Virtual machine attestation report enhancement via countersigning
Techniques for virtual machine attestation report enhancement via countersigning are described. Upon receiving an attestation report signed by a security processor of a computing device hosting a guest virtual machine in a cloud provider system, the hypervisor can countersign the attestation report to provide further assurance as to the legitimacy of the attestation report and the presence of the computing device within a legitimate data center of the cloud provider.
1 . A computer-implemented method comprising:
receiving, by a hypervisor component of a computing device within a cloud provider network, a request to obtain a counter-signed attestation report for a guest virtual machine, wherein the request was originated by the guest virtual machine executing on the computing device;
sending, by the hypervisor component, a request for an attestation report to a security processor of the computing device;
receiving, by the hypervisor component, the attestation report from the security processor, wherein the attestation report is signed by the security processor based on use of a first key associated with a vendor of the security processor;
countersigning, by the hypervisor component, the attestation report via use of a second key associated with the cloud provider network to yield a cloud-provider signature block; and
providing the attestation report and the cloud-provider signature block in a response to the request back to the guest virtual machine.
2 . The computer-implemented method of claim 1 , wherein the request is carried within a Guest Hypervisor Communication Block (GHCB) and includes a globally unique identifier (GUID) indicating that the requestor desires both the attestation report and the cloud-provider signature block.
3 . The computer-implemented method of claim 1 , further comprising:
receiving, by the computing device, key information for use in generating cloud-provider signatures of attestation reports, the key information including at least the second key, wherein the second key is a private key, associated with a public key, that is chained back to a certificate authority of the cloud provider.
4 . A computer-implemented method comprising:
receiving a request to obtain a counter-signed attestation report for a virtual machine executed by a computing device within a network of a service provider;
obtaining an attestation report for the virtual machine from a processor of the computing device, wherein the attestation report comprises attestation data indicative of an initial state of the virtual machine and is signed by the processor using a first key, wherein the first key is a vendor key associated with a vendor of the processor;
countersigning the attestation report using a second key to yield a signature block, wherein second key is a provider key associated with the service provider, and wherein the vendor key and the provider key are cryptographically independent; and
transmitting or storing at least the signature block to satisfy the request.
5 . The computer-implemented method of claim 4 , wherein transmitting or storing at least the signature block includes providing both the attestation report and the signature block together in a single logical response.
6 . The computer-implemented method of claim 5 , wherein the request indicates that the requestor desires both the attestation report and the signature block.
7 . The computer-implemented method of claim 6 , wherein the request is carried within a Guest Hypervisor Communication Block (GHCB) and includes a globally unique identifier (GUID) indicating that the requestor desires both the attestation report and the signature block.
8 . The computer-implemented method of claim 4 , wherein transmitting or storing at least the signature block occurs by providing the signature block but not the attestation report in a single logical response.
9 . The computer-implemented method of claim 8 , further comprising:
caching data, the data comprising the attestation report or a hash of the attestation report,
wherein obtaining the attestation report occurs prior to the receiving of the request,
wherein caching the data occurs prior to the receiving of the request, and
wherein countersigning the attestation report comprises signing the cached data using the second key.
10 . The computer-implemented method of claim 4 , further comprising:
obtaining, by the computing device, key information for use in generating signatures of attestation reports, the key information including at least the second key, wherein the second key is a private key, associated with a public key, that is chained back to a certificate authority,
wherein the countersigning of the attestation report is performed by the computing device.
11 . The computer-implemented method of claim 10 , wherein the receiving of the request, the obtaining of the attestation report, the countersigning of the attestation report, and the transmitting or storing of at least the signature block is performed by an offload card of the computing device, wherein the offload card is separate from the processor and implements at least some hypervisor functionality.
12 . The computer-implemented method of claim 4 , wherein:
the receiving of the request, the obtaining of the attestation report, and the transmitting or storing of at least the signature block is performed by the computing device that executes the virtual machine; and
wherein the countersigning of the attestation report is performed by a separate computing device that is distinct from the computing device.
13 . The computer-implemented method of claim 4 , wherein the second key is used for countersigning attestation reports from multiple different computing devices.
14 . The computer-implemented method of claim 4 , wherein the signature block further includes cloud provider configuration data associated with the virtual machine.
15 . The computer-implemented method of claim 14 , wherein the cloud provider configuration data includes at least one of:
a unique identifier associated with the virtual machine;
network configuration data associated with the virtual machine,
disk image data associated with the virtual machine,
policy data of policies applied to the virtual machine; or
geographic data associated with a location of the virtual machine.
16 . A system comprising:
a first one or more electronic devices configured to implement a key management service in a multi-tenant cloud provider network; and
a computing device of a second one or more electronic devices of a hardware virtualization service in the multi-tenant cloud provider network, the computing device including instructions that upon execution cause the computing device to:
receive a request to obtain a counter-signed attestation report for a virtual machine executed by the computing device;
obtain an attestation report from a processor of the computing device, wherein the attestation report comprises attestation data indicative of an initial state of the virtual machine and is signed by the processor using a first key, wherein the first key is a vendor key associated with a vendor of the processor;
countersign the attestation report using a second key to yield a cloud-provider signature block, wherein the second key is a provider key associated with the cloud provider; and
transmit or store at least the cloud-provider signature block in satisfaction of the request.
17 . The system of claim 16 , wherein the computing device is to provide at least the cloud-provider signature block via providing both the attestation report and the cloud-provider signature block together in a single logical response.
18 . The system of claim 17 , wherein the request indicates that the requestor desires both the attestation report and the cloud-provider signature block.
19 . The system of claim 18 , wherein the request is carried within a Guest Hypervisor Communication Block (GHCB) and includes a globally unique identifier (GUID) indicating that the requestor desires both the attestation report and the cloud-provider signature block.
20 . The system of claim 16 , wherein the computing device is to provide at least the cloud-provider signature block via providing the cloud-provider signature block but not the attestation report in a single logical response.