Secure delivery and deployment of a virtual environment
A secured container provides access to enterprise data while isolated from the operating system of an Information Handling System (IHS). The secured container remains secured during its delivery and deployment. A secured container is configured to provide a user of the IHS with access to enterprise data. The secured container is encrypted using a symmetrical key that is transmitted to a secured storage that is isolated from the operating system of the IHS via out-of-band communications. The encrypted secured container is digitally signed using an asymmetric key pair. The digital signature and the encrypted secured container are transmitted to the IHS via in-band communications. At the IHS, the public key of the asymmetric key pair is used to validate the digital signature and the private symmetric key is retrieved from secured storage to decrypt the secured container. Additional embodiments provide a technique for securely migrating a secured container between IHSs.
1. A method for migrating a secured container from a first IHS (Information Handling System) to a second IHS, the method comprising:
encrypting, at the first IHS, the secured container using a symmetric migration key;
encrypting, at the first IHS, the migration key and a list of allowed migration hosts;
transmitting the encrypted migration key and the encrypted list of allowed migration hosts from the first IHS to a verifying authority;
transmitting the encrypted secured container from the first IHS to the second IHS;
receiving, at the second IHS, the migration key from the verifying authority upon authentication of the second IHS by the verifying authority and upon confirmation the second IHS is identified in the list of allowed hosts; and
decrypting, at the second IHS, the secured container using the migration key.
2. The method of claim 1 , wherein the migration key and a list of allowed migration hosts are encrypted using a public key of the verifying authority.
3. The method of claim 2 , wherein the transmissions by the first IHS and the second IHS to the verifying authority are digitally signed.
4. The method of claim 2 , further comprising launching the secured container on the second IHS.
5. The method of claim 1 , wherein the secured container is a virtual machine.