BACKGROUND

The field of the disclosure relates generally to management of computer networks, and more particularly, to authentication and trust establishment within such networks.

It is well known in the industry that computer networks face many difficulties confirming the authenticity of hypervisors and operating systems. The conventional networks also confront problems authenticating applications software in the subsequent execution chain thereof, before this software has been executed. One conventional solution to such problems has been standardized (e.g., by the Trusted Computing Group (TCG)), but this standardized solution has been applied to a single host, that is, the solution is pertinent only to a single host in a data center.

Conventional trust establishment models utilize a hardware root of trust. Such hardware roots of trust aim to establish a tamper-resistant “black box” that can perform cryptographic operations, such as encryption, decryption, and hashing, using built-in cryptographic keys. Examples of such hardware roots of trust include the Trusted Platform Module TPM) and the Hardware Security Module (HSM). “Shrink-wrapped” software is then authenticated by the hardware “black box,” based on a vendor signature for the software. The hardware root of trust scheme has also been used for remote attestation, with the attestation being typically performed by a third party and/or a Cloud services user.

Remote attestation solutions have also been standardized, by the European Telecommunication Standards Institute (ETSI), for the Network Function Virtualization (NFV) environment. These standards though, have not been integrated into the modern Cloud environment. Accordingly, there is a need for reliable attestation techniques that can be performed (i) for all hosts within all data centers in the Cloud, and not limited to only a single host, (ii) by the Cloud provider, as opposed to a third party (e.g., user of services provided by a particular host), and (iii) in a manner that does not rely on the actions directed by the virtual machine itself, but rather a trusted management entity under the control of the Cloud provider.

BRIEF SUMMARY

In an embodiment, a remote attestation system for a computer network includes an attestation operations subsystem configured to manage attestation procedures for the remote attestation system, and an attestation server pool including a plurality of attestation servers. The plurality of attestation servers is configured to perform attestation of at least one host in a data center. The system further includes an attestation state database configured to store a state of attestation of the at least one host, an attestation policy database configured to store at least one operator policy of the computer network, and an end-user service portal configured to provide access to the remote attestation system by users of the computer network.

In an embodiment, a computer network includes a remote attestation system including an operations subsystem, at least one server, a policy database, and a state database, a computing architecture, and at least one mapping scheme. The remote attestation system is mapped into the computing architecture according to the at least one mapping scheme.

