Guest Event Processing in Hypervisor Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing systems in Cloud environments lack effective measures to ensure the confidentiality and privacy of guest data, as hypervisors can inspect and access sensitive information within virtual machines, posing security threats despite existing encryption methods.
Innovation Solution
A method is introduced where a firmware service processes guest events in a hypervisor-controlled system by selectively presenting a subset of information to the hypervisor, retaining sensitive data encrypted with a guest key, and performing modifications within protected memory, thereby restricting hypervisor access and maintaining data privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the hypervisor inspects and accesses guest data for processing, then the hypervisor can manage virtual machines effectively, but the confidentiality and privacy of guest data is compromised
Solution Approach 1:
The patent extracts sensitive guest data from the hypervisor's accessible memory space by implementing encrypted guest memory that the hypervisor cannot access. Guest data is stored in encrypted form in host memory, and only decrypted when actively used by the guest virtual machine, preventing the hypervisor from inspecting or accessing the data during storage.
Solution Approach 2:
The patent introduces an intermediary encryption layer between the guest data and the hypervisor. Encrypted guest memory uses encryption keys that are inaccessible to the hypervisor, creating a protective barrier that allows the hypervisor to manage virtual machines while preventing direct access to confidential guest data.
2Object-affected harmful factors
If encryption is applied to guest data, then data confidentiality is improved, but access efficiency and processing speed deteriorate
Solution Approach 1:
The patent applies preliminary action by pre-establishing encrypted guest memory regions and managing encryption keys in advance. The encryption framework is set up before data processing begins, allowing efficient encrypted operations without requiring real-time encryption/decryption overhead during normal data access operations.
Solution Approach 2:
The patent maintains continuity of useful action by keeping guest data encrypted in memory and only decrypting when actively needed by the guest virtual machine. This continuous encrypted state eliminates repeated encryption/decryption cycles, maintaining high access efficiency while preserving confidentiality throughout the data lifecycle.
Data Source
AI summary
The embodiments relate to a method for processing a guest event in a hypervisor-controlled system. A guest event triggers a first firmware service for the guest event in firmware. The guest event is associated with a guest, a guest state, and protected guest memory accessible only by the guest and the firmware. The firmware processes information associated with the guest event. The processed information includes information of the guest state and the protected guest memory. The hypervisor processes the guest event and sends a result to the firmware, triggering a second firmware service for the guest event. The firmware processes the result to generate modification associated with the guest event. The firmware performs the generated modification associated with the guest event at the protected guest memory.