System integrity using attestation for virtual trusted platform module

1. A system to attest a virtual trusted platform module, the system comprising:

memory;

one or more processors coupled to the memory; and

a guest attestation service implemented using at least one of the one or more processors to attest a virtual machine that is different from the virtual trusted platform module and that is hosted by a host operating system configured to run on a host, the guest attestation service configured to:

receive a guest endorsement key certificate and guest measurements from the virtual machine,

the guest endorsement key certificate including a guest endorsement key associated with the virtual trusted platform module that is hosted by the host operating system,

the guest endorsement key certificate vouching for the guest measurements,

the guest measurements indicating attributes of a guest operating system configured to run on the virtual machine;

determine whether the guest endorsement key certificate is issued via a chain of trust that includes a host attestation service that is configured to attest the host;

generate a verification indicating that the guest measurements are trustworthy based at least in part on a determination that the guest endorsement key certificate is issued via the chain of trust that includes the host attestation service; and

provide the verification to the virtual machine.

2. The system of claim 1 , wherein the guest attestation service is configured to:

receive a host signing key certificate from the virtual machine,

the host signing key certificate certified by the host attestation service,

the host signing key certificate including a public portion of a host signing key that corresponds to a private portion of the host signing key that is used to sign the guest endorsement key certificate; and

determine that the guest endorsement key certificate is issued via the chain of trust that includes the host attestation service by verifying that the host signing key was used to issue the guest endorsement key certificate.

3. The system of claim 1 , wherein the guest attestation service is configured to:

receive a host signing key certificate from the host attestation service that certifies a host signing key rather than from the virtual machine,

the host signing key certificate including a public portion of the host signing key that corresponds to a private portion of the host signing key that is used to sign the guest endorsement key certificate; and

determine that the guest endorsement key certificate is issued via the chain of trust that includes the host attestation service by verifying that the host signing key was used to issue the guest endorsement key certificate.

4. The system of claim 1 , wherein the guest attestation service is configured to:

determine that the guest endorsement key certificate is issued via the chain of trust that includes the host attestation service based at least in part on the guest endorsement key being signed by the host attestation service to issue the guest endorsement key certificate to the virtual trusted platform module.

5. The system of claim 1 , further comprising:

the host operating system configured to:

provide a host endorsement key certificate and host measurements to the host attestation service, the host endorsement key certificate vouching for the host measurements, the host measurements indicating attributes of the host operating system; and

receive a host signing key certificate from the host attestation service based at least in part on the host endorsement key certificate and the host measurements being provided to the host attestation service, the host signing key certificate including a public portion of a host signing key that corresponds to a private portion of the host signing key that is used to sign the guest endorsement key certificate.

6. The system of claim 5 , wherein the guest attestation service is configured to:

receive the host signing key certificate from the virtual machine; and

provide the verification to the virtual machine based at least in part on the guest endorsement key certificate, the guest measurements, and the host signing key certificate being received by the guest attestation service from the virtual machine.

7. The system of claim 1 , further comprising:

the virtual machine hosted by the host operating system, the virtual machine configured to:

provide the guest endorsement key to the host attestation service; and

receive the guest endorsement key certificate from the host attestation service.

8. The system of claim 1 , wherein the host is a source host from which the virtual machine is to be migrated; and

wherein the system further comprises:

the source host;

the host operating system configured to run on the source host;

a target host; and

a target operating system configured to run on the target host;

wherein at least one of the host operating system, which runs on the source host, or the target operating system is configured to migrate the virtual machine from the source host to the target host; and

wherein the virtual machine hosted by the target operating system is configured to obtain a second guest endorsement key certificate that is issued via a chain of trust that includes a second host attestation service that is configured to attest the target host,

the second guest endorsement key certificate including the guest endorsement key,

the second guest endorsement key certificate vouching for the guest measurements.

9. The system of claim 8 , wherein the guest attestation service is configured to:

receive the second guest endorsement key certificate and the guest measurements from the virtual machine hosted by the target operating system;

determine whether the second guest endorsement key certificate is issued via the chain of trust that includes the second host attestation service;

generate a second verification indicating that the guest measurements are trustworthy based at least in part on a determination that the second guest endorsement key certificate is issued via the chain of trust that includes the second host attestation service; and

provide the second verification to the virtual machine hosted by the target operating system.

10. The system of claim 1 , wherein the host is a source host from which the guest operating system is to be migrated;

wherein the system further comprises:

the source host;

the host operating system configured to run on the source host;

the virtual machine that is hosted by the host operating system;

a target host;

a target host operating system configured to run on the target host; and

a target virtual machine that is hosted by the target host operating system;

wherein the virtual machine that is hosted by the host operating system is configured to shut down the guest operating system on the virtual machine;

wherein the target virtual machine is configured to:

restart the guest operating system on the target virtual machine; and

obtain a second guest endorsement key certificate that is issued via a chain of trust that includes a second host attestation service that is configured to attest the target host,

the second guest endorsement key certificate including the guest endorsement key,

the second guest endorsement key certificate vouching for the guest measurements; and

wherein at least one of the host operating system configured to run on the source host or the target host operating system is configured to migrate the virtual trusted platform module from the host operating system configured to run on the source host to the target host operating system based at least in part on the guest operating system being shut down on the virtual machine and being restarted on the target host.

11. The system of claim 10 , wherein the guest attestation service is configured to:

receive the second guest endorsement key certificate and the guest measurements from the target virtual machine;

determine that the second guest endorsement key certificate is issued via the chain of trust that includes the second host attestation service;

generate a second verification indicating that the guest measurements are trustworthy based at least in part on a determination that the second guest endorsement key certificate is issued via the chain of trust that includes the second host attestation service; and

provide the second verification to the target virtual machine.

12. A method of attesting a virtual trusted platform module, the method comprising:

providing, by a virtual machine that is hosted by a source host operating system that runs on a source host, a guest endorsement key certificate and guest measurements to a guest attestation service,

the guest endorsement key certificate including a guest endorsement key associated with the virtual trusted platform module that is hosted by the source host operating system,

the guest endorsement key certificate vouching for the guest measurements,

the guest measurements indicating attributes of a guest operating system that runs on the virtual machine;

receiving, by the virtual machine, a verification from the guest attestation service, the verification indicating that the guest measurements are trustworthy based at least in part on the guest endorsement key certificate being issued via a chain of trust that includes a host attestation service that is configured to attest the source host;

migrating the virtual machine from the source host to a target host; and

obtaining, by the virtual machine hosted by a target operating system that runs on the target host, a second guest endorsement key certificate that is issued via a chain of trust that includes a second host attestation service that is configured to attest the target host,

the second guest endorsement key certificate including the guest endorsement key,

the second guest endorsement key certificate vouching for the guest measurements.

13. The method of claim 12 , further comprising:

providing, by the virtual machine hosted by the target operating system, the second guest endorsement key certificate and the guest measurements to the guest attestation service; and

receiving, by the virtual machine hosted by the target operating system, a second verification from the guest attestation service, the second verification indicating that the guest measurements are trustworthy based at least in part on the second guest endorsement key certificate being issued via the chain of trust that includes the second host attestation service.

14. The method of claim 13 , further comprising:

providing, by the target host operating system, a host endorsement key certificate and host measurements to the second host attestation service, the host endorsement key certificate vouching for the host measurements, the host measurements indicating attributes of the target host operating system; and

receiving, by the target host operating system, a host signing key certificate from the second host attestation service based at least in part on the host endorsement key certificate and the host measurements being provided to the second host attestation service, the host signing key certificate including a public portion of a host signing key that corresponds to a private portion of the host signing key that is used to sign the second guest endorsement key certificate.

15. The method of claim 14 , wherein providing the second guest endorsement key certificate and the guest measurements to the guest attestation service comprises:

providing, by the virtual machine hosted by the target operating system, the second guest endorsement key certificate, the guest measurements, and the host signing key certificate to the guest attestation service; and

wherein receiving the second verification comprises:

receiving, by the virtual machine hosted by the target operating system, the second verification from the guest attestation service based at least in part on the second guest endorsement key certificate, the guest measurements, and the host signing key certificate being provided to the guest attestation service by the virtual machine hosted by the target operating system.

16. The method of claim 13 , further comprising:

providing, by the virtual machine hosted by the target operating system, the guest endorsement key to the second host attestation service; and

receiving, by the virtual machine hosted by the target operating system, the second guest endorsement key certificate from the second host attestation service.

17. A method of attesting a virtual trusted platform module, the method comprising:

providing, by a source virtual machine that is hosted by a source host operating system that runs on a source host, a guest endorsement key certificate and guest measurements to a guest attestation service,

the guest endorsement key certificate including a guest endorsement key associated with the virtual trusted platform module that is hosted by the source host operating system,

the guest endorsement key certificate vouching for the guest measurements,

the guest measurements indicating attributes of a guest operating system that runs on the source virtual machine;

receiving, by the source virtual machine, a verification from the guest attestation service, the verification indicating that the guest measurements are trustworthy based at least in part on the guest endorsement key certificate being issued via a chain of trust that includes a host attestation service that is configured to attest the source host;

shutting down the guest operating system on the source virtual machine;

restarting the guest operating system on a target virtual machine that is hosted by a target host operating system that runs on a target host; and

obtaining, by the target virtual machine, a second guest endorsement key certificate that is issued via a chain of trust that includes a second host attestation service that is configured to attest the target host,

the second guest endorsement key certificate including the guest endorsement key,

the second guest endorsement key certificate vouching for the guest measurements; and

wherein the virtual trusted platform module is migrated from the source host operating system to the target host operating system based at least in part on the guest operating system being shut down on the source virtual machine and being restarted on the target virtual machine.

18. The method of claim 17 , further comprising:

providing, by the target virtual machine, the second guest endorsement key certificate and the guest measurements to the guest attestation service; and

receiving, by the target virtual machine, a second verification from the guest attestation service, the second verification indicating that the guest measurements are trustworthy based at least in part on the second guest endorsement key certificate being issued via the chain of trust that includes the second host attestation service.

19. The method of claim 18 , further comprising:

providing, by the target host operating system, a host endorsement key certificate and host measurements to the second host attestation service, the host endorsement key certificate vouching for the host measurements, the host measurements indicating attributes of the target host operating system; and

receiving, by the target host operating system, a host signing key certificate from the second host attestation service based at least in part on the host endorsement key certificate and the host measurements being provided to the second host attestation service, the host signing key certificate including a public portion of a host signing key that corresponds to a private portion of the host signing key that is used to sign the second guest endorsement key certificate.

20. The method of claim 18 , wherein providing the second guest endorsement key certificate and the guest measurements to the guest attestation service comprises:

providing, by the target virtual machine, the second guest endorsement key certificate, the guest measurements, and a host signing key certificate to the guest attestation service; and

wherein receiving the second verification comprises:

receiving, by the target virtual machine, the second verification from the guest attestation service based at least in part on the second guest endorsement key certificate, the guest measurements, and the host signing key certificate being provided to the guest attestation service by the target virtual machine.