Secure Network Cloud Architecture

• US 20120265976A1
• Filed: 03/16/2012
• Published: 10/18/2012
• Est. Priority Date: 04/18/2011
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Halas, Miroslav, Schimmel, Richard A., Spiers, Bradford T., Provencher, Donald P.
• Granted Patent: US 8,984,610 B2
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Apparatuses, computer readable media, methods, and systems are described for requesting creation of virtual machine (VM) in a cloud environment comprising a virtual private cloud. Through various communications between a cloud DMZ, cloud provider, and/or company'"'"'s network, a VM instance may be securely created, initialized, booted, unlocked, and/or monitored through a series of interactions building, in some examples, upon a root of trust.

Claims

1. A method comprising:

receiving, by a secure boot server from a virtual machine, a request to download components configured to boot the virtual machine, wherein the request includes at least a first token;

transmitting, by the secure boot server to a first computing system, the first token;

receiving, by the secure boot server from the first computing system, a second token indicating authorization to transmit unique components to the virtual machine in response to the request to download components;

generating, by the secure boot server, unique components comprising at least one of;

unique identifier, configuration settings, and unique data elements; and

transmitting, by the secure boot server to the virtual machine, the unique components and the second token, wherein the secure boot server is located within a cloud DMZ at a cloud computing system, and the virtual machine is located at a cloud computing system outside the cloud DMZ.

2. The method of claim 1, wherein the unique components further comprise binaries, and wherein the unique data elements comprise a cryptographic material generated for one-time use.

3. The method of claim 1, wherein the unique identifier comprises a network address, and wherein the unique data elements comprise a unique cryptographic material.

4. The method of claim 1, further comprising:

receiving, by a gateway server from the virtual machine, a third token and confidential information indicating authorization from the first computing system to create a secure channel with the virtual machine via the gateway server;

transmitting, by the gateway server to the first computing system, the third token to confirm authenticity of the received third token to a recorded third token at the first computing system; and

establishing, by the gateway server, the secure channel between the virtual machine and the first computing system, wherein the gateway server and secure boot server are located within the cloud DMZ at the cloud computing system.

5. The method of claim 1, wherein the first token, second token, third token, and confidential information are each randomly generated for one-time use.

6. The method of claim 1, wherein the confidential information includes a cryptographic key.

7. The method of claim 1, wherein the confidential information includes a digital certificate.

8. The method of claim 1, wherein the confidential information includes a unique user account.

9. The method of claim 1, wherein the virtual machine is a measured virtual machine, and authenticity of the virtual machine is determined using a quote generated based on a measurement of the measured virtual machine.

10. The method of claim 1, wherein the cloud DMZ is protected by an external firewall and an internal firewall, and wherein the new virtual machine is hosted outside of the firewalls.

11. A cloud computing system comprising at least a secure boot server and a gateway server, the system comprising:

at least one processor; and

at least one memory storing computer executable instructions that, when executed by the at least one processor, cause the system at least to;

receive, by the secure boot server from a virtual machine, a request to download components configured to boot the virtual machine, wherein the request includes at least a first token;

transmit, by the secure boot server to a first computing system, the first token after receiving the request from the virtual machine to download components;

receive, by the secure boot server from the first computing system, a second token indicating authorization to transmit unique components to the virtual machine in response to the request to download components;

transmit, by the secure boot server to the virtual machine, the unique components and the second token;

receive, by the gateway server from the virtual machine, a third token and a confidential information indicating authorization from the first computing system to create a secure channel with the virtual machine via the gateway server;

transmit, by the gateway server to the first computing system, the third token to confirm authenticity of the received third token to a recorded third token at the first computing system; and

establish, by the gateway server, the secure channel between the virtual machine and the first computing system, wherein the secure boot server and gateway server are located within a cloud DMZ at a cloud computing system, and the virtual machine is located outside the cloud DMZ at the cloud computing system.

12. The system of claim 11, wherein the at least one memory further stores computer executable instructions that, when executed by the at least one processor, cause the system at least to:

generate, by the secure boot server, unique components comprising at least one of;

unique identifier, unique data elements, and configuration settings.

13. The system of claim 11, wherein the unique components include at least one of:

an operating system kernel and an initial ramdisk.

14. The system of claim 11, wherein the first token, second token, third token, and confidential information are each randomly generated for one-time use.

15. The system of claim 11, wherein the cloud DMZ of the cloud computing system further comprises:

an internal firewall configured to regulate network traffic;

an external firewall configured to regulate network traffic;

at least one network access control device; and

a portion of a cloud orchestrator system.

16. A non-transitory computer-readable storage medium storing computer-executable instructions, which when executed by an apparatus, cause the apparatus to at least:

receive, from a virtual machine, a request to download components configured to boot the virtual machine, wherein the request includes at least a first token;

transmit, to a first computing system, the first token;

receive, from the first computing system, a second token indicating authorization to transmit unique components to the virtual machine in response to the request to download components;

transmit, to the virtual machine, the unique components and the second token, wherein a secure boot server is located within a cloud DMZ at a cloud computing system, and the virtual machine is located at a cloud computing system outside the cloud DMZ.

17. The storage medium of claim 16, further storing computer-executable instructions, which when executed by an apparatus, cause the apparatus to at least:

generate unique components comprising at least one of;

unique identifier, configuration settings, and unique data elements, wherein the unique components comprise binaries, and wherein the unique data elements comprise a cryptographic material generated for one-time use.

18. The storage medium of claim 16, wherein the unique identifier comprises a network address, and wherein the unique data elements comprise a unique cryptographic material.

19. The storage medium of claim 16, further storing computer-executable instructions, which when executed by an apparatus, cause the apparatus to at least:

receive, by a gateway server from the virtual machine, a third token and confidential information indicating authorization from the first computing system to create a secure channel with the virtual machine via the gateway server;

transmit, by the gateway server to the first computing system, the third token to confirm authenticity of the received third token to a recorded third token at the first computing system; and

establish, by the gateway server, the secure channel between the virtual machine and the first computing system, wherein the gateway server and secure boot server are located within the cloud DMZ at the cloud computing system.

20. The storage medium of claim 16, wherein the first token, second token, third token, and confidential information are each randomly generated for one-time use.

21. The storage medium of claim 16, wherein the confidential information includes a cryptographic key.

22. The storage medium of claim 16, wherein the confidential information includes a digital certificate.

23. The storage medium of claim 16, wherein the virtual machine is a measured virtual machine, and authenticity of the virtual machine is determined using a quote generated based on a measurement of the measured virtual machine.

24. A system comprising:

a cloud DMZ network comprising at least one processor and at least one memory configured to;

using an internal firewall, regulate network traffic between an organization computer network and a cloud gateway;

using an external firewall, regulate network traffic between the cloud DMZ and a virtual private cloud;

using a secure boot server, send unique operating system components to a virtual machine in the virtual private cloud; and

using a gateway server, establish a secure channel between the virtual machine and the organization computer network;

wherein the internal firewall, external firewall, secure boot server, and gateway server are located within the cloud DMZ network; and

the virtual private cloud network comprising at least one processor and at least one memory configured to;

using a virtualization platform, create the virtual machine in the at least one memory of the virtual private cloud network.

25. The system of claim 24, further comprising:

the organization computer network comprising at least one processor and at least one memory configured to;

using a cloud orchestrator, monitor state of the virtual machine in the virtual private cloud network;

using a database, store a reservation corresponding to the virtual machine, wherein the reservation comprises confidential information and a unique identifier; and

using a firewall, regulate network traffic into the organization computer network;

wherein the organization computer network is located outside of the cloud DMZ network and the virtual private cloud network.

26. The system of claim 25, wherein the unique identifier includes a network address.

27. The system of claim 25, wherein the at least one memory of the organization computer network stores computer-executable instructions that, when executed by the at least one processor of the organization computer network, cause the cloud orchestrator at least to:

transmit, via a secure channel, a request to create the virtual machine, wherein the request includes at least a first token;

receive, from the secure boot server, the first token;

transmit, to the secure boot server, a second token in response to a request to load the virtual machine with the operating system components;

receive, from the virtual machine, the second token after the virtual machine has been loaded with the requested components;

transmit, to the virtual machine, a third token and confidential information; and

receive, from the gateway server, the third token and a request to establish a secure connection through the cloud DMZ network with the virtual machine.

28. The system of claim 24, wherein the at least one memory of the cloud DMZ network stores computer-executable instructions that, when executed, cause the secure boot server at least to:

receive, from the virtual machine, a request to download the operating system components, wherein the request includes at least a first token;

transmit, to the organization computer network, the first token after receiving the request from the virtual machine to download components;

receive, from the organization computer network, a second token indicating authorization to transmit unique components to the virtual machine in response to the request to download components; and

transmit, to the virtual machine, the unique components and the second token;

29. The system of claim 24, wherein the at least one memory of the cloud DMZ network stores computer-executable instructions that, when executed, cause the gateway server at least to:

receive, from the virtual machine, a third token and a secret passphrase indicating authorization from the organization computer network to create a secure channel with the virtual machine via the gateway server;

transmit, to the organization computer network, the third token to confirm authenticity of the third token; and

establish the secure channel between the virtual machine and the organization computer network.