Secure VMCS Shadowing via Agent VMs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional virtual machine (VM) servers lack effective mechanisms to securely manage and isolate guest VM control structures (VMCS) from the host VMM, allowing unauthorized access to sensitive guest OS state and data.
Innovation Solution
Implementing a secure VMCS shadowing mechanism using agent VMs and encryption engines to create separate key domains for guest VMs and the host VMM, with agent VMs managing VMCS access on behalf of the VMM, ensuring secure access and protection of guest VM data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a conventional VM server allows the host VMM to access all user data within any VM, then the VMM can manage VMs effectively, but the VC loses control over sensitive guest OS state and data
Solution Approach 1:
The patent segments the VMCS access rights by dividing the VMCS into different fields (guest-state, host-state, control, VM-exit information) and assigning different access permissions to different entities. The VMM receives permission to access host-state and control fields, while the guest VM receives permission to access guest-state fields, preventing unauthorized access to sensitive data.
Solution Approach 2:
The patent applies local quality by providing different access rights to different parts of the VMCS. Each field of the VMCS has specific access permissions tailored to the needs of the VMM or guest VM, allowing fine-grained control over what each entity can read or write to protect sensitive information.
2Object-affected harmful factors
If the VMM is restricted from accessing guest VMCS, then guest data security is improved, but the VMM loses ability to manage VM control structures
Solution Approach 1:
The patent segments VMCS access by allowing the VMM to access only specific fields (host-state and control fields) while restricting access to guest-state fields. This segmented approach enables the VMM to manage VM control structures without compromising guest data security.
Solution Approach 2:
The patent introduces an intermediary mechanism where the VMM can indirectly access guest VMCS through controlled field access. The VMM can read host-state and control fields, and the system provides mechanisms for the VMM to manage VM operations without direct access to guest-state data, effectively using the VMCS structure itself as an intermediary that mediates between VMM and guest VM.
3Object-affected harmful factors
If guest VMs are isolated from host VMM, then data security is enhanced, but system complexity increases due to separate key domains and agent VMs
Solution Approach 1:
The patent implements nesting by placing an agent VM inside the guest VM's execution environment, which itself runs within the host VMM's control. This nested structure (host VMM → guest VM → agent VM) allows the system to achieve isolation and security while managing complexity through hierarchical organization, where each layer has specific responsibilities and the inner layers operate with limited access to outer layers.
Data Source
AI summary
A data processing system with technology to secure a VMCS comprises random access memory (RAM) and a processor in communication with the RAM. The processor comprises virtualization technology that enables the processor to (a) execute host software in root mode and (b) execute guest software from the RAM in non-root mode in a virtual machine (VM) that is based at least in part on a virtual machine control data structure (VMCDS) for the VM. The processor also comprises a root security profile to specify access restrictions to be imposed when the host software attempts to read the VMCDS in root mode. Other embodiments are described and claimed.