Microsoft patents secure cloud startup using hardware checks
Microsoft describes a method for setting up a 'sovereign' cloud, which is a private cloud operated by a specific country or organization. During startup, the system uses a secure chip called a Trusted Platform Module to verify that its core security keys are genuine. This hardware check is sent to a third-party service to confirm the cloud's identity before it receives a digital certificate to operate.
In the filing’s own words
Systems and methods for provisioning a sovereign cloud root certificate, retrieve, during a boot process of a sovereign cloud, a root certificate from a first source; measure a cryptographic measurement of the root certificate in a Trusted Platform Module (TPM) of the sovereign cloud, which is stored in a Platform Configuration Register (PCR) of the TPM; generate a Certificate Signing Request (CSR) including the TPM-stored measurement for a leaf certificate based on the PCR; transmit the CSR to a certificate authority for verification; wherein the CSR is forwarded to a Hardware Attestation Service (HAS) for attestation; receiving an attestation result at the certificate authority, the attestation result indicating whether the CSR is valid; and based on the attestation result, receive by the sovereign cloud, the leaf certificate when the attestation result is positive, or a rejection of the CSR when a discrepancy is detected.
What exactly they claim (claim 1)
1. A method for provisioning a sovereign cloud root certificate, comprising: during a boot process of a sovereign cloud, retrieving a root certificate from a first source; measuring a cryptographic measurement of the root certificate in a Trusted Platform Module (TPM) of the sovereign cloud; wherein the cryptographic measurement is stored in a Platform Configuration Register (PCR) of the TPM; generating a Certificate Signing Request (CSR) for a leaf certificate based on the PCR, the CSR comprising at least the TPM-stored measurement of the root certificate; transmitting the CSR to a certificate authority for verification; wherein the CSR is forwarded to a Hardware Attestation Service (HAS) for attestation, and wherein the HAS is configured to verify the CSR; receiving an attestation result at the certificate authority, the attestation result indicating whether the CSR is valid; and based on the attestation result, receiving by the sovereign cloud, the leaf certificate when the attestation result is positive, or a rejection of the CSR when a discrepancy is detected.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- SYSTEMS AND METHODS FOR PROVISIONING A SOVEREIGN CLOUD ROOT CERTIFICATE
- Publication number
- US20260261437A1
- Application number
- 19067825
- Filed
- Feb 28, 2025
- Published
- Sep 3, 2026
- Inventors
- 6
- Claims
- 20
Classified under
H04L 9/3268 Electricity & electronicsG06F 21/575 Physics & computingG06F 2221/034 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.