Clustered virtual trusted platform module domain services system
An information handling system includes a virtual trusted platform module (TPM) consumer associated with a virtual machine. The virtual TPM (vTPM) consumer may consume TPM services from a clustered vTPM domain service and determine the connection information of the vTPM domain service. The vTPM consumer transmits a connection request for a TPM operation request to the vTPM domain service, wherein the connection request includes a payload in addition to the connection information. The consumer may also receive a response associated with the TPM operation request from the vTPM domain service.
1. An information handling system, comprising:
a trusted platform module (TPM); and
a virtual TPM (vTPM) domain service that is further configured with at least two TPM servers providing a root of trust that is cross-signed by each one of the at least two TPM servers, the vTPM domain service is configured to:
receive a connection request for a TPM operation from a TPM-vTPM, wherein the TPM-vTPM is configured to connect and consume TPM functionality of the vTPM domain service; and
transmit a response associated with the TPM operation to the TPM-vTPM.
2. The information handling system of claim 1 , wherein the TPM operation is performed by a vTPM instance linked with a virtual machine that is associated with the TPM-vTPM.
3. The information handling system of claim 1 , wherein the connection request is to consume an application programming interface published by the vTPM domain service.
4. The information handling system of claim 3 , wherein the application programming interface published by the vTPM domain service comports with TPM application programming interfaces published by a trusted computing group.
5. The information handling system of claim 3 , wherein the application programming interface published by the vTPM configured as a domain service supports a second application programming interface of a hardware TPM.
6. The information handling system of claim 1 , wherein the root of trust is provided to a virtual machine associated with the TPM-vTPM.
7. The information handling system of claim 1 , wherein the TPM is further configured to sign a vTPM certificate authority certificate.
8. The information handling system of claim 1 , wherein the at least two TPM servers are configured as a cluster.
9. The information handling system of claim 1 , wherein the vTPM domain service is clustered.
10. The information handling system of claim 1 , the vTPM domain service is further configured to generate a vTPM identifier to be used for the connection request.
11. The information handling system of claim 1 , the TPM operation is to migrate a virtual machine from the vTPM domain service to a second vTPM domain service.
12. An information handling system, comprising:
a processor configured to host a virtual machine;
a memory including a trusted platform module (TPM)—virtual trusted platform module (vTPM) associated with the virtual machine, wherein the TPM-vTPM is configured to consume services provided by a hardware TPM via a vTPM domain service, wherein the TPM-vTPM is configured to:
determine connection information of the vTPM domain service;
transmit a connection request for a TPM operation to the vTPM domain service, wherein the connection request includes the connection information and a root certificate that is cross-signed by each one of at least two TPM servers associated with the hardware TPM and the vTPM domain service; and
receive a response associated with the connection request for the TPM operation from the vTPM domain service.
13. The information handling system of claim 12 , wherein the connection information includes an internet protocol address associated with the vTPM domain service.
14. The information handling system of claim 12 , further comprising determining an identifier associated with the vTPM domain service.
15. The information handling system of claim 12 , wherein the root certificate is a public key infrastructure certificate that was retrieved from the vTPM domain service prior to the TPM operation.
16. The information handling system of claim 12 , wherein the vTPM domain service verifies that a status of the connection request is a success prior to performing the TPM operation.
17. A method comprising:
determining, by a processor, connection information of a virtual trusted platform module (vTPM) domain service;
determining an identifier of the vTPM domain service;
transmitting, by a trusted platform module (TPM)-vTPM a connection request for a TPM operation to the vTPM domain service, wherein the connection request includes the connection information and a root certificate that is cross-signed by each one of at least two TPM servers associated with a hardware TPM and the vTPM domain service; and
receiving a response associated with the TPM operation from the vTPM domain service.
18. The method of claim 17 , wherein the connection information is an internet protocol address of the vTPM domain service.
19. The method of claim 17 , wherein the root certificate is a public key infrastructure certificate that was retrieved from the vTPM domain service prior to the TPM operation.
20. The method of claim 17 , wherein the vTPM domain service verifies that a status of the connection request is a success prior to performing the TPM operation.