Hypervisor-Controlled Firmware for Encrypted VM Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory encryption methods for virtual machines are either performance-degrading when guest-driven or insecure when hypervisor-driven, especially when dealing with malicious or vulnerable hypervisors, and they struggle to facilitate communication between encrypted virtual machines and virtual devices.
Innovation Solution
Implementing hypervisor-controlled firmware that generates an emulated firmware module to encrypt guest memory, reserving specific unencrypted ranges for communication and using ephemeral encryption keys, allowing the hypervisor to manage encrypted memory while protecting the virtual machine from malicious hypervisors and enabling secure communication with virtual devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If guest-driven memory encryption is implemented, then virtual machine security is improved, but system performance deteriorates
Solution Approach 1:
The patent introduces an intermediary encryption management component that mediates between the guest virtual machine and the encryption hardware. This intermediary handles encryption operations transparently, allowing the guest to maintain security while avoiding the performance penalties of guest-driven encryption by offloading encryption management to a specialized component.
2Ease of manufacture
If hypervisor-driven memory encryption is implemented, then implementation simplicity is improved, but security against malicious hypervisors deteriorates
Solution Approach 1:
The patent segments the encryption control authority by separating the encryption key management from the hypervisor. The encryption keys are generated and managed by a dedicated encryption management component that operates independently from the hypervisor, preventing malicious or vulnerable hypervisors from accessing encryption keys while maintaining implementation simplicity through centralized key management.
Solution Approach 2:
The patent introduces an intermediary encryption management component that acts as a trusted mediator between the hypervisor and the encryption hardware. This intermediary protects against malicious hypervisors by preventing them from accessing encryption keys while still allowing them to manage encrypted virtual machines, thus maintaining security without sacrificing implementation simplicity.
3Reliability
If full guest memory is encrypted, then security is improved, but communication with virtual devices becomes difficult
Solution Approach 1:
The patent applies local quality by creating differentiated encryption zones within guest memory. Specifically, it designates certain memory regions (such as those used for device communication) with different encryption properties than the rest of guest memory. This allows secure encryption of sensitive data while maintaining ease of communication in designated regions, resolving the contradiction between full encryption and device communication capability.
Data Source
AI summary
Systems and methods for encryption support for virtual machines. An example method may comprise initializing, by a firmware module associated with a virtual machine running on a host computer system, an exclusion range register associated with the virtual machine with a value specifying a first portion of guest memory. The first portion of the guest memory may include an exclusion range marked as reserved. The second portion of the guest memory may b e encrypted using an ephemeral encryption key. Virtual machine firmware may identify, in the second portion of the guest memory, an instruction to a virtual device associated with the virtual machine, copy data corresponding to the instruction to the first portion of guest memory, and alert the hypervisor of the data stored in the first portion of guest memory.