Secure network cloud architecture

1. A method comprising:

receiving by a secure boot server controlled by a tenant of a cloud provider data center, a request from a virtual machine to download components configured to boot the virtual machine, wherein the request includes at least a first token;

transmitting, by the secure boot server to a first computing system, the first token;

receiving, by the secure boot server from the first computing system, a second token indicating authorization to transmit unique components to the virtual machine in response to the request to download components;

generating, by the secure boot server, unique components comprising at least one of: unique identifier, configuration settings, and unique data elements; and

transmitting, by the secure boot server to the virtual machine, the unique components and the second token to initialize a boot process on the virtual machine,

wherein the secure boot server is located within a tenant-controlled cloud demilitarized zone (DMZ) at the cloud provider data center and the virtual machine is located outside the tenant-controlled cloud demilitarized zone (DMZ) at the cloud provider data center,

wherein the unique components comprise a unique initial ramdisk associated with the tenant of the cloud provider data center, and

wherein the unique initial ramdisk comprises a public cryptographic key associated with a corresponding unique private key stored with the secure boot server.

2. The method of claim 1 , wherein the unique components further comprise binaries, and wherein the unique data elements comprise a cryptographic material generated for one-time use.

3. The method of claim 1 , wherein the unique identifier comprises a network address, and wherein the unique data elements comprise a unique cryptographic material.

4. The method of claim 1 , further comprising:

receiving, by a gateway server from the virtual machine, a third token and confidential information indicating authorization from the first computing system to create a secure channel with the virtual machine via the gateway server;

transmitting, by the gateway server to the first computing system, the third token to confirm authenticity of the received third token to a recorded third token at the first computing system; and

establishing, by the gateway server, the secure channel between the virtual machine and the first computing system, wherein the gateway server is also located within the tenant-controlled cloud demilitarized zone (DMZ) at the cloud provider data center.

5. The method of claim 4 , wherein the first token, second token, third token, and confidential information are each randomly generated for one-time use.

6. The method of claim 4 , wherein the confidential information includes a cryptographic key.

7. The method of claim 4 , wherein the confidential information includes a digital certificate.

8. The method of claim 4 , wherein the confidential information includes a unique user account.

9. The method of claim 1 , wherein the virtual machine is a measured virtual machine, and authenticity of the virtual machine is determined using a quote generated based on a measurement of the measured virtual machine.

10. The method of claim 1 , wherein the cloud demilitarized zone (DMZ) is protected by an external firewall and an internal firewall, and wherein the new virtual machine is hosted outside of the firewalls.

11. A cloud computing system comprising at least a secure boot server and a gateway server, the system comprising:

at least one processor; and

at least one memory storing computer executable instructions that, when executed by the at least one processor, cause the system at least to:

receive, by a secure boot server controlled by a tenant of a cloud provider data center, a request from a virtual machine to download components configured to boot the virtual machine, wherein the request includes at least a first token;

transmit, by the secure boot server to a first computing system, the first token after receiving the request from the virtual machine to download components;

receive, by the secure boot server from the first computing system, a second token indicating authorization to transmit unique components to the virtual machine in response to the request to download components;

transmit, by the secure boot server to the virtual machine, the unique components and the second token to initialize a boot process on the virtual machine;

receive, by the gateway server from the virtual machine, a third token and a confidential information indicating authorization from the first computing system to create a secure channel with the virtual machine via the gateway server;

transmit, by the gateway server to the first computing system, the third token to confirm authenticity of the received third token to a recorded third token at the first computing system; and

establish, by the gateway server, the secure channel between the virtual machine and the first computing system,

wherein the secure boot server and the gateway server are located within a tenant-controlled cloud demilitarized zone (DMZ) at the cloud provider data center and the virtual machine is located outside the tenant-controlled cloud demilitarized zone (DMZ) at the cloud provider data center,

wherein the unique components comprise a unique initial ramdisk associated with the tenant of the cloud provider data center, and

wherein the unique initial ramdisk comprises a public cryptographic key associated with a corresponding unique private key stored with the secure boot server.

12. The system of claim 11 , wherein the at least one memory further stores computer executable instructions that, when executed by the at least one processor, cause the system at least to:

generate, by the secure boot server, the unique components, wherein the unique components further comprise at least one of: unique identifier, unique data elements, and configuration settings.

13. The system of claim 11 , wherein the unique components further include an operating system kernel.

14. The system of claim 11 , wherein the first token, second token, third token, and confidential information are each randomly generated for one-time use.

15. The system of claim 11 , wherein the tenant-controlled cloud demilitarized zone (DMZ) further comprises:

an internal firewall configured to regulate network traffic;

an external firewall configured to regulate network traffic;

at least one network access control device; and

a portion of a cloud orchestrator system.

16. A non-transitory computer-readable storage medium storing computer-executable instructions, which when executed by a secure boot server controlled by a tenant of a cloud provider data center, cause the secure boot server to at least:

receive, from a virtual machine, a request to download components configured to boot the virtual machine, wherein the request includes at least a first token;

transmit, to a first computing system, the first token;

receive, from the first computing system, a second token indicating authorization to transmit unique components to the virtual machine in response to the request to download components; and

transmit, to the virtual machine, the unique components and the second token to initialize a boot process on the virtual machine,

wherein the secure boot server is located within a tenant-controlled cloud demilitarized zone (DMZ) at the cloud provider data center, and the virtual machine is located outside the tenant-controlled cloud demilitarized zone (DMZ) at the cloud provider data center,

wherein the unique components comprise a unique initial ramdisk associated with the tenant of the cloud provider data center, and

wherein the unique initial ramdisk comprises a public cryptographic key associated with a corresponding unique private key stored with the secure boot server.

17. The storage medium of claim 16 , further storing computer-executable instructions, which when executed by the secure boot server, cause the secure boot server to at least:

generate the unique components, wherein the unique components further comprise at least one of: unique identifier, configuration settings, and unique data elements,

wherein the unique components further comprise binaries, and

wherein the unique data elements comprise a cryptographic material generated for one-time use.

18. The storage medium of claim 17 , wherein the unique identifier comprises a network address, and wherein the unique data elements comprise a unique cryptographic material.

19. The storage medium of claim 16 , further storing computer-executable instructions, which when executed by the secure boot server, cause the secure boot server to at least:

receive, by a gateway server from the virtual machine, a third token and confidential information indicating authorization from the first computing system to create a secure channel with the virtual machine via the gateway server;

transmit, by the gateway server to the first computing system, the third token to confirm authenticity of the received third token to a recorded third token at the first computing system; and

establish, by the gateway server, the secure channel between the virtual machine and the first computing system, wherein the gateway server is also located within the tenant-controlled cloud demilitarized zone (DMZ) at the cloud provider data center.

20. The storage medium of claim 19 , wherein the first token, second token, third token, and confidential information are each randomly generated for one-time use.

21. The storage medium of claim 19 , wherein the confidential information includes a cryptographic key.

22. The storage medium of claim 19 , wherein the confidential information includes a digital certificate.

23. The storage medium of claim 16 , wherein the virtual machine is a measured virtual machine, and authenticity of the virtual machine is determined using a quote generated based on a measurement of the measured virtual machine.