Device certificate based appliance configuration
Embodiments of the present invention address deficiencies of the art in respect to configuring a computing appliance and provide a method, system and computer program product for device certificate based virtual appliance configuration. In one embodiment of the invention, a virtual appliance secure configuration method can be provided. The method can include mounting non-volatile storage to the virtual appliance, retrieving a device certificate from the mounted storage and extracting a signature from the device certificate, activating the virtual appliance in a network domain and acquiring an adapter address and unique identifier for the virtual appliance, and authenticating the signature with the adapter address and unique identifier to ensure a unique active instance of the virtual appliance.
1. A virtual appliance secure configuration method comprising:
mounting a universal serial bus (USB) key on the virtual appliance;
loading a key ring from the USB key, the key ring including a device certificate for the virtual appliance, one or more extensions disposed with the device certificate, and also a private key for the virtual appliance, the device certificate including a signature created by a certificate authority, a public key for the virtual appliance, a formal name for the virtual appliance, and the one or more extensions specifying configuration limitations for an instance of the virtual appliance;
symmetrically decrypting the key ring;
retrieving the device certificate from the symmetrically decrypted key ring and extracting the signature from the device certificate;
verifying the device certificate;
activating the virtual appliance in a network domain and acquiring an adapter address and Internet protocol (IP) address for the virtual appliance; and
authenticating the signature with the adapter address and IP address based upon the one or more extensions in the device certificate to ensure a unique active instance of the virtual appliance.
2. The method of claim 1 , wherein the formal name for the virtual appliance includes a layer two virtual network adapter address for the virtual appliance in combination with one of a layer three network address and a name for the virtual appliance.
3. The method of claim 1 , wherein verifying the device certificate comprises hashing non-signature fields of the device certificate and comparing the hashed non-signature fields of the device certificate with a signature field decrypted using a manufacturer public key.
4. A virtual appliance secure configuration method comprising:
mounting a virtualized non-volatile storage device on the virtual appliance;
retrieving an encrypted device certificate from the mounted virtualized non-volatile storage device and extracting a signature from the encrypted device certificate, the encrypted device certificate including the signature created by a certificate authority, a public key for the virtual appliance, a formal name for the virtual appliance, and one or more extensions specifying configuration limitations for an instance of the virtual appliance;
verifying the encrypted device certificate;
activating the virtual appliance in a network domain and acquiring an adapter address and unique identifier for the virtual appliance; and
authenticating the signature with the adapter address and unique identifier based upon the one or more extensions in the encrypted device certificate to ensure a unique active instance of the virtual appliance.
5. The method of claim 4 , wherein
the virtualized non-volatile storage device on the virtual appliance is selected from the group consisting of a floppy drive, a rewritable compact disc, a rewritable digital video disc, and a universal serial bus (USB) key.
6. The method of claim 4 , wherein
the virtualized non-volatile storage device comprises static memory in association with a security chipset for the virtual appliance.
7. The method of claim 4 , wherein
retrieving the encrypted device certificate from the mounted virtualized non-volatile storage device comprises:
loading a key ring from the virtualized non-volatile storage device, the key ring including the encrypted device certificate for the virtual appliance, the one or more extensions disposed with the device certificate, and also a private key for the virtual appliance;
symmetrically decrypting the key ring; and
retrieving the encrypted device certificate from the symmetrically decrypted key ring.
8. The method of claim 4 , wherein
the unique identifier is an Internet protocol (IP) address for the virtual appliance.
9. The method of claim 4 , further comprising:
extracting the one or more extensions from the encrypted device certificate;
identifying a configuration parameter in the one or more extensions; and
configuring the virtual appliance according to the configuration parameter.
10. The method of claim 4 , further comprising
periodically verifying logic performing the authenticating of the signature.
11. The method of claim 4 , wherein the formal name for the virtual appliance includes a layer two virtual network adapter address for the virtual appliance in combination with one of a layer three network address and a name for the virtual appliance.
12. The method of claim 4 , wherein verifying the encrypted device certificate comprises hashing non-signature fields of the encrypted device certificate and comparing the hashed non-signature fields of the encrypted device certificate with a signature field decrypted using a manufacturer public key.
13. A computer program product comprising a non-transitory computer usable storage medium having stored therein computer usable program code for virtual appliance secure configuration, the computer usable program code, which when executed by a computer hardware system, causes the computer hardware system to perform
mounting a virtualized non-volatile storage device on the virtual appliance;
retrieving an encrypted device certificate from the mounted virtualized non-volatile storage device and extracting a signature from the encrypted device certificate, the encrypted device certificate including the signature created by a certificate authority, a public key for the virtual appliance, a formal name for the virtual appliance, and one or more extensions specifying configuration limitations for an instance of the virtual appliance;
verifying the encrypted device certificate;
activating the virtual appliance in a network domain and acquiring an adapter address and unique identifier for the virtual appliance; and
authenticating the signature with the adapter address and unique identifier based upon the one or more extensions in the encrypted device certificate to ensure a unique active instance of the virtual appliance.
14. The computer program product of claim 13 , wherein
the virtualized non-volatile storage device is selected from the group consisting of a floppy drive, a rewritable compact disc, a rewritable digital video disc, and a universal serial bus (USB) key.
15. The computer program product of claim 13 , wherein
the virtualized non-volatile storage device comprises static memory in association with a security chipset for the virtual appliance.
16. The computer program product of claim 13 , wherein the computer usable program code for retrieving the encrypted device certificate from the mounted virtualized non-volatile storage device comprises computer usable program code, which when executed by the computer hardware system, cause the computer hardware system to perform:
loading a key ring from the mounted virtualized non-volatile storage device, the key ring including the encrypted device certificate for the virtual appliance, the one or more extensions disposed with the encrypted device certificate, and also a private key for the virtual appliance;
symmetrically decrypting the key ring; and
retrieving the encrypted device certificate from the symmetrically decrypted key ring.
17. The computer program product of claim 13 , wherein
the unique identifier is an Internet protocol (IP) address for the virtual appliance.
18. The computer program product of claim 13 , wherein the computer usable program code further causes the computer hardware system to perform:
extracting the one or more extensions from the encrypted device certificate;
identifying a configuration parameter in the one or more extensions; and
configuring the virtual appliance according to the configuration parameter.
19. The computer program product of claim 13 , wherein the computer usable program code further causes the computer hardware system to perform:
periodically verifying logic performing the authenticating of the signature.
20. The computer program product of claim 13 , wherein the formal name for the virtual appliance includes a layer two virtual network adapter address for the virtual appliance in combination with one of a layer three network address and name for the virtual appliance.