Hypervisor TPM Command Filter for Secure VM Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual applications executing on a host machine are susceptible to unauthorized actions from a potentially compromised operating system, and existing methods such as direct communication with a Trusted Platform Module (TPM) driver stack are impractical due to the large code requirements.
Innovation Solution
Implementing a TPM filter within the hypervisor to intercept and monitor commands from an untrusted operating system, using shadow pages and cryptographic hashes to protect virtual machine communications, and ensuring only authorized commands reach the TPM.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a TPM driver stack is implemented to allow direct communication between the hypervisor and TPM, then secure communication between virtual applications and TPM is achieved, but the code size becomes impractically large
Solution Approach 1:
The patent extracts the essential TPM communication functionality from a full TPM driver stack and implements only the minimal required filter within the hypervisor. This filter intercepts and validates TPM commands without requiring the complete driver infrastructure, thus achieving secure communication while keeping code size manageable.
Solution Approach 2:
The patent introduces a command filter as an intermediary layer between the virtual applications and the TPM. This filter mediates all TPM communications, validating commands and ensuring security requirements are met, while avoiding the need for a full TPM driver stack in the hypervisor.
2Productivity
If the operating system directly communicates with the TPM, then communication efficiency is maintained, but the compromised OS can perform unauthorized actions on virtual machine registers
Solution Approach 1:
The patent inserts a command filter as an intermediary between the operating system and the TPM. This filter maintains communication efficiency by allowing direct OS-TPM paths for legitimate operations while blocking unauthorized access to virtual machine registers and sensitive TPM commands through intelligent command interception and validation.
Solution Approach 2:
The patent implements preliminary security validation through the command filter before TPM operations execute. The filter pre-validates commands to prevent unauthorized actions on virtual machine registers, blocking malicious operations before they can affect the system while allowing legitimate efficient communication to proceed.
Data Source
AI summary
In an example, a hypervisor measuring the state of a protected virtual machine using a Trusted Platform Module (TPM) filter. Using the TPM filter, the system ensures an untrusted operating system attempting to access the TPM is secure, without having to trust the security of the operating system or the operating system's built in hypervisor.