Secure Client-Hosted Virtualization Fuse Switch Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information handling systems lack secure and efficient methods for client-hosted virtualization, particularly in ensuring secure data processing, storage, and communication, especially in environments vulnerable to malicious software and data breaches.
Innovation Solution
The implementation of a secure client-hosted virtualization (CHV) architecture with a CHV manager that resides in secure memory, supports I/O port assignment, I/O security policies, pre-boot authentication, and full volume encryption, utilizing a fuse/switch bank to toggle between BIOS and CHV manager boot paths for enhanced security and isolation of virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure client-hosted virtualization architecture is implemented with CHV manager in secure memory, then security against malicious software is improved, but device complexity increases
Solution Approach 1:
The system is segmented into distinct security domains: the CHV manager in secure memory (immutable code) and virtual machines in non-secure memory (mutable code). This segmentation isolates security-critical functions from potential attacks, allowing enhanced security without requiring complete system redesign.
Solution Approach 2:
The CHV manager acts as an intermediary between the firmware and virtual machines, providing secure boot authentication and I/O port assignment. This intermediary layer enables security enforcement without requiring direct trust between all system components, reducing overall system complexity.
2Reliability
If fuse/switch bank is used to toggle between BIOS and CHV manager boot paths, then security and isolation are improved, but ease of operation decreases
Solution Approach 1:
The fuse/switch bank is configured in advance during system initialization or manufacturing to establish the boot path. This preliminary action ensures that security settings are locked in before operation, preventing runtime changes that could compromise security, while still allowing legitimate configuration changes through established procedures.
3Reliability
If full volume encryption and pre-boot authentication are implemented, then data security is improved, but productivity decreases
Solution Approach 1:
Authentication credentials and encryption keys are prepared in advance and stored securely in the CHV manager. During boot, these pre-prepared credentials are quickly verified rather than being generated or retrieved during the boot process, significantly reducing authentication overhead and maintaining productivity.
Data Source
AI summary
A client hosted virtualization system includes a processor to execute code, a non-volatile memory, and a switch. The memory includes code to implement a basic input/output system (BIOS) for the CHVS, and code to implement a virtualization manager. The virtualization manager is operable to initialize the CHVS, authenticate a virtual machine image associated with a virtual machine, and launch the virtual machine on the CHVS. The switch is operable to select one of a first state and a second state. The processor operates to execute the BIOS code when the switch is in the first state and to execute the virtualization manager code when the switch is in the second state.