# US 12,225,140 B2 · Method and apparatus for external control planes to cryptographically trust software artifacts launched at public cloud providers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,140 B2 - Document ID: US12225140B2 - Status: Granted - Kind: B2 - Application number: 18/214,209 - Filed: 2023-06-26 - Published: 2024-12-26 - Granted: 2025-02-11 - Earliest claimed: 2023-06-26 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Michal Davidson; Dominique Prunier; Alan White - Web page: https://patentgrep.com/patent/US12225140B2 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/3247: {involving digital signatures} - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 41/34: Signalling channels for network management communication - H04L 41/5096: {wherein the managed service relates to distributed or central networked applications} - H04L 43/0817: by checking functioning - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system, method, and computer-readable medium for performing a data center monitoring and management operation. The data center monitoring and management operation includes: submitting a request for a workload instance to a cloud service provider; establishing a secure communication channel between the cloud service provider and a data center monitoring and management console; exchanging information between the cloud service provider and the data center monitoring and management console via the secure communication channel, the information including a verifiable workload instance identity; and, using the verifiable workload instance identity to authenticate a workload instance provided by the cloud service provider. ## Claims ### Claim 1 A computer-implementable method for performing a data center monitoring and management operation, comprising: submitting a request for a workload instance to a cloud service provider; establishing a secure communication channel between the cloud service provider and a data center monitoring and management console; exchanging information between the cloud service provider and the data center monitoring and management console via the secure communication channel, the information including a verifiable workload instance identity, the verifiable workload instance identity being unique, linked by the cloud service provider to the workload instance and cryptographically verifiable; and, using the verifiable workload instance identity to authenticate a workload instance provided by the cloud service provider, the data center monitoring and management console authenticating the workload instance. ### Claim 2 (depends on 1) The method of claim 1, wherein: the secure connection is established using a public key provided by the cloud service provider. ### Claim 3 (depends on 2) The method of claim 2, wherein: the data center monitoring and management console comprises a workload authentication system; and, the workload authentication system verifies a signature of the cloud service provider using the public key provided by the cloud service provider and stores with verifiable workload instance identity. ### Claim 4 (depends on 2) The method of claim 2, wherein: the cloud service provider generates a certificate signing request (CSR) when establishing the secure communication channel between the cloud service provider and a data center monitoring and management console. ### Claim 5 (depends on 4) The method of claim 4, wherein: the workload authentication system processes the CSR to generate a signed certificate containing an authenticated workload identity. ### Claim 6 (depends on 1) The method of claim 1, further comprising: initiating an instance of a requested workload; and, retrieving the verifiable instance identity when the instance of the requested workload is initiated. ### Claim 7 A system comprising: a processor; a data bus coupled to the processor; and, a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for: submitting a request for a workload instance to a cloud service provider; establishing a secure communication channel between the cloud service provider and a data center monitoring and management console; exchanging information between the cloud service provider and the data center monitoring and management console via the secure communication channel, the information including a verifiable workload instance identity, the verifiable workload instance identity being unique, linked by the cloud service provider to the workload instance and cryptographically verifiable; and, using the verifiable workload instance identity to authenticate a workload instance provided by the cloud service provider, the data center monitoring and management console authenticating the workload instance. ### Claim 8 (depends on 7) The system of claim 7, wherein: the secure connection is established using a public key provided by the cloud service provider. ### Claim 9 (depends on 8) The system of claim 8, wherein: the data center monitoring and management console comprises a workload authentication system; and, the workload authentication system verifies a signature of the cloud service provider using the public key provided by the cloud service provider and stores with verifiable workload instance identity. ### Claim 10 (depends on 8) The system of claim 8, wherein: the cloud service provider generates a certificate signing request (CSR) when establishing the secure communication channel between the cloud service provider and a data center monitoring and management console. ### Claim 11 (depends on 10) The system of claim 10, wherein: the workload authentication system processes the CSR to generate a signed certificate containing an authenticated workload identity. ### Claim 12 (depends on 7) The system of claim 7, wherein the instructions executable by the processor are further configured for: initiating an instance of a requested workload; and, retrieving the verifiable instance identity when the instance of the requested workload is initiated. ### Claim 13 A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for: submitting a request for a workload instance to a cloud service provider; establishing a secure communication channel between the cloud service provider and a data center monitoring and management console; exchanging information between the cloud service provider and the data center monitoring and management console via the secure communication channel, the information including a verifiable workload instance identity, the verifiable workload instance identity being unique, linked by the cloud service provider to the workload instance and cryptographically verifiable; and, using the verifiable workload instance identity to authenticate a workload instance provided by the cloud service provider, the data center monitoring and management console authenticating the workload instance. ### Claim 14 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the secure connection is established using a public key provided by the cloud service provider. ### Claim 15 (depends on 14) The non-transitory, computer-readable storage medium of claim 14, wherein: the data center monitoring and management console comprises a workload authentication system; and, the workload authentication system verifies a signature of the cloud service provider using the public key provided by the cloud service provider and stores with verifiable workload instance identity. ### Claim 16 (depends on 14) The non-transitory, computer-readable storage medium of claim 14, wherein: the cloud service provider generates a certificate signing request (CSR) when establishing the secure communication channel between the cloud service provider and a data center monitoring and management console. ### Claim 17 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the workload authentication system processes the CSR to generate a signed certificate containing an authenticated workload identity. ### Claim 18 (depends on 17) The non-transitory, computer-readable storage medium of claim 17, wherein the computer executable instructions are further configured for: initiating an instance of a requested workload; and, retrieving the verifiable instance identity when the instance of the requested workload is initiated. ### Claim 19 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the computer executable instructions are deployable to a client system from a server system at a remote location. ### Claim 20 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the computer executable instructions are provided by a service provider to a user on an on-demand basis.