Implementing network security policies using TPM-based credentials

Patent metadata

Field	Value
Publication number	US-9935937-B1
Application number	US-201414533395-A
Country	US
Kind code	B1
Filing date	Nov 5, 2014
Priority date	Nov 5, 2014
Publication date	Apr 3, 2018
Grant date	Apr 3, 2018

Abstract

A method for implementing network security policies in a multi-tenant network environment may include receiving a request for implementation of at least one network security policy on one or more computing devices of a service provider cloud environment. The network security policy identified by the request may be retrieved. The network security policy may be encrypted using encrypting credentials of the one or more computing devices. Decrypting credentials corresponding to the encrypting credentials are stored in a Trusted Platform Module (TPM) within the one or more computing devices. The encrypted network security policy may be pushed to the one or more computing devices, for decryption and implementation at the one or more computing devices.

First claim

What is claimed is:

1. A computer-readable storage medium including instructions that upon execution cause a computer system to:
receive, by the computer system, a request for implementation of at least one network security policy on one or more other computing devices of a service provider cloud environment;
retrieve, by the computer system, the network security policy identified by the request, wherein the network security policy comprises secure cryptographic keys for establishing secure network connections with different computing devices;
encrypt, by the computer system, the network security policy using encrypting credentials of the one or more computing devices, wherein decrypting credentials, comprising private cryptographic keys, corresponding to the encrypting credentials are stored in a Trusted Platform Module (TPM) within the one or more computing devices; and
push, by the computer system, the encrypted network security policy to the one or more computing devices, for decryption of the encrypted network security policy using the private cryptographic keys stored in the TMPs within the one or more computing devices, and for implementation of the network security policy at the one or more computing devices;
wherein the secure cryptographic keys are usable by the one or more computing devices to establish secure network connections with the different computing devices.

2. The computer-readable storage medium according to claim 1 , wherein the one or more computing devices comprise a server computer hosting one or more virtual machine instances associated with a customer entity account, and the request is for implementation of the at least one network security policy at the server computer hosting the one or more virtual machine instances.

3. The computer-readable storage medium according to claim 2 , wherein the instructions, upon execution further cause the computer system to:
verify the one or more virtual machine instances running on the server computer are associated with the customer entity account.

4. The computer-readable storage medium according to claim 1 , wherein the request identifies at least one of a plurality of virtual machine instances running on at least one of the computing devices, the network security policy for implementation at the identified virtual machine instance.

5. The computer-readable storage medium according to claim 1 , wherein the request identifies a plurality of virtual machine instances running on a computing device, wherein each virtual machine instance comprises a TPM that is implemented as software running on a hypervisor associated with its respective virtual machine instance.

6. The computer-readable storage medium according to claim 1 , further including:
receiving a confirmation from the one or more computing devices of decryption and implementation of the network security policy at the one or more computing devices.

7. The computer-readable storage medium according to claim 1 , wherein the network security policy comprises at least one of:
one or more Internet Protocol Security (IPSec) keys;
one or more network protocol settings;
one or more firewall settings or rules;
one or more Access Control Lists (ACLs);
bandwidth usage rules;
rules specifying restrictions of communications to/from instances or between instances;
type of packets allowed for communication between instances; or
meta-language description of communication restrictions.

8. The computer-readable storage medium according to claim 1 , wherein the instructions, upon execution further cause the computer system to:
receive, from a computing device of the one or more computing devices, an original hash of the network security policy as initially implemented at the computing device;
send, to the computing device, a request for a current hash of the network security policy implemented at the computing device;
receive, from the computing device, the current hash of the network security policy implemented at the computing device;
verify the current hash against the original hash; and
output an indication of whether the current hash matches the original hash.

9. A method for implementing network security policies at a computing device of a service provider, the method comprising:
receiving from a policy administration service running on a different computing device of the service provider, an encrypted network security policy, wherein the encrypted network security policy comprises a secure cryptographic key for establishing a secure network connection with a different computing device;
acquiring one or more authentication credentials, comprising private cryptographic keys, from a Trusted Platform Module (TPM) within the computing device;
decrypting the network security policy by a security agent of the computing device, the decrypting using the one or more authentication credentials associated with the security agent and the policy administration service, wherein the security agent is in an established trusted communication with the policy administration service;
implementing by the security agent, the decrypted network security policy at the computing device, comprising:
installing the secure cryptographic key; and
establishing a secure network connection with the different computing device using the secure cryptographic key; and

communicating a confirmation of successful implementation of the network security policy to the policy administration service.

10. The method according to claim 9 , comprising:
verifying a signature of the policy administration service using the one or more authentication credentials.

11. The method according to claim 9 , wherein the authentication credentials comprise at least one of a public-private key pair or a multi-level set of secure keys.

12. The method according to claim 9 , wherein the network security policy is associated with one or more virtual machine instances running on the computing device.

13. The method according to claim 9 , wherein the network security policy is associated with a plurality of virtual machine instances running on the computing device, wherein each virtual machine instance comprises a TPM that stores authentication credentials and is implemented as software running on a hypervisor of its respective virtual machine instance.

14. The method according to claim 9 , comprising:
sending to the policy administration service, a confirmation of successful implementation of the network security policy at the computing device.

15. The method according to claim 14 , wherein the confirmation comprises a first hash of the network security policy as implemented at the computing device.

16. The method according to claim 15 , comprising:
in response to a request from the policy administration service for verifying the network security policy, requesting a second hash of the network security policy from the computing device, the second hash for comparing to the first hash to perform the verifying.

17. The method according to claim 9 , comprising:
receiving a request from the policy administration service for verifying the network security policy implemented at the computing device;
in response to the request:
generating a hash value of the network security policy implemented at the computing device;
encrypt the generated hash value using a public key from the TPM;
signing the encrypted hash value using a private key; and
sending the signed encrypted hash value to the policy administration service.

18. The method according to claim 9 , wherein the sec

Assignees

• Amazon Tech Inc

Inventors

• Potlapally Nachiketh Rao
• Lucas Alexander Robin Gordon

Classifications

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title