Multi-Layer Kernel Isolation for Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Businesses handling sensitive data are hesitant to migrate to public clouds due to lack of trust in cloud providers, and confidential virtual machines lack VM-level backward compatibility, requiring non-trivial changes in guest OS kernels to run securely.
Innovation Solution
Loading two independent firmware kernel layers with different privilege levels onto a hosting environment, where the higher privilege layer is isolated and controls access to memory and storage, providing trusted services without performance overhead and eliminating the need for UEFI in the boot order.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single kernel layer is used in the hosting environment, then the system structure is simple and easier to operate, but security is compromised because the kernel cannot be isolated from untrusted hypervisor software
Solution Approach 1:
The kernel is divided into two distinct privilege levels: a first privilege level kernel layer that runs untrusted hypervisor software, and a second privilege level kernel layer that runs trusted virtual machine software. This segmentation isolates the untrusted components from the trusted components, allowing security to be improved without requiring a complete redesign of the entire system. Each layer operates independently with its own memory space and execution context.
2Reliability
If trusted platform modules are used to encrypt data, then confidentiality is improved, but trust in the hosting environment software dependencies is still required which undermines security
Solution Approach 1:
The trusted execution environment is extracted from the untrusted hosting environment by creating a separate second privilege level kernel layer that is isolated from the first privilege level layer. This extraction removes the trust dependency on hosting environment software because the trusted virtual machine software runs in an isolated context that does not rely on the integrity of the untrusted hypervisor layer. The trusted layer can independently enforce security policies and protect sensitive data without requiring trust in external software components.
3Ease of operation
If VM-level backward compatibility is enforced, then ease of operation is improved, but security is compromised because guest OS kernels cannot run securely without modifications
Solution Approach 1:
The first privilege level kernel layer acts as an intermediary between the untrusted hosting environment and the second privilege level kernel layer that runs trusted virtual machine software. This intermediary layer provides the necessary interface and translation mechanisms to maintain backward compatibility with existing guest OS kernels while simultaneously enabling security through isolation. The intermediary handles the complexity of security enforcement, allowing guest OS kernels to run with minimal modifications while still achieving secure execution.
Data Source
AI summary
A computer implemented method includes loading a first kernel layer having a first privilege level onto a hosting environment. A second kernel layer having a second privilege level different from the first privilege level is also loaded onto the hosting environment. The first kernel layer is isolated from the second kernel layer and access to a hosting environment memory protection table is controlled via the first kernel layer.