System and method for remote attestation in trusted execution environment creation using virtualization technology

Patent metadata

Field	Value
Publication number	US-11436318-B2
Application number	US-202016905652-A
Country	US
Kind code	B2
Filing date	Jun 18, 2020
Priority date	Jun 18, 2020
Publication date	Sep 6, 2022
Grant date	Sep 6, 2022

Abstract

System and method for performing a remote attestation for creation of a trusted execution environment (TEE) using a virtual secure enclave device running in a virtualized environment utilizes a trusted bootloader appliance in a TEE virtual computing instance, which is created in response to a request for a TEE from a software process running in the system. The trusted bootloader appliance manages the provisioning of a TEE in the TEE virtual computing instance for the software process. The remote attestation includes performing a first stage attestation on the trusted bootloader appliance by a hardware platform of the computer system and performing a second stage attestation on the provisioned TEE by the trusted bootloader appliance.

First claim

What is claimed is:

1. A computer-implemented method for performing a remote attestation for creation of a trusted execution environment (TEE) using a virtual secure enclave device running in a virtualized environment in a computer system, the method comprising:
in response to a request for a TEE from a software process running in the computer system, creating a TEE virtual computing instance in the computer system by the virtual secure enclave device;
provisioning a trusted bootloader appliance in the TEE virtual computing instance by the virtual secure enclave device;
performing a first stage attestation on the provisioned trusted bootloader appliance by a hardware platform of the computer system;
receiving information to be protected from the software process at the trusted bootloader appliance;
managing a provisioning of a TEE in the TEE virtual computing instance by the trusted bootloader appliance through the virtual secure enclave device with the information from the software process; and
performing a second stage attestation on the provisioned TEE by the trusted bootloader appliance, wherein the first and second stage attestations provide evidence that the TEE has been properly created with the information from the software process.

2. The method of claim 1 , wherein managing the provisioning of the TEE includes receiving memory pages and memory mapping information for the TEE from the software process at the trusted bootloader appliance to provision the TEE.

3. The method of claim 2 , further comprising receiving a transport key from the software process at the TEE virtual computing instance via the virtual secure enclave device, the transport key being used to ensure secure communication between the software process and the TEE virtual computing instance.

4. The method of claim 3 , wherein the transport key from the software process is encrypted using a shared secret key that is derived at the software process and the hardware platform of the computer system platform using a key exchange algorithm, and wherein the transport key is decrypted using the shared secret key derived at the hardware platform.

5. The method of claim 1 , wherein provisioning the trusted bootloader appliance includes creating a secure communication channel between the software process and the trusted bootloader appliance by the virtual secure enclave device.

6. The method of claim 1 , wherein performing the first stage attestation includes generating a first stage attestation report at the hardware platform and sending the first stage attestation report to the software process, and wherein performing the second stage attestation includes generating a second stage attestation report at the TEE virtual computing instance platform and sending the second stage attestation report to the software process.

7. The method of claim 6 , wherein the first stage attestation report includes a TBA measurement and a certificate from a trusted certificate authority.

8. The method of claim 6 , wherein the second stage attestation report includes a TEE measurement and a digital signature.

9. A non-transitory computer-readable storage medium containing program instructions for performing a remote attestation for creation of a trusted execution environment (TEE) using a virtual secure enclave device running in a virtualized environment in a computer system, wherein execution of the program instructions by one or more processors of the computer system causes the one or more processors to perform steps comprising:
in response to a request for a TEE from a software process running in the computer system, creating a TEE virtual computing instance in the computer system by the virtual secure enclave device;
provisioning a trusted bootloader appliance in the TEE virtual computing instance by the virtual secure enclave device;
performing a first stage attestation on the provisioned trusted bootloader appliance by a hardware of the computer system;
receiving information to be protected from the software process at the trusted bootloader appliance;
managing a provisioning of a TEE in the TEE virtual computing instance by the trusted bootloader appliance through the virtual secure enclave device with the information from the software process; and
performing a second stage attestation on the provisioned TEE by the trusted bootloader appliance, wherein the first and second stage attestations provide evidence that the TEE has been properly created with the information from the software process.

10. The computer-readable storage medium of claim 9 , wherein managing the provisioning of the TEE includes receiving memory pages and memory mapping information for the TEE from the software process at the trusted bootloader appliance to provision the TEE.

11. The computer-readable storage medium of claim 10 , wherein the steps further comprise receiving a transport key from the software process at the TEE virtual computing instance via the virtual secure enclave device, the transport key being used to ensure secure communication between the software process and the TEE virtual computing instance.

12. The computer-readable storage medium of claim 11 , wherein the transport key from the software process is encrypted using a shared secret key that is derived at the software process and the hardware platform of the computer system platform using a key exchange algorithm, and wherein the transport key is decrypted using the shared secret key derived at the hardware platform.

13. The computer-readable storage medium of claim 9 , wherein provisioning the trusted bootloader appliance includes creating a secure communication channel between the software process and the trusted bootloader appliance by the virtual secure enclave device.

14. The computer-readable storage medium of claim 9 , wherein performing the first stage attestation includes generating a first stage attestation report at the hardware platform and sending the first stage attestation report to the software process, and wherein performing the second stage attestation includes generating a second stage attestation report at the TEE virtual computing instance platform and sending the second stage attestation report to the software process.

15. The computer-readable storage medium of claim 14 , wherein the first stage attestation report includes a TBA measurement and a certificate from a trusted certificate authority.

16. The computer-readable storage medium of claim 14 , wherein the second stage attestation report includes a TEE measurement and a digital signature.

17. A computer system comprising:
memory; and
at least one processor configured to:
in response to a request for a trusted execution environment (TEE) from a software process running in the computer system, create a TEE virtual computing instance in the computer system by a virtual secure enclave device running in a virtualized environment in the computer system;
provision a trusted bootloader appliance in the TEE virtual computing instance by the virtual secure enclave device;
perform a first stage attestation on the provisioned trusted bootloader appliance by a hardware of the computer system;
receive information to be protected from the software process at the trusted bootloader appliance;
manage a provisioning of a TEE in the TEE virtual computing instance by the trusted bootloader appliance through the virtual secure enclave device with the information from the software process; and
perform a second stage attestation on the provisioned TEE by the trusted bootloader appliance, wherein the first and second st

Assignees

• Vmware Inc

Inventors

• Li Ye
• Ott David
• Laplace Cyprien
• Fainkichen Alexander
• Hiriyuru Shruthi

Classifications

• H04L9/0841

  involving Diffie-Hellman or related key agreement protocols · CPC title

• G06F21/575

  Secure boot · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• G06F2221/2149

  Restricted operating environment · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title