Red Hat, Inc.

Daniel P Berrange

Dmitri Pal

Simo Sorce

Responsive to a request for an encrypted confidential virtual machine (CVM) disk image, an unencrypted CVM disk image, an image signature, and a public key associated with the image signature is obtained. The CVM disk image is encrypted to produce an encrypted CVM disk image. Full disk encryption (FDE) is applied against the encrypted CVM disk image to obtain an FDE header. A concatenation of the image signature, the public key associated with the image signature, and the FDE header is signed to obtain an image encryption service (IES) signature. The IES signature and associated certificate chain are written to the extensible firmware interface system partition (ESP) of the encrypted CVM disk image.

Attesting on-the-fly encrypted root disks for confidential virtual machines

In one embodiment, a mechanism for providing a trusted environment for provisioning a virtual machine is disclosed. In one embodiment, a method includes beginning an initialization process of a virtual machine (VM) hosted by a VM host server, obtaining by the VM as part of the initialization process a one-time password from the VM host server, the one-time password provided to the VM host server from a management server that created the one-time password, and authenticating the VM with an identity server using the one-time password.

Providing a trusted environment for provisioning a virtual machine

A secure Virtual Network Computing (VNC) connection between a server and a client is authenticated using a series of message exchanges. A server receives a request from a client to establish a VNC connection. If the request indicates that the client supports an encryption scheme, the server provides a first set of mechanisms for a subsequent authentication process. If the request indicates that the client does not support the encryption scheme, the server provides the client a second set of mechanisms for the subsequent authentication process. The second set contains fewer mechanisms than the first set. The client chooses an authentication mechanism from the first set or the second set provided by the server. The server and the client then perform the subsequent authentication process, using the authentication mechanism chosen by the client, with a series of message exchanges.

Growing community of inventors

London, United Kingdom

Daniel P Berrange