Virtual machine-based trusted execution environment
View Patent ↗A virtual machine (VM) provisioned in the IaaS platform from a custom OS distribution that implements a remote attestation of itself. The VM can prove its privacy and integrity properties to an external party using a set of OS-level restrictions and IaaS-level validations. Remote attestation provides guarantees that the VM administrator cannot tamper with the VM operation and cannot access sensitive data. The attested properties are guaranteed by the correct operation of the underlying VM technology.
1. A method for protecting user data from an untrusted administrator who manages an untrusted application in a trusted public cloud infrastructure using a zero-knowledge runtime inside a virtual machine in a publicly verifiable way, comprising:
preparing an operating system distribution, comprising:
restrictions on any network access to the kernel or processes with the exception of a network interface that allows:
to initiate the state of the virtual machine using said operating system distribution, comprising:
installing one or several software applications;
providing configuration, credentials for accessing various systems or other data required for said virtual machine operation;
to process incoming requests using said untrusted application in a container runtime environment, that isolates the request handling process from said operating system and prevents data leaks;
firewall filtering all network requests to ensure all data in transit is encrypted with keys unavailable to said virtual machine administrator;
zero-knowledge data storage that encrypts all data at rest with user-owned keys unavailable to said virtual machine administrator;
provisioning a virtual machine using said operating system distribution on a trusted infrastructure-as-a-service platform, which:
allows sharing immutable operating system images;
provides no direct access to the virtual machine random access memory outside the operating system;
assigns the virtual machine with a unique identifier;
retrieving information describing the virtual machine state, including the operating system image used during the provisioning;
allows bi-directional data communication between the virtual machine and infrastructure-as-a-service platform during the virtual machine boot;
provides information on the infrastructure-as-a-service platform activity related to the virtual machine, including stopping and rebooting said virtual machine;
initiating the state of said virtual machine by installing applications and/or providing configuration information;
performing remote attestation of said virtual machine by said other party to ensure user data is protected, by one of the methods:
direct remote attestation, comprising:
retrieving a virtual machine unique identifier on the infrastructure-as-a-service platform;
retrieving access to the infrastructure-as-a-service information related to said virtual machine, including the boot log and the operating system image identifier, by one of the methods:
sharing infrastructure-as-a-service credentials; or
using an interactive cryptographic audit method to prove the integrity of the virtual machine information retrieved from the infrastructure-as-a-service provider;
retrieving the infrastructure-as-a-service platform information describing how said virtual machine was provisioned and operated;
delegated remote attestation, in which a trusted third party provides the complete or partial results of direct remote attestation.