Binding Secure Keys to Hardware Security Modules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems, the flexibility of virtual machine assignments poses a security risk as secure keys wrapped by a hardware security module can be accessed by unauthorized guests, even if the original guest is compromised, leading to potential unauthorized use of sensitive data.
Innovation Solution
A method and system that configure a hardware security module for exclusive use by a secure guest, utilizing a secret linked to the guest's metadata, which is integrity protected and encrypted, to ensure only the intended guest can access the secure keys, intercepting requests to generate or terminate sessions, and managing access to prevent unauthorized use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtual machine assignments are made flexible, then resource utilization and adaptability improve, but security risks increase as unauthorized guests may access secure keys
Solution Approach 1:
The system segments access control by creating binding relationships between specific secure keys and specific guests. The HSM is divided into multiple secure key containers, each accessible only to its designated guest through unique binding identifiers. This segmentation allows flexible VM assignments while preventing unauthorized access, as each guest can only access their bound keys regardless of VM migration or assignment changes.
Solution Approach 2:
The patent introduces an intermediary binding mechanism that sits between the HSM and guests. This binding layer uses unique identifiers to mediate access requests, verifying whether a guest is authorized to access a particular secure key. The intermediary prevents direct unauthorized access while allowing flexible assignments through proper binding validation.
2Adaptability or versatility
If secure keys are made accessible to multiple guests for flexibility, then adaptability improves, but key security deteriorates as compromised guests can steal keys
Solution Approach 1:
Secure keys are segmented into individual binding containers within the HSM, each associated with a specific guest through unique binding identifiers. This segmentation ensures that even if one guest is compromised, their stolen credentials cannot access other guests' keys, as each key container is isolated and protected by its own binding verification mechanism.
Solution Approach 2:
The system applies local quality by giving each secure key container its own specific binding characteristics and access control properties. Each guest has localized access rights to their specific bound keys, with no cross-contamination possible. This local quality protection ensures that security breaches remain contained to individual guest-key pairs.
3Productivity
If HSM is reassigned between virtual resources, then resource utilization improves, but the HSM becomes unaware of reassignment creating security vulnerabilities
Solution Approach 1:
The system implements feedback mechanisms where the HSM continuously receives and processes binding verification information for each access request. When a guest attempts to access a secure key, the HSM verifies the binding identifier and confirms the guest's authorization status. This feedback loop ensures the HSM remains aware of current assignment relationships, enabling secure reassignment between virtual resources while maintaining security awareness.
Data Source
AI summary
A method, computer program product, and a system where a secure interface control configures a hardware security module for exclusive use by a secure guest. The secure interface control (“SC”) obtains a configuration request (via a hypervisor) to configure the hardware security module (HSM), from a given guest of guests managed by the hypervisor. The SC determines if the HSM is already configured to a specific guest of the one or more guests, but based on determining that the HSM is not configured to the and is a secure guest the SC forecloses establishing a configuration of the HSM by limiting accesses by guests to the HSM exclusively to the given guest. The SC logs the given guest into the HSM by utilizing a secret of the given guest. The SC obtains, from the HSM, a session code and retains the session code.