Microsoft Technology Licensing, LLC

Jingbo Wu

Ran Kalach

Yevgeniy Anatolievich Samsonov

Abhinav Srivastava

Dinesh Haridas

Mark Fishel Novak

Samartha Chandrashekar

Kevin Michael Broas

Qiang Wang

Kinshumann Kinshumann

Michael Bishop Ebersol

Jin Lin

Lawrence Ralph Cleeton

David Kimler Altobelli

Yevgeniy A Samsonov

The techniques disclosed herein enable a system to configure a confidential virtual resource unit by provisioning a security component to a tenant's virtual resource unit. The system creates multiple different virtual trust layers within the confidential virtual resource unit. This creation effectively defines security boundaries between the virtual trust layers. The virtual trust layers are associated with different privileges, such that a higher privileged virtual trust layer is provided with more privileges compared to a lower privileged virtual trust layer. In one example, a lower privileged virtual trust layer may include basic virtual resource components (e.g., drivers, applications, processes, functions, workloads executing within a guest operating system) and a higher privileged virtual trust layer is the location to which a virtual security component is provisioned by the system.

Provisioning a security component from a cloud host to a guest virtual resource unit

Techniques are described herein that are capable of establishing system integrity using attestation for a virtual trusted platform module (vTPM). For instance, an endorsement key certificate, including an endorsement key associated with the vTPM, may be signed to issue the endorsement key certificate to the vTPM. The endorsement key certificate may be used to establish a chain of trust with regard to the vTPM. For instance, the endorsement key certificate may be used to attest the vTPM (and measurements provided by the vTPM).

System integrity using attestation for virtual trusted platform module

A facility for booting a virtual machine hosted on a host is described. In one example facility, the facility boots the virtual machine in accordance with a policy instance associated with the virtual machine. As part of the booting, the facility extracts information needed to complete the booting from a virtual trusted platform module associated with the virtual machine, the extraction based upon the policy instance associated with the virtual machine. At the completion of the booting, the facility copies contents of a policy instance associated with the host into the policy instance associated with the virtual machine.

Upgrading a secure boot policy on a virtual machine

Described is the backup and/or restore of virtual disks In general, metadata is backed up for restoring a virtual disk. To restore the disk, a physical disk is created, with the virtual disk the created on a partition of the physical disk. Backup and restore is described for nested virtual disks, including for block level restore. Further described is backing up of critical virtual disks and their containers, and virtual disk backup with respect to basic disks and dynamic volumes.

Recovery of a computer that includes virtual disks

Growing community of inventors

Medina, WA, United States of America

Jingbo Wu