Virtual TPM Offloading to Platform Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems implementing virtualization, the emulation of Trusted Platform Modules (TPMs) by the hypervisor consumes processor resources, leading to performance slowdowns, especially when handling large numbers of virtual machines or those infected with malware.
Innovation Solution
Offloading TPM emulation from the hypervisor to a separate platform controller, which provides a secure and efficient emulation of virtual TPMs, reducing processor resource consumption and minimizing the attack surface.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the hypervisor emulates TPMs for virtual machines, then security operations can be performed for multiple VMs, but processor resources are consumed leading to performance slowdowns
Solution Approach 1:
The patent extracts the TPM emulation function from the hypervisor and implements it as a separate virtual device accessible to VMs through PCI bus. This separation allows TPM operations to be handled by dedicated hardware rather than consuming hypervisor processor resources, thereby maintaining security functionality while improving system performance.
Solution Approach 2:
The patent introduces a virtual TPM device as an intermediary between VMs and the security functions. This virtual device acts as a mediator that handles TPM operations independently of the hypervisor, allowing secure communications without burdening the processor resources of the main system.
2Reliability
If the hypervisor emulates TPMs, then security operations are available to VMs, but the attack surface increases when handling malware-infected VMs
Solution Approach 1:
The patent extracts TPM emulation from the hypervisor's codebase and implements it as a separate virtual device. This extraction isolates security-critical functions from the hypervisor's execution environment, reducing the attack surface for malware while maintaining security operations availability to VMs.
Solution Approach 2:
The patent segments the system into distinct functional components: the hypervisor manages virtualization, while the virtual TPM device handles security operations. This segmentation ensures that even if malware infects a VM, it cannot compromise the hypervisor's TPM emulation capability, as they are separate entities.
Data Source
AI summary
In some examples, a storage medium stores a plurality of information elements that relate to corresponding virtual trusted platform module (TPM) interfaces, where each respective information element of the plurality of information elements corresponds to a respective virtual machine (VM). A controller provides virtual TPMs for respective security operations. A processor resource executes the VMs to use the information elements to access the corresponding virtual TPM interfaces to invoke the security operations of the virtual TPMs, where a first VM is to access a first virtual TPM interface of the virtual TPM interfaces to request that a security operation of a respective virtual TPM be performed.