Protection of a secured application in a cluster
An information handling system may include at least one processor; and a memory coupled to the at least one processor. The information handling system may be configured to: execute an application on the at least one processor, wherein at least a portion of data of the application is stored encrypted in a secure enclave region of the memory; and securely transfer execution of the application to a second information handling system by: transmitting platform configuration register (PCR) measurement data to the second information handling system; and transmitting the data of the application to the second information handling system; wherein the PCR measurement data is usable by the second information handling system to perform a remote attestation, the remote attestation including verification of the PCR measurement data to confirm that the data of the application has not been changed.
1. An information handling system comprising:
at least one processor; and
a memory coupled to the at least one processor;
wherein the information handling system is configured to:
execute an application within a guest operating system (OS) on the at least one processor, wherein at least a portion of data of the application is stored encrypted in a secure enclave region of the memory; and
securely transfer execution of the application to a second information handling system by:
performing first measurements relating to the information handling system by a physical cryptoprocessor of the information handling system,
performing second measurements relating to the guest OS by a virtual cryptoprocessor of the guest OS,
determining platform configuration register (PCR) measurement data that is based on the first and second measurements,
transmitting the PCR measurement data to the second information handling system, and
transmitting the at least a portion of data of the application to the second information handling system;
wherein the PCR measurement data is usable by the second information handling system to perform a remote attestation, the remote attestation including:
verification of the PCR measurement data to confirm that the at least a portion of data of the application has not been changed, and
verification that the guest OS and a physical cryptoprocessor of the second information handling system are bound and associated with a single physical platform.
2. The information handling system of claim 1 , wherein the secure enclave region is based on Software Guard Extensions (SGX) of the at least one processor.
3. The information handling system of claim 1 , wherein the information handling system and the second information handling system are nodes of a hyper-converged infrastructure (HCI) cluster.
4. The information handling system of claim 1 , wherein a hypervisor is configured to execute the guest OS.
5. The information handling system of claim 1 , wherein the physical cryptoprocessor is a Trusted Platform Module (TPM).
6. A method comprising:
an information handling system executing an application within a guest operating system (OS) on at least one processor of the information handling system,
wherein at least a portion of data of the application is stored encrypted in a secure enclave region of a memory of the information handling system; and
the information handling system securely transferring execution of the application to a second information handling system by:
performing first measurements relating to the information handling system by a physical cryptoprocessor of the information handling system,
performing second measurements relating to the guest OS by a virtual cryptoprocessor of the guest OS,
determining platform configuration register (PCR) measurement data that is based on the first and second measurements,
transmitting the PCR measurement data to the second information handling system, and
transmitting the at least a portion of data of the application to the second information handling system;
wherein the PCR measurement data is usable by the second information handling system to perform a remote attestation, the remote attestation including:
verification of the PCR measurement data to confirm that the at least a portion of data of the application has not been changed, and
verification that the guest OS and a physical cryptoprocessor of the second information handling system are bound and associated with a single physical platform.
7. The method of claim 6 , wherein the secure enclave region is based on Software Guard Extensions (SGX) of the at least one processor.
8. The method of claim 6 , wherein the information handling system and the second information handling system are nodes of a hyper-converged infrastructure (HCI) cluster.
9. The method of claim 6 , wherein the physical cryptoprocessor is a Trusted Platform Module (TPM).
10. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable code thereon that is executable by a processor of an information handling system for:
executing an application within a guest operating system (OS) on the processor, wherein at least a portion of data of the application is stored encrypted in a secure enclave region of a memory of the information handling system; and
securely transferring execution of the application to a second information handling system by:
performing first measurements relating to the information handling system by a physical cryptoprocessor of the information handling system,
performing second measurements relating to the guest OS by a virtual cryptoprocessor of the guest OS,
determining platform configuration register (PCR) measurement data that is based on the first and second measurements,
transmitting the PCR measurement data to the second information handling system, and
transmitting the at least a portion of data of the application to the second information handling system;
wherein the PCR measurement data is usable by the second information handling system to perform a remote attestation, the remote attestation including:
verification of the PCR measurement data to confirm that the at least a portion of data of the application has not been changed, and
verification that the guest OS and a physical cryptoprocessor of the second information handling system are bound and associated with a single physical platform.
11. The article of claim 10 , wherein the secure enclave region is based on Software Guard Extensions (SGX) of the at least one processor.
12. The article of claim 10 , wherein the information handling system and the second information handling system are nodes of a hyper-converged infrastructure (HCI) cluster.
13. The article of claim 10 , wherein a hypervisor is configured to execute the guest OS.
14. The article of claim 10 , wherein the physical cryptoprocessor is a Trusted Platform Module (TPM).