Hypervisor Secure Event Handling for Guest VMs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computing environments, the hypervisor can potentially access and manipulate guest data or operations, posing a security risk.
Innovation Solution
The hypervisor's access to the event handling pathway of a guest virtual machine is restricted, with a secure layer managing security and accessing event information from a specified region of memory, while non-secure layers handle event processing only if the information complies with security protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the hypervisor manages provision of hardware resources to multiple virtual machines, then system resource utilization and productivity are improved, but security risks increase as the hypervisor becomes an avenue for maliciously accessing guest data
Solution Approach 1:
The event handling pathway is segmented into secure and non-secure portions. The secure portion includes secure event handling registers and secure event queues that are inaccessible to the hypervisor, while non-secure portions handle routine event processing. This segmentation allows the hypervisor to manage resources efficiently while preventing malicious access to secure guest data through the event handling pathway.
2Reliability
If the hypervisor provides a layer of isolation between different guests, then guest data security is improved, but the hypervisor itself becomes a potential attack vector for improperly manipulating guest operations
Solution Approach 1:
A secure layer is introduced as an intermediary between the hypervisor and the event handling pathway. This secure layer includes secure event handling registers and secure event queues that act as a mediator, allowing the hypervisor to initiate event handling while preventing direct access to secure guest data. The secure layer verifies and filters events before they reach guest handlers, blocking malicious events while allowing legitimate ones to pass through.
3Speed
If the hypervisor has direct access to event handling pathways, then event processing speed is improved, but security compliance checking is compromised
Solution Approach 1:
Security checks are performed in advance through the secure layer before events reach the guest event handlers. The secure event handling registers and secure event queues pre-validate events against security protocols, filtering out malicious events before they can compromise guest security. This preliminary security verification maintains fast event processing for legitimate events while blocking harmful ones at the secure layer.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A virtualized computing environment is protected from a malicious hypervisor by restricting the hypervisor's access to one or more portions of an event (interrupt or exception) handling pathway of a guest virtual machine, wherein the guest virtual machine includes both a secure layer to manage security for the guest and one or more non-secure layers to handle event processing. The hypervisor is restricted from providing normal exception information to the guest virtual machine (referred to simply as a "guest" herein), and instead is only permitted to provide an event signal to the secure layer of the guest. In response to the event signal, the secure layer of the guest accesses a specified region of memory for the event information, reviews the information, and provides the information to another, non-secure, layer of the guest for processing only if the event information complies with specified security protocols.