Method and apparatus for external control planes to cryptographically trust software artifacts launched at public cloud providers

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and,
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• submitting a request for a workload instance to a cloud service provider;
• establishing a secure communication channel between the cloud service provider and a data center monitoring and management console;
• exchanging information between the cloud service provider and the data center monitoring and management console via the secure communication channel, the information including a verifiable workload instance identity, the verifiable workload instance identity being unique, linked by the cloud service provider to the workload instance and cryptographically verifiable;
• and,
• using the verifiable workload instance identity to authenticate a workload instance provided by the cloud service provider, the data center monitoring and management console authenticating the workload instance.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• submitting a request for a workload instance to a cloud service provider;
• establishing a secure communication channel between the cloud service provider and a data center monitoring and management console;
• exchanging information between the cloud service provider and the data center monitoring and management console via the secure communication channel, the information including a verifiable workload instance identity, the verifiable workload instance identity being unique, linked by the cloud service provider to the workload instance and cryptographically verifiable;
• and,
• using the verifiable workload instance identity to authenticate a workload instance provided by the cloud service provider, the data center monitoring and management console authenticating the workload instance.