Patent ID: 12236221

DETAILED DESCRIPTION

Described herein are methods and systems for implementing a software provisioning agent residing in a trusted execution environment (TEE).

An example cloud environment may include one or more host computer systems running multiple centrally managed virtual machines. One of the important administrative tasks with respect to cloud environments is performing software provisioning tasks (e.g., installations and/or updates) on the virtual machines. Should the security of a host computer system become compromised by a malicious party, such a malicious party would be able to tamper with the software updates applied to the host itself, as well as to various applications and components running on the host, such as virtual machines, containers, etc.

The present disclosure alleviates these and other deficiencies of various common implementations by providing methods and systems for implementing TEE-resident software provisioning agents. In an illustrative example, software provisioning activities in the cloud environment may be managed by a software provisioning controller, which may communicate to software provisioning agents installed on each host. Each software provisioning agent may be implemented by one or more executable code modules, which may expose one or more software provisioning application programming interface (API) functions that may be invoked by the local host and/or the software provisioning controller.

For improved security, each software provisioning agent may run in a TEE on the respective host computer system. In an illustrative example, the TEE may be implemented by an Intel® Software Guard Extensions (SGX) secure enclave, which is a private region of encrypted memory, the contents of which would only be decrypted for access by the process running within the enclave. In another illustrative example, the TEE may be implemented by the AMD® Secure Encrypted Virtualization (SEV), which encrypts the memory state of each virtual machine using a respective encryption key inaccessible by other virtual machines. Various other TEE implementations for the above-referenced and/or other processor architectures may be compatible with the systems and methods of the present disclosure.

Each TEE-resident software provisioning agent may securely communicate with the software provisioning controller in order to perform various software provisioning operations (e.g., software installation and/or update operations) on the local host. In an illustrative example, a software provisioning operation may be initiated by the software provisioning controller, which may transmit a software provisioning command to one or more software provisioning agents residing on the respective hosts. In another illustrative example, a software provisioning operation may be initiated by the software provisioning agent transmitting a request to the software provisioning controller. In another illustrative example, a software provisioning operation may be initiated by a host computer system and/or by a virtual machine running on the host computer system, which may invoke a function of the software provisioning API implemented by the software provisioning agent.

Upon initiating the software provisioning operation, the software provisioning agent may receive one or more files containing the code and/or metadata for performing the software provisioning operation. In an illustrative example, the files may be retrieved from the software provisioning controller. Alternatively, the software provisioning controller may supply, to the software provisioning agent, one or more file identifiers (e.g., uniform resource identifiers (URI)) for retrieving one or more files from a software repository.

In some implementations, the files may be encrypted, e.g., by a private key of the software provisioning controller. Upon retrieving the necessary files, the software provisioning agent may decrypt them using the public key of the software provisioning controller. Various other encryption schemes may be implemented by the systems and methods of the present disclosure.

In some implementations, a transport layer security scheme (e.g., secure socket layer (SSL)) may be implemented for secure data and command transmission between the software provisioning controller, software provisioning agents, and/or one or more software repositories.

Upon receiving and decrypting the files, the software provisioning agent may perform the software provisioning operation (e.g., software installation or update operation). In an illustrative example, the software provisioning agent may invoke one or more functions of the software provisioning API implemented by the host computer system and/or by virtual machines running on the host computer system. Alternatively, the software provisioning agent may directly perform one or more file system operations on the host, e.g., by invoking one or more functions of the file system API implemented by the host computer system. Various other methods of performing software provisioning operations may be implemented by the systems and methods of the present disclosure.

In some implementations, the software provisioning controller may also run in a TEE, thus further improving the overall security of the software provisioning workflow.

Various aspects of the methods and systems are described herein by way of examples, rather than by way of limitation. The methods described herein may be implemented by hardware (e.g., general purpose and/or specialized processing devices, and/or other devices and associated circuitry), software (e.g., instructions executable by a processing device), or a combination thereof.

FIG.1schematically depicts a high-level component diagram of an example cloud environment100implemented in accordance with one or more aspects of the present disclosure. As schematically illustrated byFIG.1, the cloud environment100may be managed by the virtualization manger110which may provide a graphical user interface and a RESTful API to manage the cloud environment resources. In some implementations, the cloud infrastructure manager110may further perform the functions of a software provisioning controller operating in accordance with one or more aspects of the present disclosure.

The cloud environment100may further include one or more host computer systems120A-120N, on which virtual machine instances130A-130Z may run. Host agents140A-140N may run as daemons on the respective hosts120A-120N in order to manage and monitor the storage, memory and network resources of each host, as well as to facilitate communications of the host with the cloud infrastructure manager110. In various implementations, the host agent may further co-ordinate virtual machine creation, statistics gathering, log collection and other host administration tasks. In some implementations, the host agent140may further perform the functions of a software provisioning agent operating in accordance with one or more aspects of the present disclosure.

The cloud infrastructure manager110may act as a client with respect to each host agent140A-140N, and may communicate to the host agents140A-140N via XML-RPC or any other suitable protocol. In some implementations, a transport layer security scheme (e.g., secure socket layer (SSL)) may be implemented for secure data and command transmission between the host agents140, cloud infrastructure manager110, and/or software repositories implemented by the shared storage service150.

The shared storage service150may be implemented by one or more storage nodes, one or more container servers to manage mappings of object containers, one or more object servers to manage objects (such as files) on the storage nodes, and one or more authentication servers to manage accounts defined within the object storage service. In some implementations, the shared storage service may further implement one or more software repositories for storing virtual machine images, operating system code and metadata, application code and metadata, and/or software update code and metadata.

The cloud infrastructure manager110may manage deployment, configuration, and maintenance of the host computers and virtual machines. The functions of the cloud infrastructure manager110may include provisioning, remote management and monitoring of one or more cloud environments100. The cloud infrastructure manager110may implement fine-grained life cycle management, user and group role-based access control, integrated subscription management, as well as advanced graphical user interface (GUI), command line interface (CLI), and/or API access.

While in the illustrative example ofFIG.1the cloud infrastructure manager110is shown as running on a separate physical machine, in various alternative implementations the cloud infrastructure manager110may be collocated with one of the hosts120A-120N.

FIG.2Aschematically illustrates an example software provisioning workflow performed by a TEE-resident software provisioning agent operating in accordance with one or more aspects of the present disclosure. In an illustrative example, the software provisioning controller210may initiate a software provisioning operation by transmitting a software provisioning command215the software provisioning agent220residing in TEE225of the host computer system230. The software provisioning command215may identify one or more software applications installed on the host230. The software provisioning command215may further identify one or more software provisioning actions to be performed by the software provisioning agent220with respect to each of the identified software applications. The software provisioning command215may further comprise identifiers (e.g., uniform resource identifiers (URI)) of one or more files to be downloaded by the software provisioning agent220from the software provisioning controller210or from the software repository235.

Responsive to receiving the software provisioning command215, the software provisioning agent220may receive (operation240) one or more files242containing the code and/or metadata for performing the software provisioning operations specified by the software provisioning command215. In some implementations, the files may be encrypted, e.g., by a private key of the software provisioning controller210or the software repository235. Accordingly, the software provisioning agent220may decrypt the received encrypted files using the public key of the software provisioning controller210or the software repository235. Various other encryption schemes may be implemented by the systems and methods of the present disclosure.

The software provisioning agent220may store (operation244) the decrypted files in a local file system of the host220and may then perform the software provisioning operation245(e.g., a software installation operation or a software update operation) specified by the software provisioning command215. In an illustrative example, the software provisioning agent220may invoke (operation246) one or more functions of the software provisioning API250implemented by the host computer system230and/or by virtual machines running on the host computer system230. Identifiers of the received files in the local file system may be supplied as arguments to the invoked API functions. The host230and/or a virtual machine running on the host230may then access the file and perform the operations specified by the invoked API functions, the completing the software installation or update.

Alternatively, the software provisioning agent220may directly perform one or more file system operations on the host230, e.g., by invoking (operation248) one or more functions of the file system API255implemented by the host computer system. Identifiers of the received files in the local file system may be supplied as arguments to the invoked API functions.

In another illustrative example, schematically illustrated byFIG.2B, the software provisioning operation may be initiated by the software provisioning agent220, which may, in order to perform an installation or an update of a software application running on the host230or on one or more virtual machines running on the host230, transmit a software provisioning request205to the software provisioning controller210. The software provisioning request205may identify one or more software applications installed on the host230. The software provisioning request205may further identify one or more software provisioning actions to be performed by the software provisioning agent220with respect to each of the identified software applications.

The software provisioning controller210may reply to the software provisioning request205by transmitting a response comprising one or more software provisioning commands215. Responsive to receiving the software provisioning command215, the software provisioning agent220may receive one or more files242and may further perform the software provisioning operations specified by the software provisioning command215, as described herein above with reference toFIG.2A.

In another illustrative example, schematically illustrated byFIG.2C, the software provisioning operation may be initiated by the host computer system230, which may, in order to perform an installation or an update of a software application running on the host230or on one or more virtual machines running on the host230, invoke (operation202) a function of the software provisioning API204implemented by the software provisioning agent220. The software provisioning agent220may initiate the requested software provisioning operation by transmitting a software provisioning request205to the software provisioning controller210.

The software provisioning controller210may reply to the software provisioning request205by transmitting a response comprising one or more software provisioning commands215. Responsive to receiving the software provisioning command215, the software provisioning agent220may receive one or more files242and may further perform the software provisioning operations specified by the software provisioning command215, as described herein above with reference toFIG.2A.

Various other methods of performing software provisioning operations may be implemented by the systems and methods of the present disclosure.

FIG.3depicts a flowchart of an example software provisioning method300performed by the TEE-resident software provisioning agent, in accordance with one or more aspects of the present disclosure. In some implementations, method300may be performed by a single processing thread executed by a processing device. Alternatively, method300may be performed by two or more processing threads executed by one or more processing devices, such that each thread would execute one or more individual functions, routines, subroutines, or operations of the method. In an illustrative example, the processing threads implementing method300may be synchronized (e.g., using semaphores, critical sections, and/or other thread synchronization mechanisms). Alternatively, the processing threads implementing method300may be executed asynchronously with respect to each other. Therefore, whileFIG.3and the associated description lists the operations of method300in certain order, various implementations of the method may perform at least some of the described operations in parallel and/or in arbitrary selected orders.

At block310, a software provisioning agent implementing the method may receive, from the software provisioning controller, a software provisioning command identifying one or more software applications installed on the host computer system serviced by the software provisioning agent. The software provisioning command may further identify one or more software provisioning actions to be performed by the software provisioning agent with respect to each of the identified software applications. The software provisioning command may identify one or more files to be downloaded by the software provisioning agent from the software provisioning controller or from a software repository, as described in more detail herein above.

At block320, the software provisioning agent may retrieve, from the software provisioning controller and/or from the software repository specified by the software provisioning command, the files specified by the software provisioning command. The software provisioning agent may decrypt the received encrypted files and may store the decrypted files in a local file system of the host computer system, as described in more detail herein above.

At block330, the software provisioning agent may perform the software provisioning operations specified by the software provisioning command. In an illustrative example, the software provisioning agent may invoke or more functions of the software provisioning API implemented by the host computer system and/or by virtual machines running on the host computer system. Alternatively, the software provisioning agent may directly perform one or more file system operations on the host computer system, e.g., by invoking one or more functions of the file system API255implemented by the host computer system, as described in more detail herein above.

Upon completing the operations of block330, the method may terminate.

FIG.4depicts a flowchart of another example software provisioning method400performed by the TEE-resident software provisioning agent, in accordance with one or more aspects of the present disclosure. In some implementations, method400may be performed by a single processing thread executed by a processing device. Alternatively, method400may be performed by two or more processing threads executed by one or more processing devices, such that each thread would execute one or more individual functions, routines, subroutines, or operations of the method. In an illustrative example, the processing threads implementing method400may be synchronized (e.g., using semaphores, critical sections, and/or other thread synchronization mechanisms). Alternatively, the processing threads implementing method400may be executed asynchronously with respect to each other. Therefore, whileFIG.4and the associated description lists the operations of method400in certain order, various implementations of the method may perform at least some of the described operations in parallel and/or in arbitrary selected orders.

At block410, a software provisioning agent implementing the method may transmit, to the software provisioning controller, a software provisioning request identifying one or more software applications installed on the host computer system serviced by the software provisioning agent. The software provisioning request may further identify one or more software provisioning actions to be performed by the software provisioning agent with respect to each of the identified software applications.

At block420, the software provisioning agent may receive, from the software provisioning controller, a software provisioning command responsive to the software provisioning request. The software provisioning command may identify one or more files to be downloaded by the software provisioning agent from the software provisioning controller or from a software repository, as described in more detail herein above.

At block430, the software provisioning agent may retrieve, from the software provisioning controller and/or from the software repository specified by the software provisioning command, the files specified by the software provisioning command. The software provisioning agent may decrypt the received encrypted files and may store the decrypted files in a local file system of the host computer system, as described in more detail herein above.

At block440, the software provisioning agent may perform the software provisioning operations specified by the software provisioning command. In an illustrative example, the software provisioning agent may invoke or more functions of the software provisioning API implemented by the host computer system and/or by virtual machines running on the host computer system. Alternatively, the software provisioning agent may directly perform one or more file system operations on the host computer system, e.g., by invoking one or more functions of the file system API255implemented by the host computer system, as described in more detail herein above.

Upon completing the operations of block440, the method may terminate.

FIG.5depicts a flowchart of another example software provisioning method500performed by the TEE-resident software provisioning agent, in accordance with one or more aspects of the present disclosure. In some implementations, method500may be performed by a single processing thread executed by a processing device. Alternatively, method500may be performed by two or more processing threads executed by one or more processing devices, such that each thread would execute one or more individual functions, routines, subroutines, or operations of the method. In an illustrative example, the processing threads implementing method500may be synchronized (e.g., using semaphores, critical sections, and/or other thread synchronization mechanisms). Alternatively, the processing threads implementing method500may be executed asynchronously with respect to each other. Therefore, whileFIG.5and the associated description lists the operations of method500in certain order, various implementations of the method may perform at least some of the described operations in parallel and/or in arbitrary selected orders.

At block510, a software provisioning agent implementing the method may receive, from the host computer system, a software provisioning request identifying one or more software applications installed on the host computer system serviced by the software provisioning agent. The software provisioning request may further identify one or more software provisioning actions to be performed by the software provisioning agent with respect to each of the identified software applications.

At block520, the software provisioning agent implementing the method may forward the software provisioning request to the software provisioning controller, as described in more detail herein above.

At block530, the software provisioning agent may receive, from the software provisioning controller, a software provisioning command responsive to the software provisioning request. The software provisioning command may identify one or more files to be downloaded by the software provisioning agent from the software provisioning controller or from a software repository, as described in more detail herein above.

At block540, the software provisioning agent may retrieve, from the software provisioning controller and/or from the software repository specified by the software provisioning command, the files specified by the software provisioning command. The software provisioning agent may decrypt the received encrypted files and may store the decrypted files in a local file system of the host computer system, as described in more detail herein above.

At block550, the software provisioning agent may perform the software provisioning operations specified by the software provisioning command. In an illustrative example, the software provisioning agent may invoke or more functions of the software provisioning API implemented by the host computer system and/or by virtual machines running on the host computer system. Alternatively, the software provisioning agent may directly perform one or more file system operations on the host computer system, e.g., by invoking one or more functions of the file system API255implemented by the host computer system, as described in more detail herein above.

Upon completing the operations of block550, the method may terminate.

FIG.6depicts a block diagram of an illustrative computer system600operating in accordance with one or more aspects of the disclosure. In various implementations, computer system1000may perform the functions of to the host computer system120ofFIG.1. Computer system600comprises a memory610and one or more physical processors620A-620N, that are operatively coupled to the memory610and execute, within the TEE630, the code implementing the software provisioning methods300,400and/or500. The memory610may further store one or more software provisioning commands640and/or various configuration settings650, as described in more details herein above.

FIG.7depicts a high-level component diagram of an example computer system which may be employed to implement the systems and methods described herein. In various implementations, computer system1000may perform the functions of host computer system120ofFIG.1. In some implementations, computer system1000may be connected (e.g., via a network1030, such as a Local Area Network (LAN), an intranet, an extranet, or the Internet) to other computer systems. Computer system1000may operate in the capacity of a server or a client computer in a client-server environment, or as a peer computer in a peer-to-peer or distributed network environment. Computer system1000may be provided by a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, switch or bridge, or any device capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that device. Further, the term “computer” shall include any collection of computers that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methods described herein.

In a further aspect, the computer system1000may include a processing device1002, a volatile memory1004(e.g., random access memory (RAM)), a non-volatile memory1009(e.g., read-only memory (ROM) or electrically-erasable programmable ROM (EEPROM)), and a data storage device1016, which may communicate with each other via a bus1008.

Processing device1002may be provided by one or more processors such as a general purpose processor (such as, for example, a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, a microprocessor implementing other types of instruction sets, or a microprocessor implementing a combination of types of instruction sets) or a specialized processor (such as, for example, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), or a network processor).

Computer system1000may further include a network interface device1022. Computer system1000also may include a video display unit1010(e.g., an LCD), an alphanumeric input device1012(e.g., a keyboard), a cursor control device1014(e.g., a mouse), and a signal generation device1020.

Data storage device1016may include a non-transitory computer-readable storage medium1024on which may store instructions1026encoding any one or more of the methods or functions described herein, including instructions for implementing methods300,400and/or500of implementing a software provisioning agent residing in a TEE.

Instructions1026may also reside, completely or partially, within volatile memory1004and/or within processing device1002during execution thereof by computer system1000, hence, volatile memory1004and processing device1002may also constitute machine-readable storage media.

While computer-readable storage medium1024is shown in the illustrative examples as a single medium, the term “computer-readable storage medium” shall include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of executable instructions. The term “computer-readable storage medium” shall also include any tangible medium that is capable of storing or encoding a set of instructions for execution by a computer that cause the computer to perform any one or more of the methods described herein. The term “computer-readable storage medium” shall include, but not be limited to, solid-state memories, optical media, and magnetic media.

The methods, components, and features described herein may be implemented by discrete hardware components or may be integrated in the functionality of other hardware components such as ASICS, FPGAs, DSPs or similar devices. In addition, the methods, components, and features may be implemented by firmware modules or functional circuitry within hardware devices. Further, the methods, components, and features may be implemented in any combination of hardware devices and software components, or only in software.

Unless specifically stated otherwise, terms such as “updating”, “identifying”, “determining”, “sending”, “assigning”, or the like, refer to actions and processes performed or implemented by computer systems that manipulates and transforms data represented as physical (electronic) quantities within the computer system registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.

Examples described herein also relate to an apparatus for performing the methods described herein. This apparatus may be specially constructed for performing the methods described herein, or it may comprise a general purpose computer system selectively programmed by a computer program stored in the computer system. Such a computer program may be stored in a computer-readable tangible storage medium.

The methods and illustrative examples described herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used in accordance with the teachings described herein, or it may prove convenient to construct more specialized apparatus to perform methods400,500and/or each of their individual functions, routines, subroutines, or operations. Examples of the structure for a variety of these systems are set forth in the description above.

The above description is intended to be illustrative, and not restrictive. Although the present disclosure has been described with references to specific illustrative examples and implementations, it will be recognized that the present disclosure is not limited to the examples and implementations described. The scope of the disclosure should be determined with reference to the following claims, along with the full scope of equivalents to which the claims are entitled.