Hardware Hypervisor TPM Shared Access State Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely managing shared access to a Trusted Platform Module (TPM) between a hypervisor and a guest operating system, balancing security and access requirements, as traditional methods complicate state management and introduce vulnerabilities if not properly synchronized.
Innovation Solution
A hardware hypervisor facilitates shared access to a TPM by accessing it prior to the guest OS boot, obtaining a software encryption key, determining the software identity, and sealing storage to maintain secure state compatibility, allowing time-based and locality-based access to ensure high security and synchronization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the hypervisor accesses the TPM prior to guest OS boot to obtain encryption keys and seal storage, then security is improved, but the complexity of state management increases
Solution Approach 1:
The hypervisor performs preliminary actions by accessing the TPM, obtaining encryption keys, and sealing storage before the guest OS boots. This ensures security requirements are met upfront while establishing a known good state for subsequent guest OS access.
Solution Approach 2:
The patent introduces a state management mechanism that acts as an intermediary between the hypervisor and guest OS for TPM access. This intermediary tracks TPM state transitions and coordinates access between different entities, reducing the overall system complexity.
2Reliability
If time-based and locality-based access control is implemented for TPM, then security is improved, but the difficulty of detecting and measuring access states increases
Solution Approach 1:
The system implements feedback mechanisms that track and report TPM access states based on time-based and locality-based policies. This feedback enables the system to monitor access patterns and detect state changes while maintaining security controls.
Data Source
Figure 1~2
Figure 3A
Figure 3B
AI summary
Examples relate to a hardware hypervisor that facilitates shared access to a Trusted Platform Module ("TPM") by the hypervisor and a guest operating system ("OS"). In some examples, the hypervisor implements machine readable instructions that cause the hypervisor to: access the TPM prior to boot of the guest OS; obtain a software encryption key stored at the TPM; determine, using the software encryption key, the software identity from an external storage; and leave the TPM in a state compatible for the guest OS.