Trusted Corevisor Segmentation for Cloud VM Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing reliance on cloud-based virtual machines poses significant security risks due to vulnerabilities in hypervisors and host operating systems, allowing attackers to access sensitive VM data, compromising privacy and integrity.
Innovation Solution
The HypSec system introduces a trusted corevisor that executes at a higher privilege level, isolating and protecting VM data, while delegating less critical functions to an untrusted hostvisor, using hardware virtualization to enforce access control and ensure secure VM boot, CPU, and memory management, with end-to-end encryption for I/O protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If hypervisor is integrated with host OS kernel to leverage existing functionality, then implementation and maintenance effort is simplified, but attack surface increases and security risk worsens
Solution Approach 1:
The hypervisor is divided into two distinct portions: a trusted corevisor that executes at a higher exception level (EL2) with full hardware access, and an untrusted hostvisor that executes at a lower exception level (EL1) with restricted access. This segmentation isolates the security-critical functions in the corevisor while allowing the hostvisor to leverage host OS functionality, thus maintaining ease of implementation while improving security by limiting the attack surface to only the essential trusted portion.
2Ease of operation
If hypervisor executes at higher privilege level to access VM data, then VM control and management is improved, but unauthorized access risk increases
Solution Approach 1:
Different portions of the hypervisor are assigned different privilege levels based on their security requirements. The corevisor executes at EL2 with full access to VM data for essential control functions, while the hostvisor executes at EL1 with restricted access for non-critical management tasks. This local differentiation of privilege levels ensures that VM control is maintained where needed while minimizing unauthorized access risk in less critical areas.
3Quantity of substance
If cloud providers outsource computational resources to reduce cost, then operational cost is reduced, but trustworthiness of hypervisor infrastructure becomes a concern
Solution Approach 1:
The security-critical trusted computing base is extracted from the untrusted cloud infrastructure and placed in a dedicated corevisor that executes at a higher exception level. This extraction ensures that even if the hostvisor or host OS is compromised or untrustworthy, the corevisor maintains secure control over VM data and operations, thereby preserving trustworthiness while allowing cloud providers to outsource computational resources for cost efficiency.
Data Source
AI summary
Systems comprising: a memory; and a hardware processor and configured to: execute a hypervisor having a first portion and a second portion, wherein the first portion of the hypervisor executes at a first exception level that allows the first portion to access data of a virtual machine in the hardware processor and the memory, and wherein the second portion of the hypervisor executes at a second exception level that prevents the second portion from accessing the data of the virtual machine in the hardware processor and the memory. Methods comprising: executing a first portion of a hypervisor at a first exception level that allows the first portion to access data of a virtual machine in a hardware processor and memory; and executing a second portion of a hypervisor at a second exception level that prevents the second portion from accessing the data in the hardware processor and the memory.