Secure Public Cloud

A computer comprising:

• a processor;
• at least one computer-readable medium coupled to the processor;
• and
• instructions in the computer-readable medium that, if executed by the processor, enable the computer to:
• receive a domain manager image and memory position-dependent address information in response to requesting a service from a cloud services provider;
• verify the domain manager image;
• identify a key domain key to be used to encrypt data stored in a key domain of a key domain-capable server, wherein the key domain comprises a plurality of memory locations of a memory of the key domain-capable server;
• use the key domain key and the memory-position dependent address information to encrypt a domain launch image such that the encrypted domain launch image is cryptographically bound to at least one memory location of the key domain;
• encrypt the key domain key;
• and
• send the encrypted domain launch image and the encrypted key domain key to the key domain-capable server, to cause a processor of the key domain-capable server to execute an instruction to create the key domain.

A method comprising:

• receiving a domain manager image and memory position-dependent address information in response to requesting a service from a cloud services provider;
• verifying the domain manager image;
• identifying a key domain key to be used to encrypt data stored in a key domain of a key domain-capable server, wherein the key domain comprises a plurality of memory locations of a memory of the key domain-capable server;
• using the key domain key and the memory-position dependent address information to encrypt a domain launch image such that the encrypted domain launch image is cryptographically bound to at least one memory location of the key domain;
• encrypting the key domain key;
• and
• sending the encrypted domain launch image and the encrypted key domain key to the key domain-capable server, to cause a processor of the key domain-capable server to execute an instruction to create the key domain.