Pre-boot authentication for virtual machines using credentials stored in virtual trusted platform modules

Patent metadata

Field	Value
Publication number	US-11829482-B2
Application number	US-202117381337-A
Country	US
Kind code	B2
Filing date	Jul 21, 2021
Priority date	Jun 8, 2021
Publication date	Nov 28, 2023
Grant date	Nov 28, 2023

Abstract

An apparatus comprises a processing device configured to receive, at a host operating system of a virtual machine host, a request to execute a virtual machine and to obtain, from a virtual trusted platform module running on the virtual machine host, credentials for logging in to a guest operating system of the virtual machine. The processing device is further configured to provide, to pre-boot authentication software associated with the virtual machine, the credentials obtained from the virtual trusted platform module, and to automatically log in to the guest operating system of the virtual machine utilizing the pre-boot authentication software and the provided credentials.

First claim

What is claimed is:

1. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to perform steps of:
receiving, at a host operating system of a virtual machine host, a request to execute a virtual machine;
obtaining, from a virtual trusted platform module running on the virtual machine host and external to the virtual machine, credentials for logging in to a guest operating system of the virtual machine;
providing, to pre-boot authentication software associated with the virtual machine, the credentials obtained from the virtual trusted platform module; and
automatically logging in to the guest operating system of the virtual machine utilizing the pre-boot authentication software and the provided credentials.

2. The apparatus of claim 1 wherein the virtual machine host comprises a bare metal hypervisor running on a host device.

3. The apparatus of claim 1 wherein the virtual machine host comprises a hypervisor running within the host operating system.

4. The apparatus of claim 1 wherein the virtual machine host comprises a hypervisor running within another virtual machine.

5. The apparatus of claim 1 wherein the virtual machine comprises a nested virtual machine that executes inside of a virtualized computing environment of the virtual machine host.

6. The apparatus of claim 5 wherein the nested virtual machine is installed on a root virtual machine of the virtualized computing environment.

7. The apparatus of claim 1 wherein the credentials comprise access credentials for a given user in a given domain, and wherein the access credentials for the given user in the given domain are the same for the host operating system of the virtual machine host and the guest operating system of the virtual machine.

8. The apparatus of claim 1 wherein the credentials comprise single sign-on credentials provided via an authentication server external to the virtual machine host.

9. The apparatus of claim 8 wherein the credentials comprise a token generated by the authentication server external to the virtual machine host.

10. The apparatus of claim 9 wherein the token is stored in encrypted form in the virtual trusted platform module utilizing a secret key of the virtual trusted platform module.

11. The apparatus of claim 1 wherein the credentials comprise local user authentication credentials.

12. The apparatus of claim 11 wherein the local user authentication credentials comprise lightweight directory access protocol authentication credentials.

13. The apparatus of claim 1 wherein the credentials comprise a private key generated by the pre-boot authentication software during a previous boot of the virtual machine, and wherein the private key is stored in encrypted form in the virtual trusted platform module utilizing a secret key of the virtual trusted platform module.

14. The apparatus of claim 1 wherein providing the credentials obtained from the virtual trusted platform module to the pre-boot authentication software running on the virtual machine comprises:
creating a user authentication tunnel between the virtual trusted platform module and the virtual machine; and
passing the credentials over the user authentication tunnel between the virtual trusted platform module and the virtual machine.

15. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform steps of:
receiving, at a host operating system of a virtual machine host, a request to execute a virtual machine;
obtaining, from a virtual trusted platform module running on the virtual machine host and external to the virtual machine, credentials for logging in to a guest operating system of the virtual machine;
providing, to pre-boot authentication software associated with the virtual machine, the credentials obtained from the virtual trusted platform module; and
automatically logging in to the guest operating system of the virtual machine utilizing the pre-boot authentication software and the provided credentials.

16. The computer program product of claim 15 wherein the credentials comprise a private key generated by the pre-boot authentication software during a previous boot of the virtual machine, and wherein the private key is stored in encrypted form in the virtual trusted platform module utilizing a secret key of the virtual trusted platform module.

17. The computer program product of claim 15 wherein providing the credentials obtained from the virtual trusted platform module to the pre-boot authentication software running on the virtual machine comprises:
creating a user authentication tunnel between the virtual trusted platform module and the virtual machine; and
passing the credentials over the user authentication tunnel between the virtual trusted platform module and the virtual machine.

18. A method comprising:
receiving, at a host operating system of a virtual machine host, a request to execute a virtual machine;
obtaining, from a virtual trusted platform module running on the virtual machine host and external to the virtual machine, credentials for logging in to a guest operating system of the virtual machine;
providing, to pre-boot authentication software associated with the virtual machine, the credentials obtained from the virtual trusted platform module; and
automatically logging in to the guest operating system of the virtual machine utilizing the pre-boot authentication software and the provided credentials;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

19. The method of claim 18 wherein the credentials comprise a private key generated by the pre-boot authentication software during a previous boot of the virtual machine, and wherein the private key is stored in encrypted form in the virtual trusted platform module utilizing a secret key of the virtual trusted platform module.

20. The method of claim 18 wherein providing the credentials obtained from the virtual trusted platform module to the pre-boot authentication software running on the virtual machine comprises:
creating a user authentication tunnel between the virtual trusted platform module and the virtual machine; and
passing the credentials over the user authentication tunnel between the virtual trusted platform module and the virtual machine.

Assignees

• Dell Products Lp

Inventors

• Sethi Parminder Singh
• Kumar Suren

Classifications

• G06F21/575 Primary

  Secure boot · CPC title

• G06F9/45545

  Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/31

  User authentication · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title