Edge attestation for authorization of a computing node in a cloud infrastructure system

A cloud infrastructure node comprising:

• a processor;
• and
• a non-transitory computer-readable medium including instructions that, when executed by the processor, cause the processor to:
• obtain a set of authentication data from a console for authorization of a host node, the set of authentication data including a first endorsement key and an authentication policy identifying characteristics of the host node;
• obtain, from the host node, a request for a network address to connect to a cloud infrastructure environment;
• transmit a request for a second endorsement key to the host node;
• receive the second endorsement key from the host node;
• compare the second endorsement key with the first endorsement key received in the set of authentication data to validate the second endorsement key;
• transmit a request for host node authentication data to the host node;
• receive the host node authentication data from the host node;
• compare the received host node authentication data with the authentication policy received in the set of authentication data to validate the received host node authentication data;
• and
• responsive to validating the second endorsement key and the received host node authentication data, provide the network address to the host node, wherein the host node is configured to connect to the cloud infrastructure environment using the network address.

A non-transitory computer-readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a process, the process comprising:

• obtaining a set of authentication data from a console for authorization of a host node, the set of authentication data including a first endorsement key and an authentication policy identifying characteristics of the host node;
• obtaining, from the host node, a request for a network address to connect to a cloud infrastructure environment;
• receiving a request for a pre-boot execution environment client from the host node;
• providing a pre-boot execution environment client to the host node, wherein the host node is configured to execute a boot procedure using the pre-boot execution environment client.
• receiving a second endorsement key from the host node;
• comparing the second endorsement key with the first endorsement key received in the set of authentication data to validate the second endorsement key;
• receiving a set of host node authentication data from the host node derived during the boot procedure using the pre-boot execution environment client;
• comparing the received host node authentication data with the authentication policy received in the set of authentication data to validate the received host node authentication data;
• and
• responsive to validating the second endorsement key and the received host node authentication data, providing the network address to the host node, wherein the host node is configured to connect to the cloud infrastructure environment using the network address.