Shared Virtual Machine Monitor Integrity Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face challenges in ensuring the immutability and integrity of virtual machine monitor (VMM) code across multiple domains, leading to inefficient memory usage and preventing service providers from inspecting or updating the code for security patches, while also ensuring data privacy and isolation among mutually distrusting domains.
Innovation Solution
Implementing a shared virtual machine manager (sVMM) with integrity protection using domain-specific keys, and a cryptographic engine to provide separated encryption services, allowing the sVMM code to be shared immutably among domains while maintaining data integrity and enabling inspection by service providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VMM code is duplicated across multiple tenant domains, then data privacy and isolation are improved, but memory usage efficiency deteriorates
Solution Approach 1:
The patent merges multiple copies of VMM code into a single shared immutable copy that is securely accessible by multiple tenant domains. The VMM code is loaded once into a shared memory region and protected through cryptographic mechanisms (hash chaining, read-only permissions), eliminating the need for separate copies in each tenant domain while maintaining isolation through controlled access and integrity verification.
Solution Approach 2:
The shared VMM code serves multiple functions simultaneously: it provides virtualization services to multiple tenant domains, maintains data isolation through domain-specific data structures, ensures security through cryptographic protection, and enables efficient memory utilization through single-copy sharing. The immutable VMM code acts as a universal component that can be securely instantiated across different tenant contexts.
2Reliability
If VMM code is encrypted using unique VM keys, then data privacy is improved, but the ability to inspect and update code for security patches deteriorates
Solution Approach 1:
The patent segments the VMM code into distinct components: immutable core code that is shared and protected, and mutable components that can be updated. The immutable portion is protected through cryptographic hash chains and read-only permissions, while update mechanisms allow controlled modification of specific components through verified patching processes that maintain integrity without compromising the ability to inspect code.
Solution Approach 2:
The patent introduces cryptographic intermediaries (hash functions, integrity verification mechanisms) that enable code inspection and verification without requiring decryption of the entire VMM code. Service providers can verify code integrity through public hash values and controlled access mechanisms, allowing inspection and patching while maintaining privacy protection through selective disclosure and verified update processes.
3Ease of repair
If service providers can inspect and update VMM code, then security patching is improved, but tenant trust and isolation may deteriorate
Solution Approach 1:
The patent implements preliminary actions by establishing cryptographic verification mechanisms and integrity checks before any code updates occur. Hash chains and digital signatures are pre-computed and stored, allowing tenants to verify code integrity beforehand. Update processes require verification against these pre-established cryptographic references, ensuring that patching activities maintain isolation and trust through predetermined security guarantees.
Solution Approach 2:
The patent implements feedback mechanisms where code updates trigger verification processes that notify tenant domains of changes. Integrity verification feedback is provided to tenants through controlled channels, allowing them to verify that updates maintain isolation guarantees. This feedback loop maintains trust by providing transparency about update activities while preserving security through verified integrity checks.
Data Source
AI summary
Technologies for providing shared immutable code among untrusting domains are provided. The untrusting domains may be cryptographically separated within a cloud computing service or environment. The shared immutable code may be a shared virtual machine monitor (sVMM) that is setup by system software to indicate that the sVMM code pages need integrity alone and should be protected with an integrity key associated with individual domains. This indication may be stored in page tables and carried over the memory bus to a cryptographic engine. The cryptographic engine may use this indication to protect the integrity of data before storing the data to memory. In order to ensure cryptographic isolation, integrity values may be generated using a domain-specific key ensuring that an attempt to modify the code by one domain is detected by a different domain. Other embodiments are described herein and claimed.