Secure Hardware Composition Buffer for Virtual Machine Display Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual PC environments, sharing graphics hardware among multiple virtual machines introduces security challenges as malicious users can access and manipulate video data from other partitions, compromising confidentiality.
Innovation Solution
Implementing secure hardware composition in graphics hardware to duplicate and combine virtual desktop pixels into a composition buffer, restricting read access to prevent malicious software from capturing display data across partitions, and using a hypervisor to manage display flip commands and composition processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the primary O/S is provided access to virtual desktop buffers to composite the final image, then the desktop buffer composition process can function, but security is compromised allowing malicious users to access sensitive information from other partitions
Solution Approach 1:
A secure compositing engine is introduced as an intermediary component that receives virtual desktop buffers from multiple partitions and produces the final composed image. This mediator handles the composition process in a controlled manner, preventing direct access to individual partition buffers while still enabling the compositing function. The secure compositing engine acts as a trusted intermediary that balances functionality with security isolation.
2Adaptability or versatility
If a malicious user modifies the compositing process to access virtual desktop buffers, then they can capture display data from other partitions, but the confidentiality of video data is compromised
Solution Approach 1:
The system segments the compositing process into distinct components: individual virtual desktop buffers for each partition remain isolated, while the secure compositing engine creates a separate composition buffer that contains the final composed image. This segmentation ensures that even if the compositing process is modified, malicious users can only access the composed output rather than the sensitive source buffers from other partitions.
Solution Approach 2:
The secure compositing engine creates a copy of the necessary display data in a composition buffer that is specifically designed for output purposes. Instead of allowing direct access to original virtual desktop buffers, the system uses controlled copying to transfer only the necessary composited information to a secure output buffer, preventing unauthorized access to source partition data.
3Productivity
If graphics hardware is shared amongst multiple virtual machines, then resource utilization is improved, but security challenges arise regarding access to video data
Solution Approach 1:
The system adds a new dimension to graphics hardware sharing by introducing virtualization layers and secure compositing engines that operate between the physical hardware and individual virtual machines. This additional architectural dimension enables multiple VMs to share hardware resources while maintaining security boundaries, transforming the sharing model from direct access to controlled virtualized access.
Data Source
AI summary
A plurality of virtual machines are executed on a host computer, the host computer including graphics hardware, and a display. The virtual machines write display data to their respective virtual desktop buffers. A virtual machine is selected to output to the display of the host computer. A composition buffer on the graphics hardware is enabled with respect to the selected virtual machine. The contents of the virtual desktop buffer associated with the selected virtual machine are copied to the composition buffer by the graphics hardware. The contents of the composition buffer are rendered and displayed by the graphics hardware. In addition, read access to the compositing buffer is restricted to the graphics hardware, thus preventing malicious software applications from capturing the display data across partitions.