Patent ID: 9209979
Filing Date: 2015-12-08
Classification: G06F,H04L

Abstract:
1. A method comprising: transmitting, by a first computing system via a secure channel to a second computing system, a request to create a virtual machine in the second computing system, wherein the request includes at least a first token, and wherein the second computing system is a cloud computing system comprising a plurality of pieces of physical infrastructure hardware that provide a virtualization platform; recording, in a computer memory of the first computing system using a processor of the first computing system, the first token in association with the request for a virtual machine; receiving, by the first computing system from a server located in a secure zone in the second computing system, the first token after the second computing system requests to load components configured to boot the virtual machine; confirming, using the processor of the first computing system, authenticity of the received first token with the recorded first token; transmitting, by the first computing system to the server located in the secure zone in the second computing system, a second token unique to the request to load components, wherein the second token is configured to enable the server located in the secure zone of the second computing system to transmit the requested components and the second token to the virtual machine, wherein the requested components are unique to the request to load components; recording, in the computer memory using the processor of the first computing system, the second token in association with the request for the virtual machine; receiving, by the first computing system from the virtual machine, the second token after the virtual machine has been loaded with the requested components on a first piece of physical infrastructure hardware of the plurality of pieces of physical infrastructure hardware that provide the virtualization platform; confirming, using the processor of the first computing system, authenticity of the received second token with the recorded second token; transmitting, by the first computing system to the virtual machine, a third token and confidential information configured to enable the virtual machine to create a secure connection with the first computing system via a gateway server located in the secure zone of the second computing system; recording, in the computer memory using the processor of the first computing system, the third token in association with the request for the virtual machine; receiving, by the first computing system from the gateway server located in the secure zone of the second computing system, the third token and a request to establish a secure connection through the secure zone with the virtual machine; confirming, using the processor of the first computing system, authenticity of the received third token with the recorded third token; recording, using the processor of the first computing system, an entry in a log file stored on the computer memory of the first computing system indicating a duration of time in a boot phase exceeds a predetermined threshold of time; recording, using the processor of the first computing system, an entry in a log file stored on the computer memory of the first computing system indicating a duration of time in an unlock phase exceeds a predetermined threshold of time; and recording, using the processor of the first computing system, an entry in a log file stored on the computer memory of the first computing system indicating a duration of time in a connect phase exceeds a predetermined threshold of time, wherein the virtual machine is a measured virtual machine, and authenticity of the measured virtual machine is determined by the first computing system for at least one tenant of a cloud provider associated with the cloud computing system using a quote generated based on a measurement of the measured virtual machine, and wherein the quote is uniquely tied to the first piece of physical infrastructure hardware of the plurality of pieces of physical infrastructure hardware that provide the virtualization platform, and the cloud provider creates an association between a trusted protection module (TPM) associated with the measured virtual machine and the generated quote, the association between the TPM and the generated quote identifying to the at least one tenant of the cloud provider the first piece of physical infrastructure of the plurality of pieces of physical infrastructure hardware on which the measured virtual machine has been loaded.