Multi-Part Metadata for Secure Guest Startup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing environments struggle to securely facilitate access to confidential data for secure guests while maintaining integrity and confidentiality, as traditional hypervisors lack trustworthiness and can modify guest states.
Innovation Solution
A computer program product utilizing multi-part metadata with integrity measures to verify and protect secure guest images, allowing separate handling of vendor-specific and customer-specific confidential data, ensuring secure guest startup and data access without compromising integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional hypervisor is used to host secure guests, then the hypervisor can fully control and inspect guest memory, but the hypervisor cannot be trusted to maintain integrity and confidentiality of guest states
Solution Approach 1:
The metadata is divided into multiple parts with different security requirements. Vendor-specific confidential data and customer-specific confidential data are separated into different metadata parts, allowing selective integrity verification and access control. This segmentation enables the system to provide fine-grained trust management where different portions of metadata can be verified by different entities at different times.
Solution Approach 2:
The patent introduces an intermediary mechanism where metadata acts as a trusted carrier between the secure guest and the external environment. The metadata contains integrity measures that allow the secure guest to verify the authenticity of confidential data without directly trusting the hypervisor. This intermediary structure enables secure data exchange while maintaining guest isolation and trust.
2Ease of operation
If confidential data is provided to secure guests, then the guests can access necessary information, but the integrity and confidentiality of the data must be maintained
Solution Approach 1:
Integrity measures are computed and stored in metadata before the secure guest starts execution. This preliminary action allows the guest to verify the integrity of confidential data upon receipt without needing to recompute verification during runtime. The metadata is prepared in advance with all necessary integrity checks embedded, enabling efficient and secure data access during guest execution.
Solution Approach 2:
The patent changes the state of confidential data from unverified to verified through integrity checking. By transforming the data representation and adding verification parameters (integrity measures) to the metadata, the system enables the secure guest to distinguish between authentic and tampered data. This parameter change approach allows the guest to safely use confidential data while maintaining confidence in its integrity.
3Reliability
If the secure guest image is protected when loaded, then integrity is maintained, but additional verification mechanisms are required
Solution Approach 1:
The patent merges the integrity verification mechanism with the metadata structure itself. Rather than adding separate verification systems, the integrity measures are embedded directly within the metadata that already contains confidential data. This merging reduces overall system complexity by combining multiple functions (data storage, integrity verification, and access control) into a unified metadata structure.
4Reliability
If multi-part metadata with integrity measures is used, then verification and protection are enhanced, but the metadata structure becomes more complex
Solution Approach 1:
The metadata is divided into multiple parts with different security requirements. Vendor-specific confidential data and customer-specific confidential data are separated into different metadata parts, allowing selective integrity verification and access control. This segmentation enables the system to provide fine-grained trust management where different portions of metadata can be verified by different entities at different times.
Solution Approach 2:
The metadata structure is designed to serve multiple functions simultaneously: storing confidential data, providing integrity verification, and enabling access control. Each metadata part can be independently verified and used by different components of the system. This multi-functionality reduces the need for separate structures for each function, thereby managing complexity while enhancing reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A trusted execution environment obtains a secure guest image and metadata to be used to start a secure guest. The metadata includes multiple parts and a plurality of integrity measures. A first part of the metadata includes one or more integrity measures of the plurality of integrity measures, and a second part of the metadata includes customized confidential data of the secure guest and one or more other integrity measures of the plurality of integrity measures. The trusted execution environment is used to verify at least one select part of the metadata using at least one integrity measure of the plurality of integrity measures of the metadata. Based on successful verification of the at least one select part of the metadata, the trusted execution environment starts the secure guest using the secure guest image and at least a portion of the metadata.