Parallel Virtual Machine Managers for Secure TPM Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud computing security approaches are limited in functionality, making it difficult to prevent unauthorized access to secured locations and protect customer secrets from compromised virtual machine managers.
Innovation Solution
Implementing parallel virtual machine managers, including a standard VMM and a security VMM with higher privileges, to manage access to a hardware trusted platform module (TPM) and create virtual TPMs for guest virtual machines, ensuring secure access and protection against unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional virtual machine manager approaches are used, then device complexity is reduced, but security reliability deteriorates due to limited functionality in preventing unauthorized access
Solution Approach 1:
The patent divides the virtual machine manager into two separate components: a standard VMM that handles general virtualization tasks and a security VMM that专门 manages security-critical operations and access to the hardware TPM. This segmentation allows each component to be optimized for its specific function, improving security reliability while keeping individual component complexities manageable.
Solution Approach 2:
The security VMM acts as an intermediary layer between the standard VMM and the hardware TPM. It mediates all access requests to the TPM, providing an additional security checkpoint that verifies the integrity of the standard VMM and the guest OS before allowing access to cryptographic secrets, thus enhancing security without requiring complete redesign of the virtualization stack.
2Adaptability or versatility
If parallel virtual machine managers are implemented, then security functionality is improved, but device complexity increases due to multiple VMM layers
Solution Approach 1:
The security VMM is designed to provide multiple security functions through a unified interface: it performs integrity verification of the standard VMM, manages the hardware TPM, creates virtual TPM instances for guest VMs, and controls access to cryptographic secrets. This multi-functionality approach enhances security adaptability while avoiding the need for separate specialized components for each security task.
Solution Approach 2:
The architecture implements a nested structure where the security VMM operates at a higher privilege level (ring -1 or supervisor mode) and encapsulates the standard VMM, which in turn manages guest virtual machines. The security VMM creates virtual TPM instances that are nested within the hardware TPM abstraction, providing layered security where each layer protects the layers below it.
3Reliability
If security VMM with higher privileges is used, then protection against compromised standard VMM is improved, but ease of operation deteriorates due to restricted access
Solution Approach 1:
The security VMM implements self-verification mechanisms where it continuously monitors and verifies its own integrity and the integrity of the standard VMM through measurements stored in the hardware TPM. This self-service approach to security verification maintains high protection reliability while automating the security checks, reducing the operational burden on users.
Solution Approach 2:
The system performs preliminary integrity verification of the standard VMM and guest OS before allowing access to the hardware TPM. The security VMM pre-establishes trust relationships and creates virtual TPM instances with pre-configured security policies, so that during normal operation, access requests are processed efficiently against pre-validated configurations rather than requiring complex real-time security decisions.
Data Source
AI summary
A processor on a host machine can concurrently operate a standard virtual machine manager (VMM) and a security VMM (SVMM), where the SVMM has a higher privilege level and manages access to a hardware TPM or other trusted source on the host machine. Such a configuration prevents a compromised VMM from gaining access to secrets stored in the hardware TPM. The SVMM can create a virtual TPM (vTPM) for each guest VM, and can seal information in each vTPM to the hardware TPM. A guest VM or the standard VMM can access information in the corresponding vTPM only through the corresponding SVMM. Such an approach enables the host to securely implement critical security functionality that can be exposed to customers, and provides protection against leakage of customer secrets in case of a security compromise.