Execute-Only Code Trusted Channel for VMs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure communications between computing system entities, such as applications or virtual machines, are complex and performance-intensive, often requiring a trusted third party for intermediation, which can lead to undesirable trade-offs between security and performance, especially in time-sensitive scenarios.
Innovation Solution
The implementation of execute-only (XO) code properties to create a lightweight trusted communication channel between entities, leveraging page table mechanisms and transactional methods to isolate and protect secrets, reducing the need for continuous intervention by a trusted third party and minimizing overhead costs compared to trusted execution environment (TEE) approaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a trusted third party entity (operating system, virtual machine monitor) intermediates secure communications between separate entities, then security is improved, but performance deteriorates due to additional overhead and continual intervention requirements
Solution Approach 1:
The patent performs security setup in advance by provisioning execute-only code regions and secrets during channel establishment. The trusted agent configures memory pages with execute-only attributes and embeds secrets in immediate operands of instructions before the entities begin communication. This preliminary security configuration eliminates the need for continual trusted agent intervention during actual communications, resolving the contradiction between security and performance.
Solution Approach 2:
The patent extracts the trusted agent from the communication path after initial setup. By using execute-only code regions with embedded secrets, the system removes the need for the trusted third party to be present during actual data exchanges. The entities can communicate securely directly with each other, taking out the performance bottleneck while maintaining security through the isolated execute-only regions.
2Reliability
If a trusted execution environment (TEE) is used to enable secure communication, then security is improved, but device complexity and overhead increase due to entering/exiting TEE operations
Solution Approach 1:
The patent creates a lightweight copy of TEE functionality using execute-only code regions in standard memory. Instead of requiring full TEE hardware and software stacks, the invention copies the essential security property (unreadable executable code) into regular memory pages with special attributes. This approach provides TEE-like security without the complexity of actual TEE entry/exit operations, resolving the contradiction between security and device complexity.
Solution Approach 2:
The patent uses disposable execute-only code regions that can be easily created and destroyed without expensive TEE context switches. Each secure channel uses its own isolated execute-only region with embedded secrets, which can be provisioned quickly by the trusted agent and discarded when no longer needed. This eliminates the heavy overhead of TEE while maintaining security through temporary, isolated execution regions.
3Reliability
If page table mechanisms are used to isolate execute-only regions, then security is improved through secret protection, but device complexity increases
Solution Approach 1:
The patent makes the page table mechanism serve multiple functions: it both isolates execute-only regions for security and enables efficient address translation for normal memory access. By using the existing page table infrastructure to enforce execute-only attributes and protect secrets, the system achieves strong secret protection without adding separate complex isolation mechanisms. The page tables universally handle both memory management and security enforcement, resolving the contradiction between security and device complexity.
Data Source
AI summary
In one embodiment, an apparatus includes a first virtual machine (VM) including an encryption logic to encrypt first information. The encryption logic may include a first code block stored in a first execute-only region of a memory to encrypt the first information with a first key provisioned by a trusted agent, the first key stored in the first code block. The apparatus may further include a second VM including a decryption logic to decrypt the first information, and a shared buffer to enable secure communication of the encrypted first information from the first VM to the second VM, without involvement of the trusted agent. Other embodiments are described and claimed.