Back to results
US 10,896,257 B2Granted
Secure boot of virtualized computing instances
AssigneeVMware, Inc.
InventorsJason A. Lango, Adam Cain, Nitin Bahadur, John K. Edwards, Kevin George, William McGovern, Andrew G. Tucker
Life of this patent
Estimating the term…
Abstract
In an embodiment, a secure boot method comprises writing a wrapped data encryption key (DEK) and a wrapped key encryption key (KEK) onto a label of a wrapped operating system image prior to uploading the wrapped operating system image to a virtual data center using one or more computing devices.
Claims19
A method for a client device, comprising:
- encrypting, at the client device, an operating system image under a data encryption key (DEK) to generate a wrapped operating system image;
- encrypting the DEK under a key encryption key (KEK) to generate a wrapped DEK;
- transmitting the KEK to a key management server to encrypt the KEK under an account root key of the key management server to generate a wrapped KEK;
- and
- after receiving the wrapped KEK from the key management service, transmitting the wrapped DEK, the wrapped KEK, and the wrapped operating system image from the client device to a virtual data center, wherein the virtual data center subsequently:
- sends a decryption request to the key management server, the decryption request including the wrapped KEK;
- receives a response from the key management server that includes the KEK;
- unwraps the wrapped DEK using the KEK to obtain the DEK;
- and
- boots up a guest operating system using the DEK.
7 more elements
A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors of a client device, cause:
- encrypting, at the client device, an operating system image under a data encryption key (DEK) to generate a wrapped operating system image;
- encrypting the DEK under a key encryption key (KEK) to generate a wrapped DEK;
- transmitting the KEK to a key management service to encrypt the KEK under an account root key of the key management server to generate a wrapped KEK;
- and
- after receiving the wrapped KEK from the key management service, transmitting the wrapped DEK, the wrapped KEK, and the wrapped operating system image from the client device to a virtual data center, wherein the virtual data center subsequently:
- sends a decryption request to the key management server, the decryption request including the wrapped KEK;
- receives a response from the key management server that includes the KEK;
- unwraps the wrapped DEK using the KEK to obtain the DEK;
- and
- boots up a guest operating system using the DEK.
7 more elements
A computer system, comprising:
- an on-premises device having one or more processors and storage media storing first instructions for execution by the one or more processors of the on-premises device;
- a virtual data center having one or more processors and storage media storing second instructions for execution by the virtual data center;
- wherein the on-premises device is communicatively coupled to the virtual data center by a data network;
- wherein the first instructions are configured for:
- encrypting an operating system image under a data encryption key (DEK) to generate a wrapped operating system image;
- encrypting the DEK under a key encryption key (KEK) to generate a wrapped DEK;
- transmitting the KEK to a key management service to encrypt the KEK under an account root key of the key management server to generate a wrapped KEK;
- receiving the wrapped KEK from the key management service;
- and
- transmitting, through the data network, the wrapped DEK, the wrapped KEK, and the wrapped operating system to the virtual data center, wherein the virtual data center subsequently uses the wrapped DEK and the wrapped KEK to decrypt the wrapped operating system image;
- wherein the second instructions are configured for:
- sending a decryption request to the key management server, the decryption request including the wrapped KEK;
- receiving a response from the key management server that includes the KEK;
- unwrapping the wrapped DEK using the KEK to obtain the DEK;
- generating an encrypted machine image by merging the wrapped system image with an intermediary guest manager machine image;
- and
- booting up a guest operating system using the DEK and the encrypted machine image.
14 more elements
Dependencies are inferred from the claim text.