Dynamic derivation and verification of the measurement of a computing environment
A method and a system for dynamically deriving and verifying a measure of a computing environment is presented. The proposed method and system are used to reliably verify measurements of the computing environment. The method includes receiving a dataset recorded by an untrusted source describing elements used to create a computing system operating in a computing environment, receiving attestation evidence generated by a trusted source including an initial measurement value describing the elements of the computing system, deriving a measurement value based on the received dataset, and performing a verification process on a measurement of the computing environment. The verification process is performed by comparing the derived measurement value with the measurement value of the attestation evidence. In response to the comparison of the derived measurement value with the measure value of the attestation evidence being equal, trustworthiness of the computing environment is determined.
1 . A computer implemented method for verifying trustworthiness of a virtual environment configured to execute applications on a guest operating system, the method comprising:
receiving, at a secure computing environment implemented by one or more processors, a dataset recorded by an untrusted source, the dataset comprising parameters and commands used to create a virtual environment configured to execute applications on a guest operating system;
receiving attestation evidence generated by a trusted source operating within a trusted execution environment that is distinct from the secure computing environment, the attestation evidence describing a post-creation state of the virtual environment and comprising an initial measurement value, wherein the initial measurement value is a cryptographic hash computed by the trusted source using at least some of the parameters and commands used during creation of the virtual environment;
deriving at the secure computing environment, a derived measurement value, wherein the derived measurement value is a cryptographic hash computed by the secure computing environment using at least some of the parameters and commands included in the received dataset; and
performing a verification process by:
comparing the derived measurement value with the initial measurement value included in the attestation evidence; and
in response to determining that the derived measurement value satisfies a matching criterion with respect to the initial measurement value, generating a verification result indicating trustworthiness of the virtual environment.
2 . The method of claim 1 , further comprising, upon completion of performing the verification process on the attestation evidence, sending a verification result that includes a result of the comparison of the derived measurement value with the initial measurement value to the virtual environment.
3 . The method of claim 1 , wherein performing the verification process further comprises applying a policy to the received dataset and the initial measurement value to determine that each of a plurality of elements of the received dataset lies within a predetermined range of values.
4 . The method of claim 1 , wherein the dataset includes entries recorded in order of occurrence during creation of the computing system, and wherein deriving the derived measurement value includes iterating through the entries recorded in order of occurrence and computing the derived measurement value based on the entries.
5 . The method of claim 1 , wherein elements of the dataset include one or more of a version of a dataset recorder, environment information, configuration data, parameters, commands, memory range, and data range.
6 . The method of claim 1 , wherein the untrusted source is a hypervisor and virtual machine manager (VMM).
7 . The method of claim 1 , wherein the trusted source is a management monitor that operates in a trusted execution environment.
8 . The method of claim 1 , wherein deriving the derived measurement value further utilizes information stored in an external source.
9 . The method of claim 1 , wherein the virtual environment comprises a virtual machine instantiated during the creation of the virtual environment, and wherein the attestation evidence describes a state of the virtual machine after creation.
10 . The method of claim 1 , wherein the attestation evidence generated by the trusted source further includes a further measurement value corresponding to secondary data, and wherein the secondary data describes elements not represented in the initial measurement value.
11 . The method of claim 10 , further comprising:
receiving a further measurement value of secondary data in the attestation evidence;
deriving a derived second measurement value from the secondary data received in the attestation evidence; and
performing a further verification process by:
comparing the derived second measurement value with the further measurement value, and
in response to determining that the derived second measurement value satisfies a matching criterion with respect to the further measurement value, determining trustworthiness of the virtual environment configured to execute applications on a guest operating system.
12 . A system for dynamic derivation and verification of trustworthiness of a virtual environment configured to execute applications on a guest operating system, comprising:
an attestation verification system, comprising:
a measurement deriver coupled to receive a dataset recorded by an untrusted source, the measurement deriver being configured to derive a derived measurement value from the received dataset, wherein the derived measurement value is a cryptographic hash computed using at least some parameters and commands included in the received dataset; and
a verifier coupled to receive the derived measurement value and an initial measurement value included in attestation evidence generated by a trusted source, the trusted source operating within a trusted execution environment that is distinct from the attestation verification system, the attestation evidence describing a state of the virtual environment after creation, wherein the initial measurement value is a cryptographic hash computed by the trusted source using at least some of the parameters and commands used during creation of the virtual environment,
wherein the verifier compares the derived measurement value with the initial measurement value received in the attestation evidence to generate a verification result indicating trustworthiness of the virtual environment after creation when the derived measurement value satisfies a matching criterion with respect to the initial measurement value, wherein the virtual environment is configured to execute applications on a guest operating system.
13 . The system of claim 12 , further comprising a dataset recorder operating as the untrusted source and configured to record the dataset, wherein the dataset includes elements used to create the virtual environment.
14 . The system of claim 13 , wherein elements of the dataset include one or more of a version of a dataset recorder, environment information, configuration data, parameters, commands, memory range, and data range.
15 . The system of claim 14 , wherein the elements of the dataset are recorded in order during creation of the virtual environment.
16 . The system of claim 13 , wherein the dataset recorder operates in an untrusted environment.
17 . The system of claim 13 , wherein the dataset recorder comprises a hypervisor or virtual machine manager (VMM) operating in an untrusted environment.
18 . The system of claim 12 , wherein the virtual environment comprises a virtual machine instantiated during creation of the virtual environment configured to execute applications on a guest operating system.