data
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An execution environment has a deployed virtual machine image. The virtual machine image provides a service that is identified by a role. The execution environment generates a measurement of the virtual machine image and provides it to a key service to request role keys that enable operation of the virtual machine image in the execution environment. The key service determines whether the virtual machine image is mapped to the role and, if so, returns the role keys to the requesting execution environment.

## Claims

### Claim 1

A method performed by a computing system, the method comprising:
receiving a request to deploy a computing service in an execution environment of the computing system;
prior to execution of at least a portion of the computing service in the execution environment,
applying, in the execution environment, a measurement function to a virtual machine (VM) image, that defines the computing service, deployed in the execution environment,
generating, by the computing system, a VM image measurement based on the application of the measurement function;
sending, by the computing system to a key service, a key request including an indication of the computing service and the VM image measurement, and
obtaining, from the key service in response to the key request, a key representing a determination that the VM image measurement is mapped to the computing service, wherein the key enables the execution environment to execute the portion of the computing service; and
executing the portion of the computing service in the execution environment using the key.

### Claim 2 (depends on 1)

The method of claim 1, wherein the measurement function comprises a hash function.

### Claim 3 (depends on 1)

The method of claim 1, wherein the computing service is identified by a role, and further comprising sending an indication of the role to the key service.

### Claim 4 (depends on 3)

The method of claim 3, wherein obtaining the key comprises receiving, from the key service, a role key that is associated with the role.

### Claim 5 (depends on 1)

The method of claim 1, wherein the execution environment comprises a trusted execution environment.

### Claim 6 (depends on 4)

The method of claim 4, wherein the role key comprises an encrypted role key.

### Claim 7 (depends on 6)

The method of claim 6, and further comprising decrypting the encrypted role key to obtain the key.

### Claim 8 (depends on 3)

The method of claim 3, and further comprising:
deploying the computing service to the execution environment using VM image.

### Claim 9 (depends on 8)

The method of claim 8, and further comprising:
obtaining the VM image from a deployment system.

### Claim 10 (depends on 9)

The method of claim 9, wherein the deployment system accesses a role-to-image mapping that maps the role to the VM image.

### Claim 11

A computing system comprising:
at least one processor; and
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
receive a request to deploy a computing service in an execution environment of the computing system;
prior to execution of at least a portion of the computing service in the execution environment,
apply, in the execution environment, a measurement function to a virtual machine (VM) image, that defines the computing service, deployed in the execution environment,
generate, by the computing system, a VM image measurement based on the application of the measurement function,
send, by the computing system, to a key service, a key request including an indication of the computing service and the VM image measurement, and
receive, from the key service in response to the key request, a key representing a determination that the VM image measurement is mapped to the computing service, wherein the key enables the execution environment to execute the portion of the computing service; and
execute the portion of the computing service in the execution environment using the key.

### Claim 12 (depends on 11)

The computing system of claim 11, wherein the measurement function comprises a hash function.

### Claim 13 (depends on 11)

The computing system of claim 11, wherein the computing service is identified by a role, and wherein the instructions, when executed, cause the computing system to send an indication of the role to the key service.

### Claim 14 (depends on 13)

The computing system of claim 13, wherein the instructions cause the computing system to receive, from the key service, a role key that is associated with the role.

### Claim 15 (depends on 14)

The computing system of claim 14, wherein the role key is received from the key service based on a determination that the VM image measurement is mapped to the role.

### Claim 16 (depends on 14)

The computing system of claim 14, wherein the role key comprises an encrypted role key, and the instructions cause the computing system to:
decrypt the encrypted role key to obtain the key.

### Claim 17 (depends on 14)

The computing system of claim 14, wherein the instructions, when executed, cause the computing system to:
obtain the VM image from a deployment system; and
deploy the computing service to the execution environment using VM image.

### Claim 18 (depends on 17)

The computing system of claim 17, wherein the deployment system accesses a set of role-to-image mappings that map the role to the VM image, and the role key is received from the key service based on a determination that the VM image measurement is mapped to the role.

### Claim 19

A computing system comprising:
at least one processor; and
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, provide:
a measurement system configured to:
prior to execution of at least a portion of a computing service in an execution environment,
apply, in the execution environment, a measurement function to a virtual machine (VM) image, that defines the computing service, deployed in the execution environment;
obtain a virtual machine (VM) image measurement based on the application of the measurement function to the VM image; and
send a key request to a key service, the key request including an indication of the computing service and the VM image measurement; and
an execution environment configured to:
receive a role key from the key service based on a determination that the VM image measurement is mapped to a role corresponding to the computing service, wherein the role key enables the execution environment to execute of at least a portion of the computing service, and
execute the portion of the computing service in the execution environment using the role key.

### Claim 20 (depends on 19)

The computing system of claim 19, wherein
the measurement function comprises a hash function, and
the instructions, when executed, provide:
a decryption system that receives, from the key service, an encrypted role key that is associated with the role, and decrypts the encrypted role key to obtain the key.