Trusted Component Secure Memory Dump Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a virtualized computing environment, generating a complete memory dump is hindered by the virtual machine monitor's inability to access all data, especially when errors occur, and there is no out-of-band control for initiating the dump process, leading to degraded serviceability.
Innovation Solution
A method involving a trusted component with asymmetric cryptographic key pairs, which generates a symmetric dump key, encrypts data from the guest memory, and provides it to the virtual machine monitor for transmission to the client system, ensuring secure and reliable data transfer without exposing data to the virtual machine monitor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the virtual machine monitor is used to generate memory dumps, then data protection is improved, but complete data access and serviceability deteriorate
Solution Approach 1:
A trusted component acts as an intermediary between the virtual machine monitor and the guest memory. This component holds cryptographic keys and permissions that enable it to selectively access protected data on behalf of the dump generation process, while the virtual machine monitor itself maintains its security constraints. The intermediary resolves the contradiction by providing controlled access without compromising the underlying protection model.
2Reliability
If data are encrypted with a program key to protect them from virtual machine monitor access, then security is improved, but the ability to generate complete memory dumps deteriorates
Solution Approach 1:
The system changes the cryptographic parameters dynamically based on the operation being performed. During normal execution, data remains encrypted with the program key for security. During dump operations, the trusted component uses its stored key material to derive or access the necessary keys, temporarily changing the accessibility parameters without permanently altering the security model. This allows complete data access when needed while maintaining security during normal operation.
3Device complexity
If no out-of-band control is provided for dump initiation, then system simplicity is improved, but control flexibility and serviceability deteriorate
Solution Approach 1:
The trusted component is designed with multi-functionality, serving both as a security guardian during normal operation and as a controlled access point for dump initiation. It can receive dump requests through multiple channels (from the virtual machine monitor, from external management systems, or triggered by specific conditions), providing universal control capability without requiring separate dedicated hardware or complex additional infrastructure.
Data Source
AI summary
A method for generating a dump comprising data generated by a virtual system in a computing environment is depicted. The method comprises: initiating a dump process for dumping data generated by the virtual system and stored in guest memory; sending a dump request for the data from the virtual machine monitor to the trusted component; in response to receiving the dump request, generating a symmetric dump generating key; reading the data from the guest memory; encrypting the data with the symmetric dump generating key; encrypting the symmetric dump generating key with the public cryptographic key of the client system; providing the encrypted dump data and the encrypted symmetric dump generating key to the virtual machine monitor; generating a dump comprising the encrypted dump data and the encrypted symmetric dump generating key; and providing the dump to the client system.