Virtual machine images encryption using trusted computing group sealing

A computer implemented method for securely storing a customer's symmetric key, the method comprising:

• receiving the customer's symmetric key at a data center;
• encrypting the customer's symmetric key with a public key of the data center to form a wrapped customer's symmetric key;
• and
• storing the wrapped customer's symmetric key.

A computer implemented method for storing a customized virtual machine, the method comprising:

• provisioning a virtual machine on a host machine from a catalog of stock virtual machines;
• instantiating the virtual machine on the host machine;
• configuring the virtual machine, based on customer inputs, to form a customer's configured virtual machine;
• creating an image from the customer's configured virtual machine;
• unwrapping a customer's encrypted symmetric key to form a customer's symmetric key;
• encrypting the customer's configured virtual machine with the customer's symmetric key to form an encrypted configured virtual machine;
• and
• storing the encrypted configured virtual machine to non-volatile storage.

A computer implemented method for executing a customer's configured virtual machine, the method comprising:

• receiving a customer selection of an encrypted configured virtual machine image;
• obtaining a sealed blob from a data structure controlled by a data center;
• unsealing the sealed blob to form a data center private key;
• decrypting a customer's symmetric key with the data center private key;
• decrypting the customer's configured virtual machine from the encrypted configured virtual machine;
• and
• executing the customer's configured virtual machine on a host processor of a host machine.