Secure Virtual Machine Dispatch via Millicode Interface
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, there is a challenge in ensuring secure access to virtual machines (VMs) as hypervisors, which are typically untrusted, have control over customer data, compromising security and data integrity.
Innovation Solution
Implement a secure interface control using millicode and hardware modules to manage secure VMs, preventing hypervisors from direct access to VM data by using separate secure and non-secure memory descriptors, and maintaining security modes to handle VM states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the hypervisor directly accesses VM data to manage virtual machines, then the ease of operation and control is improved, but the security and data integrity deteriorate as the hypervisor may be untrusted or compromised
Solution Approach 1:
The patent introduces a secure interface control (millicode) as an intermediary between the hypervisor and secure VM data. The millicode runs in a protected mode and acts as a trusted mediator that manages access to secure VM state descriptors, preventing the untrusted hypervisor from directly accessing sensitive data while still enabling necessary control operations.
Solution Approach 2:
The patent segments memory into secure and non-secure portions, with secure state descriptors stored in protected memory regions accessible only through the millicode. This segmentation isolates critical data from the untrusted hypervisor environment while maintaining separate access paths for different trust levels.
2Reliability
If secure interface control with millicode is implemented to prevent hypervisor access, then data security is improved, but the device complexity increases due to additional security layers
Solution Approach 1:
The millicode serves as a specialized intermediary layer that adds security functionality without requiring complete system redesign. It provides the necessary security controls through a focused set of protected operations, managing complexity by concentrating security logic in a dedicated component rather than distributing it throughout the entire system.
3Reliability
If separate secure and non-secure state descriptors are used, then security isolation is improved, but the loss of time increases due to additional mode determination and data loading operations
Solution Approach 1:
The system performs preliminary actions by pre-establishing secure and non-secure state descriptor structures with appropriate access permissions before VM execution. The millicode is pre-configured with security policies and access rules, allowing it to make rapid decisions about data access without requiring complex runtime analysis, thus reducing the time penalty of security checks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to one or more embodiments of the present invention, a computer implemented method includes receiving, by a hypervisor that is executing on a host server, a request to dispatch a virtual machine. The method further includes, based on a determination that the virtual machine is a secure virtual machine, preventing the hypervisor from directly accessing any data of the secure virtual machine by determining, by a secure interface control of the host server, a security mode of the virtual machine. Based on the security mode being a first mode, the secure interface control loads a virtual machine state from a first state descriptor, which is stored in a non-secure portion of memory. Based on the security mode being a second mode, the secure interface control loads the virtual machine state from a second state descriptor, which is stored in a secure portion of the memory.