Secure provisioning of operating systems

Patent metadata

Field	Value
Publication number	US-10425229-B2
Application number	US-201615043224-A
Country	US
Kind code	B2
Filing date	Feb 12, 2016
Priority date	Feb 12, 2016
Publication date	Sep 24, 2019
Grant date	Sep 24, 2019

Abstract

Methods, media, and systems for secure provisioning of servers within a cloud computing environment are provided for herein. In some embodiments, a management service can delegate provisioning of a server of the cloud computing environment to an imaging service. In response, the imaging service can generate an operating system image for the server and can utilize disk encryption to protect to operating system image. In embodiments, a volume encryption key of the disk encryption can be encrypted utilizing a public key of a trusted platform manager of the server, to produce an encrypted volume encryption key that is protected by the trusted platform module of the server. The encrypted operating system image and the encrypted volume encryption key can then be transmitted to the server to cause the server to be provisioned with the operating system image. Other embodiments may be described and/or claimed herein.

First claim

What is claimed is:

1. A computer-implemented method of securely provisioning servers, the method comprising:
using an imaging service located in a remote environment, performing each of the following:
receiving an image delegation notification that identifies a server that the imaging service is to provision with an operating system image,
wherein the image delegation notification is received, from a management service, as part of verifying a secure presence of the server in the remote environment based on the server communicating an authentication request to the management service that verifies the secure presence of the server in the remote environment;
generating the operating system image for the server;
encrypting at least an operating system volume, of the operating system image, utilizing a volume encryption key of a disk encryption mechanism;
encrypting the volume encryption key utilizing a protected encryption key that is protected by a trusted platform module of the server; and
transmitting the operating system image and the encrypted volume encryption key to the server to cause the server to be provisioned with the operating system image.

2. The computer-implemented method of claim 1 , the method further comprising retrieving, at the image service, a public key, wherein the public key was extracted from the trusted platform module of the server prior to deployment of the server to the remote environment.

3. The computer-implemented method of claim 2 , the method further comprising, storing the public key in a data store after being extracted from the trusted platform module of the server, wherein the management service that transmits the image delegation notification to the imaging service to cause the imaging service to provision the server with the operating system image, retrieves the public key from the data store.

4. The computer-implemented method of claim 2 , wherein the public key is included within the image delegation notification, and wherein retrieving the public key at the image service comprises extracting the public key from the image delegation notification.

5. The computer implemented method of claim 1 , further comprising establishing a remote trusted platform module session with the trusted platform module of the server utilizing the public key, wherein the remote trusted platform module session is utilized to authenticate the server.

6. The computer-implemented method of claim 1 , wherein the server is a first server, and wherein the imaging service resides on a second server, wherein the first server and the second server are intra-rack peers.

7. The computer-implemented method of claim 5 , further comprising:
utilizing the remote trusted platform module session to cause the volume encryption key to be sealed by the trusted platform module based on expected values of platform control registers of the server.

8. The computer-implemented method of claim 7 , further comprising retrieving the expected values of the platform control registers from a data store that correlates plurality of configurations of servers with a corresponding plurality of expected values of the platform control registers.

9. The computer-implemented method of claim 1 , further comprising:
upon transmitting the operating system image to the server, transmitting a completion notification to a management service to enable the management service to delegate the imaging service for generating an operating system image for another server.

10. One or more computer storage media storing computer-useable instructions that, when executed by one or more computing devices, causes the one or more computing devices to perform operations for securely provisioning servers, the operations comprising:
using an imaging service located in a remote environment, performing each of the following:
receiving an image delegation notification that identifies a server that the imaging service is to provision with an operating system image,
wherein the image delegation notification is received, from a management service, as part of verifying a secure presence of the server in the remote environment based on the server communicating an authentication request to the management service that verifies the secure presence of the server in the remote environment;
generating the operating system image for the server, wherein the imaging service is located in the remote environment, wherein the image delegation is received in response to successful authentication of the server in the remote environment;
encrypting at least an operating system volume, of the operating system image, utilizing a volume encryption key of a disk encryption mechanism;
encrypting the volume encryption key utilizing a protected encryption key that is protected by a trusted platform module of the server; and
transmitting the operating system image and the encrypted volume encryption key to the server to cause the server to be provisioned with the operating system image.

11. The one or more computer storage media of claim 10 , the method further comprising retrieving, at the image service, a public key, wherein the public key was extracted from the trusted platform module of the server prior to deployment of the server to the remote environment.

12. The one or more computer storage media of claim 11 , the method further comprising, storing the public key in a data store after being extracted from the trusted platform module of the server, wherein the management service that transmits the image delegation notification to the imaging service to cause the imaging service to provision the server with the operating system image, retrieves the public key from the data store.

13. The one or more computer storage media of claim 11 , wherein the public key is included within the image delegation notification, and wherein retrieving the public key at the image service comprises extracting the public key from the image delegation notification.

14. The one or more computer storage media of claim 10 , further comprising establishing a remote trusted platform module session with the trusted platform module of the server utilizing the public key, wherein the remote trusted platform module session is utilized to authenticate the server.

15. The one or more computer storage media of claim 10 , wherein the server is a first server, and wherein the imaging service resides on a second server, wherein the first server and the second server are intra-rack peers.

16. The one or more computer storage media of claim 14 , further comprising:
utilizing the remote trusted platform module session to cause the volume encryption key to be sealed by the trusted platform module based on expected values of platform control registers of the server.

17. The one or more computer storage media of claim 16 , further comprising retrieving the expected values of the platform control registers from a data store that correlates plurality of configurations of servers with a corresponding plurality of expected values of the platform control registers.

18. The one or more computer storage media of claim 10 , further comprising:
upon transmitting the operating system image to the server, transmitting a completion notification to a management service to enable the management service to delegate the imaging service for generating an operating system image for another server.

19. A computer system for securely provisioning servers within a cloud computing environment, the computer system comprising:
one or more processors; and
memo

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Mueller Ulrich
• Gershaft Aleksandr Mikhailovich
• Mccarron Christopher W
• Jubran Marwan E

Classifications

• H04L2209/127

  Trusted platform modules [TPM] · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F21/72

  in cryptographic circuits · CPC title

• G06F21/44

  Program or device authentication · CPC title