US 12,143,506 B2
Establishing PKI chain of trust in air gapped cloud
Pu Liu, Carnation, WA (US); Yingchang Charley Zhang, Redmond, WA (US); Sahil S. Chavan, Redmond, WA (US); Deyang Gu, Mercer Island, WA (US); Lucius B. Fleuchaus, Redmond, WA (US); Akshay Kishor Kulkarni, Redmond, WA (US); and David Nunez Tejerina, Redmond, WA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed on Jan. 26, 2022, as Appl. No. 17/585,198.
Prior Publication US 2023/0239163 A1, Jul. 27, 2023
Int. Cl. H04L 9/32 (2006.01); H04L 9/08 (2006.01)
CPC H04L 9/3263 (2013.01) [H04L 9/0825 (2013.01); H04L 9/3236 (2013.01); H04L 9/3247 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for establishing a PKI (Public Key Infrastructure) chain of trust in an isolated cloud computing environment, comprising:
receiving a digital leaf certificate in the isolated cloud computing environment, the digital leaf certificate being rooted to a first root certificate in a non-isolated PKI chain of trust in a non-isolated cloud computing environment and the digital leaf certificate including a first object identifier value,
wherein the digital leaf certificate is received to support establishing the PKI chain of trust rooted in a second root certificate for the isolated cloud computing environment;
obtaining a second root certificate in the isolated cloud computing environment;
signing the second root certificate with a private key of the digital leaf certificate to generate a signed blob;
storing the signed blob to a predetermined storage location in the isolated cloud computing environment;
executing a bootstrap executable configured with a second object identifier value;
obtaining the signed blob from the predetermined storage location in the isolated cloud computing environment;
verifying the signed blob with the digital leaf certificate;
when the signed blob is verified, comparing the first object identifier value from the digital leaf certificate to the second object identifier value from the bootstrap executable;
when the first and second object identifier values match, installing a PKI chain of trust rooted in the second root certificate for the isolated cloud computing environment; and
distributing the second root certificate in the isolated cloud computing environment to secure communications within the isolated cloud computing environment.