Authenticated Virtual Machine Launch via Nested LCPM

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing launch control policies do not ensure the secure launch of nested Virtual Machine Managers (VMMs) and Virtual Machines (VMs), creating potential security breaches by allowing unauthenticated execution environments.

Innovation Solution

An authenticated launch mechanism is implemented using a generic interface that invokes a protected launch control mechanism for VMs and nested VMMs, extending the Trusted Execution Technology (TXT) launch control policy to cover these environments, ensuring integrity measurements are verified against whitelists and stored in Platform Configuration Registers (PCRs) for secure boot processes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If TXT launch control is used to securely launch a single VMM, then the initial VMM launch is secure and trustworthy, but subsequently launched nested VMMs and VMs cannot be securely launched because TXT is not invoked when VMX-root is active

Engineering Contradiction:

Improvesecurity of VMM launchVSAvoidability to launch nested VMMs

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements nested virtualization where a root VMM launches nested VMMs, each with their own launch control policy enforcement. The nested VMMs are launched within the root VMM's protected environment while maintaining their own security boundaries through separate LCPM instances and PCR measurements, creating a nested structure of trusted execution environments.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent segments the launch control functionality by creating separate Launch Control Policy Modules (LCPMs) for the root VMM and nested VMMs. Each LCPM independently enforces its own launch control policy, allowing secure launch verification at each virtualization layer without interfering with the other's security model.

Inventive Principle:

Principle #1Segmentation

2Ease of operation

If VMs and nested VMMs are launched without application of launch control policy, then the system can operate with greater flexibility and ease of operation, but this creates a potential opportunity for security breaches

Engineering Contradiction:

Improveease of launching VMs and nested VMMsVSAvoidsecurity breach risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The launch control mechanism operates autonomously through the LCPM module that automatically verifies integrity measurements of nested VMMs and VMs against their respective launch control policies. The system self-regulates security enforcement without requiring manual intervention, maintaining both ease of operation and security by making the security checks transparent and automatic.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent implements feedback through integrity measurement verification where the LCPM continuously monitors and verifies the integrity of launched virtualization environments. The measurement verification process provides feedback on whether nested VMMs and VMs comply with their launch control policies, enabling automatic security enforcement while maintaining operational flexibility.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS9372984B2Authenticated launch of virtual machines and nested virtual machine managers

Publication Date: 2016.06.21 INTEL CORP

AI summary

An embodiment of the invention provides for an authenticated launch of VMs and nested VMMs. The embodiment may do so using an interface that invokes a VMM protected launch control mechanism for the VMs and nested VMMs. The interface may be architecturally generic. Other embodiments are described herein.