Hypervisor Antivirus Checks in Encrypted Trusted Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hypervisor-level antivirus solutions face challenges in scanning encrypted guest memory, as accessing encrypted memory from the hypervisor is impossible, limiting their effectiveness in trusted execution environments like encrypted virtual machines.
Innovation Solution
Introducing trusted code that includes a condition checker, loaded into encrypted memory by boot firmware, which is verified by both the hypervisor and guest, allowing the hypervisor to execute antivirus checks within the encrypted environment without modifying the trusted code, ensuring full access to encrypted memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If the hypervisor attempts to scan guest memory for antivirus purposes, then security detection capability is improved, but the ability to access encrypted memory is blocked
Solution Approach 1:
The patent introduces trusted code as an intermediary component that resides within the encrypted trusted execution environment but can be accessed and executed by the hypervisor. This trusted code includes a condition checker that the hypervisor can invoke to scan guest memory for viruses, effectively mediating between the hypervisor's security needs and the encrypted memory's protection requirements.
Solution Approach 2:
The patent segments the memory access authority by introducing a separate trusted code module with specific permissions. Instead of giving the hypervisor direct access to all encrypted memory, the system divides functionality so that the trusted code handles specific security checking tasks, allowing selective access to encrypted memory only when needed for virus detection.
2Measurement precision
If the hypervisor is given direct access to encrypted guest memory, then antivirus scanning effectiveness is improved, but security protection of the encrypted environment is compromised
Solution Approach 1:
The trusted code serves as a secure intermediary that the hypervisor uses to access encrypted memory for scanning purposes. The hypervisor does not directly access encrypted memory; instead, it invokes the trusted code's condition checker, which temporarily accesses the encrypted memory under controlled conditions and returns only the necessary security information, maintaining encryption integrity while enabling detection.
Solution Approach 2:
The trusted execution environment provides self-service security checking through its own trusted code and condition checker. The encrypted environment has built-in capabilities for virus detection that can be activated by the hypervisor, allowing the system to maintain security while performing antivirus scans without external intervention that would compromise encryption.
Data Source
AI summary
A system includes a hypervisor, a memory, and boot firmware stored in the memory. The boot firmware is configured to execute on a processor to load a trusted code that includes a condition checker from the hypervisor, check a signature of the trusted code, and verify the signature is trusted by a guest. The boot firmware is also configured to load the trusted code into an encrypted memory at a known guest address. The hypervisor is configured to protect the known guest address. The trusted code includes a first instruction, one or more intermediate instructions, and a final instruction. The first instruction and the final instruction are exits to the hypervisor. The hypervisor is also configured to execute the condition checker and detect an inconsistency in guest memory.