PCIe Trust Domains for Virtual Machine Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In modern computer systems using virtualization, the security vulnerability arises when PCIe devices connected to the same switch are allowed to perform peer-to-peer transactions without IOMMU evaluation, potentially enabling malicious access to memory allocated to other virtual machines, leading to side-channel attacks.
Innovation Solution
Implementing trust domains through unique trust identifiers for PCIe devices and virtual machines, allowing the hypervisor to enable or disable direct routing of Translated Memory Requests between PCIe devices connected to the same switch, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If Address Control Services (ACS) are enabled for peer-to-peer transactions, then routing efficiency is improved, but security is worsened because PCIe TLPs are not sent to the IOMMU to evaluate permission
Solution Approach 1:
The patent introduces a trust identifier verification mechanism as an intermediary between PCIe devices and the IOMMU. The hypervisor assigns trust identifiers to PCIe devices and virtual machines, and the PCIe switch verifies these identifiers before allowing peer-to-peer transactions. This intermediary layer maintains routing efficiency while adding security evaluation, resolving the contradiction between speed and reliability.
2Productivity
If direct routing of peer-to-peer Translated Memory Requests is enabled, then transaction speed is improved, but security against side-channel attacks is worsened
Solution Approach 1:
The patent implements preliminary action by having the hypervisor assign trust identifiers to PCIe devices and virtual machines before transactions occur. The PCIe switch is pre-configured with these trust identifiers and uses them to verify device permissions before allowing direct memory access. This preliminary verification enables fast direct routing while preventing side-channel attacks, as the security check is performed in advance rather than during the transaction.
3Adaptability or versatility
If multiple virtual machines share a PCIe switch with PCIe devices, then resource utilization is improved, but security isolation between virtual machines is worsened
Solution Approach 1:
The patent applies local quality by assigning unique trust identifiers to each virtual machine and its associated PCIe devices. The PCIe switch verifies the trust identifier of each device initiating a peer-to-peer transaction, ensuring that only devices within the same trust domain can communicate directly. This local verification mechanism enables multiple virtual machines to share the PCIe switch for improved resource utilization while maintaining strict security isolation between them.
Data Source
AI summary
Disclosed are various embodiments for various approaches for implementing trust domains to provide boundaries between PCIe devices connected to the same PCIe switch. A first trust identifier can be assigned to a first virtual machine hosted by the computing device. The first trust identifier can also be assigned to a first PCIe device assigned to the first virtual machine. Later, it can be determined that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine. An Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch can be disabled in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine.