Trusted platform module (TPM) assisted data center management

A machine-implemented system, comprising

• a non-transitory computer readable storage medium having a data center registration service to process on a network;
• and
• the non-transitory computer readable storage medium having an identity service to process on the network;
• wherein the data center registration service is to register a trusted platform module (TPM) remote attestation received from a physical processing environment of a physical device when that physical processing environment is initiated on the physical device, and wherein during initiation the physical processing environment interacts with the identity service to acquire identifying information that is subsequently at least partially used by the physical processing environment in combination with the TPM remote attestation to authenticate to and interact with a data center to receive commands, data, and virtual processing environments that execute within the physical processing environment as virtual machines, and configuring the virtual processing environments with keys that just the physical processing environment has and can process for decrypting the virtual processing environments, permitting the virtual processing environments to be pinned to a physical machine having the physical processing environment once delivered to the physical processing environment, the TPM remote attestation is a signed hash of software resources and the configuration for the physical processing environment including a hash of the Basic Input/Output System (BIOS) of the physical machine and the Operating System (OS) of the physical processing environment, the TPM remote attestation signed with a private key of a TPM protected area, wherein the TPM remote attestation processed as an authentication credential for validating the physical processing environment each time the physical device communicates with the identity service, and wherein the physical device includes a generic platform module (GPM) equipped within firmware of the physical device that provides the TPM protected area, the GPM including an unchanging serial number to uniquely identify the GPM and a sealed storage area that releases the private key for use within the TPM protected area upon providing a secret paraphrase, the TPM protected area is a less capable instantiation of the GPM, and the private key is stored within and never provided outside a context of the sealed storage area and the TPM protected area, the GPM providing cryptographic functions that operate within the TPM protected area to gain access to the private key from the sealed storage via presentation of the secret paraphrase, and wherein the physical processing environment validates underlying hardware of the physical processing environment each time the physical processing environment initiates on that underlying hardware by checking a previously used subnet of the physical processing environment against a current subnet that is used each time the physical processing environment initiates.