Clustered virtual trusted platform module domain services system

Patent metadata

Field	Value
Publication number	US-12309294-B2
Application number	US-202217728579-A
Country	US
Kind code	B2
Filing date	Apr 25, 2022
Priority date	Apr 25, 2022
Publication date	May 20, 2025
Grant date	May 20, 2025

Abstract

An information handling system includes a virtual trusted platform module (TPM) consumer associated with a virtual machine. The virtual TPM (vTPM) consumer may consume TPM services from a clustered vTPM domain service and determine the connection information of the vTPM domain service. The vTPM consumer transmits a connection request for a TPM operation request to the vTPM domain service, wherein the connection request includes a payload in addition to the connection information. The consumer may also receive a response associated with the TPM operation request from the vTPM domain service.

First claim

What is claimed is:

1. An information handling system, comprising:
a trusted platform module (TPM); and
a virtual TPM (vTPM) domain service that is further configured with at least two TPM servers providing a root of trust that is cross-signed by each one of the at least two TPM servers, the vTPM domain service is configured to:
receive a connection request for a TPM operation from a TPM-vTPM, wherein the TPM-vTPM is configured to connect and consume TPM functionality of the vTPM domain service; and
transmit a response associated with the TPM operation to the TPM-vTPM.

2. The information handling system of claim 1 , wherein the TPM operation is performed by a vTPM instance linked with a virtual machine that is associated with the TPM-vTPM.

3. The information handling system of claim 1 , wherein the connection request is to consume an application programming interface published by the vTPM domain service.

4. The information handling system of claim 3 , wherein the application programming interface published by the vTPM domain service comports with TPM application programming interfaces published by a trusted computing group.

5. The information handling system of claim 3 , wherein the application programming interface published by the vTPM configured as a domain service supports a second application programming interface of a hardware TPM.

6. The information handling system of claim 1 , wherein the root of trust is provided to a virtual machine associated with the TPM-vTPM.

7. The information handling system of claim 1 , wherein the TPM is further configured to sign a vTPM certificate authority certificate.

8. The information handling system of claim 1 , wherein the at least two TPM servers are configured as a cluster.

9. The information handling system of claim 1 , wherein the vTPM domain service is clustered.

10. The information handling system of claim 1 , the vTPM domain service is further configured to generate a vTPM identifier to be used for the connection request.

11. The information handling system of claim 1 , the TPM operation is to migrate a virtual machine from the vTPM domain service to a second vTPM domain service.

12. An information handling system, comprising:
a processor configured to host a virtual machine;
a memory including a trusted platform module (TPM)—virtual trusted platform module (vTPM) associated with the virtual machine, wherein the TPM-vTPM is configured to consume services provided by a hardware TPM via a vTPM domain service, wherein the TPM-vTPM is configured to:
determine connection information of the vTPM domain service;
transmit a connection request for a TPM operation to the vTPM domain service, wherein the connection request includes the connection information and a root certificate that is cross-signed by each one of at least two TPM servers associated with the hardware TPM and the vTPM domain service; and
receive a response associated with the connection request for the TPM operation from the vTPM domain service.

13. The information handling system of claim 12 , wherein the connection information includes an internet protocol address associated with the vTPM domain service.

14. The information handling system of claim 12 , further comprising determining an identifier associated with the vTPM domain service.

15. The information handling system of claim 12 , wherein the root certificate is a public key infrastructure certificate that was retrieved from the vTPM domain service prior to the TPM operation.

16. The information handling system of claim 12 , wherein the vTPM domain service verifies that a status of the connection request is a success prior to performing the TPM operation.

17. A method comprising:
determining, by a processor, connection information of a virtual trusted platform module (vTPM) domain service;
determining an identifier of the vTPM domain service;
transmitting, by a trusted platform module (TPM)-vTPM a connection request for a TPM operation to the vTPM domain service, wherein the connection request includes the connection information and a root certificate that is cross-signed by each one of at least two TPM servers associated with a hardware TPM and the vTPM domain service; and
receiving a response associated with the TPM operation from the vTPM domain service.

18. The method of claim 17 , wherein the connection information is an internet protocol address of the vTPM domain service.

19. The method of claim 17 , wherein the root certificate is a public key infrastructure certificate that was retrieved from the vTPM domain service prior to the TPM operation.

20. The method of claim 17 , wherein the vTPM domain service verifies that a status of the connection request is a success prior to performing the TPM operation.

Assignees

• Dell Products Lp

Inventors

• Mackenbach Jeroen
• Boyapalle Anantha K
• Terpstra John Henry

Classifications

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• G06F21/71

  to assure secure computing or processing of information · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title