Method and apparatus for remotely provisioning software-based security coprocessors
A virtual security coprocessor is created in a first processing system. The virtual security coprocessor is then transferred to a second processing system, for use by the second processing system. For instance, the second processing system may use the virtual security coprocessor to provide attestation for the second processing system. In an alternative embodiment, a virtual security coprocessor from a first processing system is received at a second processing system. After receiving the virtual security coprocessor from the first processing system, the second processing system uses the virtual security coprocessor. Other embodiments are described and claimed.
1. A non-transitory machine-readable storage medium including instructions that if executed cause a processing system to:
create a virtual trusted platform module for a virtual machine of the processing system;
generate, based on an endorsement key of the virtual trusted platform module, an endorsement credential for the virtual trusted platform module;
generate a platform credential for the virtual trusted platform module;
store the endorsement credential in a memory associated with the virtual trusted platform module; and
store the platform credential in the memory associated with the virtual trusted platform module.
2. The medium of claim 1 , wherein the instructions if executed further cause the processing system to encrypt a state of the virtual trusted platform module, the state including the endorsement key.
3. The medium of claim 2 , wherein the instructions if executed further cause the processing system to migrate the virtual trusted platform module to a second server of the processing system for use by the second server.
4. The medium of claim 3 , wherein the instructions if executed further cause the processing system to move the encrypted state to the second server during the migration.
5. The medium of claim 3 , wherein the instructions if executed further cause the processing system to delete a record of the virtual trusted platform module from the processing system after the migration.
6. The medium of claim 1 , wherein the endorsement credential is stored in a non-volatile memory associated with the virtual trusted platform module.
7. The medium of claim 1 , wherein the instructions if executed further cause the processing system to sign the endorsement credential with a migratable manufacturer key.
8. A method comprising:
creating a virtual trusted platform module for a virtual machine of a first server of a processing system;
generating, based on an endorsement key of the virtual trusted platform module, an endorsement credential for the virtual trusted platform module;
generating a platform credential for the virtual trusted platform module;
storing the endorsement credential in a memory associated with the virtual trusted platform module; and
storing the platform credential in the memory associated with the virtual trusted platform module.
9. The method of claim 8 , further comprising encrypting a state of the virtual trusted platform module, the state including the endorsement key.
10. The method of claim 9 , further comprising migrating the virtual trusted platform module to a second server of the processing system for use by the second server.
11. The method of claim 10 , further comprising moving the encrypted state to the second server during the migration.
12. The method of claim 10 , further comprising deleting a record of the virtual trusted platform module from the first server after the migration.
13. The method of claim 8 , further comprising storing the endorsement credential in a non-volatile memory associated with the virtual trusted platform module.
14. The method of claim 8 , further comprising signing the endorsement credential with a migratable manufacturer key.
15. A system comprising:
a first system including at least one first processor and at least one first memory, wherein the first system is configured to:
create a virtual trusted platform module for a virtual machine;
generate, based on an endorsement key of the virtual trusted platform module, an endorsement credential for the virtual trusted platform module;
generate a platform credential for the virtual trusted platform module;
store the endorsement credential in a memory associated with the virtual trusted platform module; and
store the platform credential in the memory associated with the virtual trusted platform.
16. The system of claim 15 , further comprising a second system coupled to the first system and including at least one second processor and at least one second memory.
17. The system of claim 16 , wherein the first system is to migrate the virtual trusted platform module to a second server of the processing system for use by the second server.
18. The system of claim 17 , wherein the first system is to delete a record of the virtual trusted platform module from the first system after the migration.
19. An apparatus comprising:
a processor configured to:
create a virtual trusted platform module for a virtual machine;
generate, based on an endorsement key of the virtual trusted platform module, an endorsement credential for the virtual trusted platform module;
generate a platform credential for the virtual trusted platform module;
store the endorsement credential in a memory associated with the virtual trusted platform module; and
store the platform credential in the memory associated with the virtual trusted platform.
20. The apparatus of claim 19 , wherein the processor is further configured to migrate the virtual trusted platform module from a first processing system to a second processing system for use by the second processing system.
21. The apparatus of claim 20 , wherein the processor is further configured to delete a record of the virtual trusted platform module from the first processing system after the migration.
22. The apparatus of claim 19 , wherein the processor is further configured to encrypt a state of the virtual trusted platform module, the state including the endorsement key.