Trusted hardware for attesting to authenticity in a cloud environment

1. An apparatus comprising:

at least one processor; and

at least one memory storing computer executable instructions that, when executed, cause the apparatus at least to:

store, in a trusted protection module (TPM), a first measurement of a virtualization platform;

store, in the TPM, a second measurement of a measured virtual machine;

store, in the TPM, a third measurement of a secure channel, wherein the third measurement of the secure channel comprises a measurement of a symmetric encryption key used by a transport layer security (TLS) protocol;

generate a TPM quote using a key, wherein the TPM quote is based on the first measurement and the second measurement and the third measurement;

provide the TPM quote for attesting to authenticity of the virtualization platform and of the measured virtual machine; and

process a dedication request that dedicates the apparatus to the measured virtual machine,

wherein the TPM quote is uniquely tied to an individual piece of hardware, and a cloud provider creates an association between the TPM and the generated TPM quote.

2. The apparatus of claim 1 , wherein the first measurement comprises a measurement of physical infrastructure hardware on which the virtualization platform runs.

3. The apparatus of claim 1 , wherein the TPM quote is generated based on a nonce, wherein the nonce comprises an authentication code.

4. The apparatus of claim 1 , wherein the executable instructions, when executed, further cause the apparatus to process a release request permitting the apparatus to make a measurement of a second virtual machine different from the measured virtual machine.

5. The apparatus of claim 1 , wherein the second measurement comprises a measurement of at least one of a binary, configuration information, a cryptographic key, a digital certificate, a driver, and a module.

6. A method comprising:

storing, in a trusted protection module (TPM), a first measurement of a virtualization platform;

storing, in the TPM, a second measurement of a measured virtual machine;

storing, in the TPM, a third measurement of a secure channel, wherein the third measurement of the secure channel comprises a measurement of a symmetric encryption key used by a transport layer security (TLS) protocol;

generating, by a processor, a TPM quote using a key, wherein the TPM quote is based on the first measurement and the second measurement and the third measurement;

providing the TPM quote for attesting to authenticity of the virtualization platform and of the measured virtual machine; and

processing a dedication request that dedicates trusted hardware to the measured virtual machine,

wherein the TPM quote is uniquely tied to an individual piece of hardware, and a cloud provider creates an association between the TPM and the generated TPM quote.

7. The method of claim 6 , wherein the first measurement comprises a measurement of physical infrastructure hardware on which the virtualization platform runs.

8. The method of claim 7 , wherein the measurement of the physical infrastructure hardware comprises a cryptographic hash of firmware associated with each device included in the physical infrastructure.

9. The method of claim 7 , wherein the physical infrastructure includes a code segment that is trusted.

10. The method of claim 9 , wherein the code segment is hard coded into a processor included in the physical infrastructure.

11. The method of claim 6 , wherein the TPM quote is generated based on a nonce, wherein the nonce comprises an authentication code.

12. The method of claim 6 , further comprising processing a release request permitting the trusted hardware to make a measurement of a second virtual machine different from the measured virtual machine.

13. The method of claim 6 , wherein the second measurement comprises a measurement of at least one of a binary, configuration information, a cryptographic key, a digital certificate, a driver, and a module.

14. The method of claim 6 , wherein the association between the TPM and the generated TPM quote is maintained in an inventory of valid attestation identity keys (AIKs).

15. The method of claim 14 , wherein the cloud provider provides the inventory to at least one tenant to enable remote attestation of authenticity of a cloud infrastructure providing the measured virtual machine.

16. The method of claim 14 , wherein the inventory identifies at least one specific physical infrastructure that contains a specific TPM having a specific AIK public key.

17. The method of claim 14 , wherein the cloud provider creates the association between the TPM and the generated TPM quote in accordance with a legal agreement between at least one tenant and the cloud provider.

18. A non-transitory computer readable medium storing computer executable instructions that, when executed, cause an apparatus at least to:

store, in a trusted protection module (TPM), a first measurement of a virtualization platform;

store, in the TPM, a second measurement of a measured virtual machine;

store, in the TPM, a third measurement of a secure channel, wherein the third measurement of the secure channel comprises a measurement of a symmetric encryption key used by a transport layer security (TLS) protocol;

generate a TPM quote using a key, wherein the TPM quote is based on the first measurement and the second measurement and the third measurement;

provide the TPM quote for attesting to authenticity of the virtualization platform and of the measured virtual machine; and

process a dedication request that dedicates the apparatus to the measured virtual machine,

wherein the TPM quote is uniquely tied to an individual piece of hardware, and a cloud provider creates an association between the TPM and the generated TPM quote.

19. The computer readable medium of claim 18 , wherein the first measurement comprises a measurement of physical infrastructure hardware on which the virtualization platform runs.

20. The computer readable medium of claim 18 , wherein the TPM quote is generated based on a nonce, wherein the nonce comprises an authentication code.

21. The computer readable medium of claim 18 , wherein the second measurement comprises a measurement of at least one of a binary, configuration information, a cryptographic key, a digital certificate, a driver, and a module.