Cryptographic certification of secure hosted execution environments

• US 9,413,538 B2
• Filed: 12/12/2011
• Issued: 08/09/2016
• Est. Priority Date: 12/12/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Baumann, Andrew A., Hunt, Galen C., Peinado, Marcus
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Kabir, Jahangir
• Application Number:
  US13/323,465
• Publication Number:
  US 20130151846A1
• Time in Patent Office: 1,702 Days
• Field of Search: 713/150, 713/156, 713/172, 713/182, 713/185
• US Class Current: 1/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Implementations for providing a secure execution environment with a hosted computer are described. A security-enabled processor establishes a hardware-protected memory area with an activation state that executes only software identified by a client system. The hardware-protected memory area is inaccessible by code that executes outside the hardware-protected memory area. A certification is transmitted to the client system to indicate that the secure execution environment is established, in its activation state, with only the software identified by the request.

Claims

1. A method comprising:

providing a first instruction that causes a security-enabled processor of a computing system to establish a hardware-protected memory area within a memory of the computing system, the security-enabled processor configured to mediate, via one or more gate functions, access to the hardware-protected memory area by all code that executes outside of the hardware-protected memory area; and

providing a second instruction that causes the security-enabled processor, based at least on a request of a client system, to include, in an initial state, software and data identified by the request of the client system in the hardware-protected memory are;

instructing a portion of the software indentified by the request of the client system that is included in the hardware-protected memory area to execute, the portion of the software configured, upon execution, to cause the security-enabled processor to perform the act of generating cryptographic certification of all of contents of the hardware-protected memory area in the initial state;

receiving the cryptographic certification from the security-enabled processor, at least a portion of the cryptographic certification including an attestation created by the security-enabled processor using a private key of the security-enabled processor; and

providing the cryptographic certification to the client system, the cryptographic certification used by the client system based on a comparison of at least the portion of the cryptographic certification to a known cryptographic indication of the software and data identified in the request in the initial state, to determine that the contents of the hardware-protected memory area includes, in the initial state, only the software and data identified in the request, the attestation used by the client system, based at least on a public key associated with the security-enabled processor, to determine that the cryptographic certification of all contents of the hardware-protected memory area in the initial state was created by the security-enabled processor.

2. The method of claim 1, wherein the cryptographic certification includes a hash or a digest of all the contents of the hardware-protected memory area in the initial state.

3. The method of claim 1, wherein the data identified in the request of the client system includes one or more parameters identified by the client system, and wherein the cryptographic certification is further used by the client system to determine that the initial state includes no parameters other than the one or more parameters.

4. The method of claim 1, further comprising providing, to the client system, an auditing certificate, signed by another private key of an auditor entity, the auditing certificate indicating that the security-enabled processor is physically intact.

5. The method of claim 1, wherein the attestation includes one or more trust certificates, including a trust certificate from a trusted authority, the one or more trust certificates collectively used by the client system to determine that the security-enabled processor is of a type that mediates access to the hardware-protected memory area by all code that executed outside of the hardware-protected memory area and that encrypts all the contents of the hardware protected memory area.

6. The method of claim 1, wherein the attestation includes a processor certificate from a manufacturer of the security-enabled processor, the processor certificate indicating that the security-enabled processor is of a type that mediates access to the hardware-protected memory area by all of the code that executes outside of the hardware-protected memory area.

20. The method of claim 1, wherein the security-enabled processor is configured to encrypt all of the contents of the hardware-protected memory area, and wherein mediation of the access to the hardware-protected memory area includes decrypting portions of the contents of the hardware-protected memory area.

7. One or more computer-readable storage devices comprising a plurality of programming instructions that is executable by one or more processors to cause a computing system to:

transmit a request to an application hosting service, the request for a security-enabled processor of the application hosting service to establish a hardware-protected memory area of a memory of the application hosting service, the request identifying software and data to be included in the hardware-protected memory area in an initial state, the security-enabled processor configured to mediate access to the hardware-protected memory area by all code that is executed outside of the protected memory area, the security-enabled processor configured to encrypt all contents of the hardware-protected memory area, a portion of the software to be included in the hardware-protected memory are executable to cause the security-enabled processor to generate a cryptographic certification of all of the contents of the hardware-protected memory area in the initial state;

receive the cryptographic certification from the application hosting service, the cryptographic certification including at least an attestation created by the security-enabled processor using a private key of the security-enabled processor;

determine, based at least on a comparison of at least a portion of the cryptographic certification to a known cryptographic indication of the software and data in the initial state, that only the software and data identified by the request is included in the hardware-protected memory area in the initial state; and

determine, based at least on the attestation and a public key of the security-enabled processor, that the cryptographic certification of all of the contents of the hardware-protected memory area in the initial state is generated by the security-enabled processor.

8. The one or more computer-readable storage devices of claim 7, wherein the plurality of programming instructions is further executable to cause the computing system to receive from the application hosting service cryptographic certification that the security-enabled processor is physically secure.

9. The one or more computer-readable storage devices of claim 7, wherein the plurality of programming instructions is further executable to cause the computing system to instruct the application hosting service to load one or more application components into the hardware-protected memory area, the one or more application components different from the software that is identified by the request and that is included in the hardware-protected memory area in the initial state.

10. The one or more computer-readable storage devices of claim 7, wherein the identifier includes at least a hash of the contents of the hardware-protected memory area in the initial state.

11. The one or more computer-readable storage devices of claim 7, wherein the plurality of programming instructions is further executable to cause the computing system to receive an auditing certificate, signed by another private key of an auditor entity, indicating that the security-enabled processor is physically uncompromised.

12. The one or more computer-readable storage devices of claim 7, wherein the cryptographic certification includes one or more trust certificates, including a trust certificate from a trusted authority, that collectively indicate that the security-enabled processor is of a type that mediates access to the hardware-protected memory area by all of the code that is executed outside of the hardware-protected memory area.

13. The one or more computer-readable storage devices of claim 7, wherein the cryptographic certification includes a processor certificate, from a manufacturer of the security-enabled processor, that indicates that the security-enabled processor is of a type that mediates access to the hardware-protected memory area by the code that is executed outside of the protected memory area.

14. A computing system comprising:

a memory;

one or more processors, including a security-enabled processor configured to establish a hardware-protected memory area in the memory, wherein the security-enabled processor is configured to mediate access to the hardware-protected memory area by processes that execute outside of the protected memory area, that security-enabled processor further configured to encrypt all contents of the hardware-protected memory area; and

one or more modules stored on the memory and executable by the one or more processors to;

receive a request from a client system to establish the hardware-protected memory area, the request including an indication of software and data to be loaded in the hardware-protected memory area in an initial state;

cause, at least partly in response to the request, the security-enabled processor to instantiate the hardware-protected memory area and to include in the hardware-protected memory area the software and data in the initial state;

cause an instance of a loader module of the software to execute, the loader module configured, upon execution, to transmit to the client system cryptographic certification, signed by a private key of the security-enabled processor, that includes an indicator used by the client system, based on a comparison of the indicator to a known indicator of the software and data in the initial state, that the activation state of the secure execution environment of the hardware-protected memory area includes only the software and data indicated by the request in the initial state, the cryptographic certification further used by the client system, based at least on a public key of the security-enabled processor, to determine that the security-enabled processor generated the indicator.

15. The computing system of claim 14, wherein the private key of the security-enabled processor is stored on the security-enabled processor in a way that is accessible to the security-enabled processor but not to any other components of the computing system.

16. The computing system of claim 14, wherein the one or more modules are further executable by the one or more processors to receive an encryption key encrypted with a public key of the security-enabled processor that corresponds to the private key of the security-enabled processor, and to obtain, using the encryption key, one or more application components to be executed in the hardware-protected memory area.

17. The computing system of claim 14, wherein the indicator includes a digest of all contents of the hardware-protected memory area in the initial state and a public key corresponding to the private key that was used to sign the cryptographic certification.

18. The computing system of claim 14, wherein the data indicated in the request includes a parameter indicating an application of the software to be loaded into the hardware-protected memory area, and wherein the software and data in initial state further includes one or more of the parameter and the application.

19. The computing device of claim 14, wherein the one or more modules are further executable by the one or more processors to transmit, to the client system, an auditing certificate, signed by another private key of an auditor entity, indicating that the security-enabled processor has not been tampered with.