Secure provisioning of operating systems

Patent metadata

Field	Value
Publication number	US-11394548-B2
Application number	US-201916565480-A
Country	US
Kind code	B2
Filing date	Sep 9, 2019
Priority date	Feb 12, 2016
Publication date	Jul 19, 2022
Grant date	Jul 19, 2022

Abstract

Methods, media, and systems for secure provisioning of servers within a cloud computing environment are provided for herein. In some embodiments, a management service can delegate provisioning of a server of the cloud computing environment to an imaging service. In response, the imaging service can generate an operating system image for the server and can utilize disk encryption to protect to operating system image. In embodiments, a volume encryption key of the disk encryption can be encrypted utilizing a public key of a trusted platform manager of the server, to produce an encrypted volume encryption key that is protected by the trusted platform module of the server. The encrypted operating system image and the encrypted volume encryption key can then be transmitted to the server to cause the server to be provisioned with the operating system image. Other embodiments may be described and/or claimed herein.

First claim

What is claimed is:

1. A computerized system comprising:
one or more computer processors; and
computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform, using a secure server management service, operations comprising:
receiving a request, from a server in a first computing environment, to securely provision an operating system for the server associated with a cloud computing system, the server having a hardware encryption module associated with a key, wherein the request comprises an authentication request to authenticate, secure presence of the server in the first computing environment;
authenticating presence of the server, wherein authenticating presence of the server comprises:
(1) retrieving a public key associated with the hardware encryption module of the server, wherein the public key is retrieved from a data store in which the public key was stored in the cloud computing system;
(2) authenticating the server utilizing the public key; and
(3) in response to a successful authentication of the server, identifying an imaging service to provision the operating system image;

based on authenticating secure presence of the server in the first computing environment, causing, the imaging service, to provision the operating system on the first server, wherein provisioning the operating system comprises the imaging service executing the following:
accessing an operating system image for the server;
encrypting the operating system image, utilizing an encryption key; and
causing the server to be provisioned with the operating system image.

2. The system of claim 1 , the operations further comprising receiving the authentication request from the server, as part of authenticating the secure presence of the server in the first computing environment, wherein the first computing environment is identified as a physically unsecure computing environment.

3. The system of claim 1 , wherein the hardware encryption module is a trusted platform module.

4. The system of claim 1 , the operations further comprising:
retrieving state information associated with the server, the state information including an indicator of one or more of:
whether the server has been reported stolen, and
an expected internet protocol address of the server; and
validating the state information of the server, wherein identifying the imaging service of the cloud computing environment to which to delegate generating the operating system image is also in response to successful validation of the server.

5. The system of claim 1 , the operations further comprising transmitting to the server a selected imaging service notification that includes an identifier associated with the identified imaging service to enable the server to submit an imaging request to the identified imaging service.

6. The system of claim 1 , the operations further comprising communicating, to the imaging service, an image delegation notification that identifies the server to be provisioned with the operating system image, wherein the image delegation notification is received at the imaging service based on the imaging service being selected based on a geographic proximity of the image server to the server.

7. The system of claim 1 , wherein the request is a first request, the server is a first server, and the imaging service is a first imaging service, and wherein the secure server management service is further to:
receive a second request from a second server for secure provisioning of an operating system for the second server, the second request including an identifier of the second server; and
identifying a second imaging service located on the first server to which to delegate generating an operating system image for the second server.

8. One or more hardware computer-storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to:
receive a request, from a server in a first computing environment, to securely provision an operating system for the server associated with a cloud computing system, the server having a hardware encryption module comprising associated with a key, wherein the request comprises an authentication request to verify authenticate, secure presence of the server in the first computing environment;
authenticate presence of the server, wherein authenticating presence of the server comprises:
(1) retrieving a public key associated with the hardware encryption module of the server, wherein the public key is retrieved from a data store in which the public key was stored in the cloud computing system;
(2) authenticating the server utilizing the public key; and
(3) in response to a successful authentication of the server, identifying an imaging service to provision the operating system image;

based on authenticating secure presence of the server in the first computing environment, cause, an imaging service to provision the operating system on the first server, wherein provisioning the operating system comprises the imaging service executing the following:
accessing an operating system image for the server;
encrypting the operating system image, utilizing an encryption key; and
causing the server to be provisioned with the operating system image.

9. The media of claim 8 , the operations further comprising receiving the authentication request from the server, as part of authenticating the secure presence of the server in the first computing environment, wherein the first computing environment is identified as the physically unsecure computing environment.

10. The media of claim 8 , wherein the hardware encryption module is a trusted platform module.

11. The media of claim 8 , the operations further comprising:
retrieving state information associated with the server, the state information including an indicator of one or more of:
whether the server has been reported stolen, and
an expected internet protocol address of the server; and
validating the state information of the server, wherein identifying the imaging service of the cloud computing environment to which to delegate generating the operating system image is also in response to successful validation of the server.

12. The media of claim 8 , the operations further comprising transmitting to the server a selected imaging service notification that includes an identifier associated with the identified imaging service to enable the server to submit an imaging request to the identified imaging service.

13. The media of claim 8 , the operations further comprising communicating, to the imaging service, an image delegation notification that identifies the server to be provisioned with the operating system image, wherein the image delegation notification is received at the imaging service based on the imaging service being selected based on a geographic proximity of the image server to the server.

14. The media of claim 8 , wherein the request is a first request, the server is a first server, and the imaging service is a first imaging service, and wherein the secure server management service is further to:
receive a second request from a second server for secure provisioning of an operating system for the second server, the second request including an identifier of the second server; and
identifying a second imaging service located on the first server to which to delegate generating an operating system image for the second server.

15. A computer-implemented method, the method comprising:

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Mueller Ulrich
• Gershaft Aleksandr Mikhailovich
• Mccarron Christopher W
• Jubran Marwan E

Classifications

• G06F8/63 Primary

  Image based installation; Cloning; Build to order · CPC title

• G06F21/72

  in cryptographic circuits · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L2209/127

  Trusted platform modules [TPM] · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title