Back to results
US 2019/0102555 A1Published application
System integrity using attestation for virtual trusted platform module
AssigneeMicrosoft Technology Licensing, LLC
InventorsMark Fishel Novak, Yevgeniy A. Samsonov, Jingbo Wu
Life of this patent
Estimating the term…
Abstract
Techniques are described herein that are capable of establishing system integrity using attestation for a virtual trusted platform module (vTPM). For instance, an endorsement key certificate, including an endorsement key associated with the vTPM, may be signed to issue the endorsement key certificate to the vTPM. The endorsement key certificate may be used to establish a chain of trust with regard to the vTPM. For instance, the endorsement key certificate may be used to attest the vTPM (and measurements provided by the vTPM).
Claims20
A system to attest a virtual trusted platform module, the system comprising:
- memory;
- one or more processors coupled to the memory;
- and
- a guest attestation service implemented using at least one of the one or more processors to attest a virtual machine that is hosted by a host operating system configured to run on a host, the guest attestation service configured to:
- receive a guest endorsement key certificate and guest measurements from the virtual machine,
- the guest endorsement key certificate including a guest endorsement key associated with the virtual trusted platform module that is hosted by the host operating system,
- the guest endorsement key certificate vouching for the guest measurements,
- the guest measurements indicating attributes of a guest operating system configured to run on the virtual machine;
- determine whether the guest endorsement key certificate is issued via a chain of trust that includes a host attestation service that is configured to attest the host;
- generate a verification indicating that the guest measurements are trustworthy based at least in part on a determination that the guest endorsement key certificate is issued via the chain of trust that includes the host attestation service;
- and
- provide the verification to the virtual machine.
9 more elements
A method of attesting a virtual trusted platform module, the method comprising:
- providing, by a virtual machine that is hosted by a source host operating system that runs on a source host, a guest endorsement key certificate and guest measurements to a guest attestation service,
- the guest endorsement key certificate including a guest endorsement key associated with the virtual trusted platform module that is hosted by the source host operating system,
- the guest endorsement key certificate vouching for the guest measurements,
- the guest measurements indicating attributes of a guest operating system that runs on the virtual machine;
- receiving, by the virtual machine, a verification from the guest attestation service, the verification indicating that the guest measurements are trustworthy based at least in part on the guest endorsement key certificate being issued via a chain of trust that includes a host attestation service that is configured to attest the source host;
- migrating the virtual machine from the source host to a target host;
- and
- obtaining, by the virtual machine hosted by a target operating system that runs on the target host, a second guest endorsement key certificate that is issued via a chain of trust that includes a second host attestation service that is configured to attest the target host,
- the second guest endorsement key certificate including the guest endorsement key,
- the second guest endorsement key certificate vouching for the guest measurements.
7 more elements
A method of attesting a virtual trusted platform module, the method comprising:
- providing, by a source virtual machine that is hosted by a source host operating system that runs on a source host, a guest endorsement key certificate and guest measurements to a guest attestation service,
- the guest endorsement key certificate including a guest endorsement key associated with the virtual trusted platform module that is hosted by the source host operating system,
- the guest endorsement key certificate vouching for the guest measurements,
- the guest measurements indicating attributes of a guest operating system that runs on the source virtual machine;
- receiving, by the source virtual machine, a verification from the guest attestation service, the verification indicating that the guest measurements are trustworthy based at least in part on the guest endorsement key certificate being issued via a chain of trust that includes a host attestation service that is configured to attest the source host;
- shutting down the guest operating system on the source virtual machine;
- restarting the guest operating system on a target virtual machine that is hosted by a target host operating system that runs on a target host;
- and
- obtaining, by the target virtual machine, a second guest endorsement key certificate that is issued via a chain of trust that includes a second host attestation service that is configured to attest the target host,
- the second guest endorsement key certificate including the guest endorsement key,
- the second guest endorsement key certificate vouching for the guest measurements;
- and
- wherein the virtual trusted platform module is migrated from the source host operating system to the target host operating system based at least in part on the guest operating system being shut down on the source virtual machine and being restarted on the target virtual machine.
10 more elements
Dependencies are inferred from the claim text.