Secure count in cloud computing networks
AssigneeMicrosoft Technology Licensing, LLC
InventorsGerardo Diaz-Cuellar, Stefan Thom, Joerg-Thomas Pfenning
Life of this patent
Estimating the term…
Abstract
Inducements are provided to customers to regularly connect back to a service provider and report usage that is expressed using a count of requests from a local computing device for cloud-based operations such as packet routing, container instantiation, virtual machine (VM) utilization, calls to a service or application, and the like. The count information is reported within a secure context, such as a trusted execution environment (TEE), using public-private key pair cryptography by which key derivation is dependent on some form of counting. For example, a customer computing device that is subject to a usage license encrypts an operation count and reports it to the service provider.
Claims20
A computing device, comprising:
- one or more processors;
- and
- at least one non-transitory computer-readable memory having computer-executable instructions stored thereon which, when executed by the one or more processors, cause the computing device to:
- execute, in a trusted execution environment, a cryptographic process in a trusted plug-in that is installed on the computing device, in which the trusted plug-in includes a watchdog;
- count utilization of a service;
- encrypt one or more messages using the cryptographic process;
- report the utilization of the service to a service provider using the one or more encrypted messages, wherein the service provider provides the service to the computing device;
- and
- responsively to the counted utilization of the service being outside predetermined limits, disable the trusted plug-in by operations of the watchdog.
One or more non-transitory computer-readable memory devices storing computer-executable instructions which, upon execution by one or more processors in a computing device, cause the computing device to:
- employ a trusted plug-in including a watchdog to implement a trusted execution environment by using a cryptographic process to encrypt one or more messages that are communicated to a service provider from the computing device;
- download code from the service provider, in which the downloaded code is encrypted;
- produce decrypted code by decrypting the code in the trusted plug-in;
- execute the decrypted code in the trusted plug-in;
- and
- responsively to remote performance of operations by the service provider being outside one of license, policy, or agreement, disable the trusted plug-in by operations of the watchdog.
A method of operating a computer server on which a service operates, comprising:
- interoperating with a trusted plug-in that is installed on a computing device in accordance with predetermined terms, in which the trusted plug-in operates within a trusted execution environment by exchanging messages with the service that are encrypted by the trusted plug-in, and in which the trusted plug-in includes a watchdog that selectively disables the trusted plug-in based on operating counts, the operating counts being associated with utilization of the service by the computing device;
- receiving an encrypted report of the operating counts from the computing device;
- and
- discontinuing provision of additional operating counts to the watchdog in the trusted plug-in to cause the watchdog to disable the trusted plug-in responsively to the computing device being outside the predetermined terms.
Dependencies are inferred from the claim text.