Abstract: Methods and apparatus are disclosed to protect an operating system booted by a client computing device and provided by a server computing device. One such method includes requesting a trusted platform module of the client computing device to unseal a sealed encryption key, and receiving an encrypted operating system via a network in response to initiating a boot process of the client computing device. The illustrative method also includes decrypting the encrypted operating system received via the network using an unsealed encryption key obtained in response to requesting the trusted platform module to unseal the sealed encryption key, and executing the decrypted operating system.

Abstract: A technique includes providing a virtual machine within a first enclave and a second enclave. A virtual machine is used as a proxy to negotiate a connection between the first enclave and the second enclave.