Secure Performance Counters for Guest VM Side-Channel Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Side-channel and covert-channel attacks exploit architecture performance counters (APCs) to exfiltrate confidential information, posing a threat to secure computing environments, and existing solutions fail to adequately prevent such attacks.
Innovation Solution
Implementing secure performance counters by allowing access to APCs only through a trusted secure processor, with authorization from the guest, thereby preventing unauthorized access by malicious hypervisors and guests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If architecture performance counters are made accessible for monitoring and debugging purposes, then system diagnostics capability is improved, but security against side-channel attacks deteriorates
Solution Approach 1:
The patent segments the performance counter access rights by creating distinct authorization levels: guest virtual machines, hypervisors, and secure processors each have controlled access to specific counter sets. This segmentation allows diagnostics capability to be maintained for authorized entities while preventing malicious access vectors that enable side-channel attacks.
Solution Approach 2:
The patent introduces a secure processor as an intermediary layer between performance counters and accessing entities. This intermediary enforces authorization policies, allowing legitimate diagnostic access while blocking unauthorized access attempts that could lead to information leakage through side-channel attacks.
2Object-affected harmful factors
If performance counters are restricted to prevent attacks, then security is improved, but ability to monitor and debug system performance deteriorates
Solution Approach 1:
The patent applies local quality by granting different access permissions to different entities for different performance counters. Authorized entities such as the secure processor and hypervisor can access specific counters for monitoring and debugging, while unauthorized entities are blocked, thus maintaining both security and operational capability.
Solution Approach 2:
The patent creates a universal authorization framework that serves multiple functions: it enables security protection against attacks, maintains performance monitoring capability for authorized entities, and provides a flexible policy enforcement mechanism that can adapt to different diagnostic and security requirements simultaneously.
3Object-affected harmful factors
If blanket security measures are implemented to block all access to performance counters, then protection against attacks is improved, but system flexibility and adaptability deteriorate
Solution Approach 1:
The patent implements dynamic access control where authorization decisions are made in real-time based on the identity and permissions of the accessing entity. The secure processor evaluates authorization policies dynamically, allowing flexible adaptation to different access requests while maintaining consistent security protection, rather than applying static blanket restrictions.
Data Source
AI summary
The disclosed computing device can include guest circuitry configured to provide a virtual function, authorization circuitry configured to authorize host circuitry to access an architecture performance counter for the virtual function, and security circuitry configured to perform a security action based on the authorization. Various other methods, systems, and computer-readable media are also disclosed.