Attestation Protocol for Secure Guest OS Booting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional virtualization stacks in cloud computing are large and vulnerable to security threats, allowing malicious software to compromise entire physical servers or other servers, due to their extensive code base and inclusion of unnecessary virtual devices.
Innovation Solution
A reduced virtualization stack is implemented on production servers, excluding extraneous and legacy devices, with a dedicated boot server providing a complete stack for guest OS booting, isolated from the network during initialization, and using an attestation protocol to ensure clean mode operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional virtualization stack is used on production servers, then guest OS booting functionality is complete, but security vulnerabilities increase due to large code base and unnecessary virtual devices
Solution Approach 1:
The system is divided into two separate servers: a production server with a minimized virtualization stack for secure operation, and a dedicated boot server with a complete virtualization stack for guest OS booting. This segmentation allows each server to have the appropriate level of functionality for its specific purpose, reducing overall security vulnerabilities while maintaining complete booting capability.
Solution Approach 2:
The boot server functionality is extracted from the production server. The production server's virtualization stack is stripped down to only essential components needed for secure production operation, while the dedicated boot server holds the complete virtualization stack required for booting guest OS with all virtual devices.
2Reliability
If a minimized virtualization stack is used on production servers, then security vulnerabilities are reduced, but guest OS booting capability is lost
Solution Approach 1:
The dedicated boot server acts as an intermediary between the production server and guest OS booting requirements. When a guest OS needs to boot, the production server requests the boot server to perform the booting operation. The boot server uses its complete virtualization stack to provide all necessary virtual devices for guest OS booting, then transfers the booted guest OS image back to the production server.
3Ease of operation
If the boot server is connected to the network during guest OS booting, then network functionality is available, but malicious software can compromise other devices
Solution Approach 1:
The boot server is isolated from the network as a preliminary security measure before guest OS booting occurs. This prevents malicious software that may be present in the guest OS from compromising other networked devices during the vulnerable booting process. The boot server is connected to the network only after the guest OS has successfully booted and been transferred to the production server.
Solution Approach 2:
Network isolation is applied as a preliminary anti-action to prevent potential malicious software from spreading. By disconnecting the boot server from the network during guest OS booting, the system proactively blocks the propagation path for any malicious code that might be introduced during the boot process.
Data Source
AI summary
In a cloud computing environment, a production server virtualization stack is minimized to present fewer security vulnerabilities to malicious software running within a guest virtual machine. The minimal virtualization stack includes support for those virtual devices necessary for the operation of a guest operating system, with the code base of those virtual devices further reduced. Further, a dedicated, isolated boot server provides functionality to securely boot a guest operating system. The boot server is isolated through use of an attestation protocol, by which the boot server presents a secret to a network switch to attest that the boot server is operating in a clean mode. The attestation protocol may further employ a secure co-processor to seal the secret, so that it is only accessible when the boot server is operating in the clean mode.