Method and apparatus for remotely provisioning software-based security coprocessors
View Patent ↗A virtual security coprocessor is created in a first processing system. The virtual security coprocessor is then transferred to a second processing system, for use by the second processing system. For instance, the second processing system may use the virtual security coprocessor to provide attestation for the second processing system. In an alternative embodiment, a virtual security coprocessor from a first processing system is received at a second processing system. After receiving the virtual security coprocessor from the first processing system, the second processing system uses the virtual security coprocessor. Other embodiments are described and claimed.
1. At least one non-transitory machine-readable storage medium including instructions that if executed cause a first processing system to:
create a first virtual trusted platform module for a first virtual machine (VM) of the first processing system, the first processing system including a physical trusted platform module, at least one processing unit, memory, and an interface to communicate with a second processing system, the first processing system to implement a virtual machine monitor (VMM), the VMM to enable a plurality of VMs including the first VM to share resources of the first processing system, one of the plurality of VMs to run a first guest operating system and another of the plurality of VMs to run a second guest operating system;
facilitate creation of an endorsement key for the first virtual trusted platform module, wherein the endorsement key is to be stored in a storage; and
migrate the first virtual trusted platform module to the second processing system, the first virtual trusted platform module migration to send a state of the first virtual trusted platform module to the second processing system, the state of the first virtual trusted platform module including the endorsement key.
2. The at least one non-transitory machine-readable storage medium of claim 1 , wherein at least one of the first guest operating system and the second guest operating system comprises a legacy operating system.
3. The at least one non-transitory machine-readable storage medium of claim 1 , wherein at least one of the first guest operating system and the second guest operating system comprises a protected operating system.
4. The at least one non-transitory machine-readable storage medium of claim 1 , wherein the storage is communicatively coupled to the at least one processing unit.
5. The at least one non-transitory machine-readable storage medium of claim 1 , wherein the storage comprises a persistent storage.
6. The at least one machine-readable storage medium of claim 1 , wherein the instructions if executed further cause the first processing system to:
generate, based on the endorsement key for the first virtual trusted platform module, an endorsement credential for the first virtual trusted platform module; and
store the endorsement credential in the storage.
7. The at least one machine-readable storage medium of claim 6 , wherein the instructions if executed further cause the first processing system to:
generate a platform credential for the first virtual trusted platform module; and
store the platform credential in the storage.
8. The at least one machine-readable storage medium of claim 1 , wherein the instructions if executed further cause the first processing system to encrypt the state of the first virtual trusted platform module.
9. The at least one machine-readable storage medium of claim 8 , wherein the instructions if executed further cause the first processing system to move the encrypted state to the second processing system during the first virtual trusted platform module migration.
10. The at least one machine-readable storage medium of claim 1 , wherein the instructions if executed further cause the first processing system to delete a record of the first virtual trusted platform module from the first processing system after the first virtual trusted platform module migration.
11. A system comprising:
at least one processing unit;
a physical trusted platform module coupled to the at least one processing unit;
a memory coupled to the at least one processing unit;
an interface to communicate with a second system;
at least one computer readable medium including instructions that enable the at least one processing unit to create a first virtual trusted platform module for a first virtual machine, facilitate creation of an endorsement key for the first virtual trusted platform module, wherein the endorsement key is to be stored in a storage, and migrate the first virtual trusted platform module to the second system, the first virtual trusted platform module migration to send a state of the first virtual trusted platform module to the second system, the state of the first virtual trusted platform module including the endorsement key.
12. The system of claim 11 , wherein the storage is communicatively coupled to the at least one processing unit.
13. The system of claim 11 , wherein the storage comprises a general use persistent storage.
14. The system of claim 11 , wherein the storage comprises a remote storage device.
15. The system of claim 11 , wherein the storage comprises one or more of a read-only memory, a mass storage device, an optical storage and a flash memory.
16. A method comprising:
creating a first virtual trusted platform module for a first virtual machine (VM) of a first processing system, the first processing system including a physical trusted platform module, at least one processing unit, memory, and an interface to communicate with a second processing system, the first processing system to implement a virtual machine monitor (VMM), the VMM to enable a plurality of VMs including the first VM to share resources of the first processing system, one of the plurality of VMs to run a first guest operating system and another of the plurality of VMs to run a second guest operating system;
facilitating creation of an endorsement key for the first virtual trusted platform module, and storing the endorsement key in a storage; and
migrating the first virtual trusted platform module to the second processing system, the first virtual trusted platform module migration to send a state of the first virtual trusted platform module to the second processing system, the state of the first virtual trusted platform module including the endorsement key.
17. The method of claim 16 , further comprising:
generating, based on the endorsement key for the first virtual trusted platform module, an endorsement credential for the first virtual trusted platform module;
storing the endorsement credential in the storage;
generating a platform credential for the first virtual trusted platform module; and
storing the platform credential in the storage.
18. The method of claim 16 , further comprising:
encrypting the state of the first virtual trusted platform module; and
moving the encrypted state to the second processing system during the first virtual trusted platform module migration.
19. The method of claim 18 , further comprising moving the encrypted state to the second processing system during the first virtual trusted platform module migration.
20. The method claim 16 , further comprising deleting a record of the first virtual trusted platform module from the first processing system after the first virtual trusted platform module migration.