Secure Virtual Machine Enclave Migration via CPU Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The migration of virtual machines containing enclaves is hindered by the hypervisor's inability to copy enclave memory pages, as they are inaccessible, disrupting the VM migration process and compromising security.

Innovation Solution

A method that securely migrates the contents of an enclave by using CPU extensions to encrypt and evict persistent data, allowing the destination host to decrypt and rebuild the enclave, ensuring the VM's continuity and security during migration.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the hypervisor copies all memory pages of the VM during migration, then the VM can be successfully migrated to the destination host, but the enclave memory pages cannot be copied because they are inaccessible to the hypervisor

Engineering Contradiction:

ImproveVM migration capabilityVSAvoidenclave security integrity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The memory pages are segmented into two categories: enclave memory pages (protected, inaccessible to hypervisor) and non-enclave memory pages (accessible to hypervisor). The migration process handles these segments differently - the hypervisor copies non-enclave pages while the enclave pages are copied through a specialized mechanism that preserves security isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

An intermediary mechanism is introduced between the hypervisor and enclave memory pages. This intermediary allows the migration process to access and copy enclave memory pages without the hypervisor directly accessing them, thus maintaining security integrity while enabling migration.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If the hypervisor accesses enclave memory pages directly, then the migration process can copy all pages, but the security isolation of the enclave is compromised

Engineering Contradiction:

Improvemigration speedVSAvoidsecurity vulnerability

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system introduces an intermediary layer that facilitates secure access to enclave memory pages during migration. This intermediary enables the hypervisor to copy enclave pages without direct access, preventing security vulnerabilities while maintaining migration capability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The direct mechanical access mechanism (hypervisor directly reading memory pages) is replaced with a secure substitution mechanism that uses cryptographic operations and specialized hardware support to copy enclave pages without compromising security isolation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11327782B2Supporting migration of virtual machines containing enclaves

Publication Date: 2022.05.10 VMWARE INC

AI summary

The present disclosure provides an approach for migrating the contents of an enclave, together with a virtual machine comprising the enclave, from a source host to a destination host. The approach provides a technique that allows the contents of the enclave to remain secure during the migration process, and also allows the destination host to decrypt the contents of the enclave upon receiving the contents and upon receiving the VM that includes the enclave. The approach allows for the VM to continue execution on the destination host. The enclave retains its state from source host to destination host. Applications using the enclave in the source host are able to continue using the enclave on the destination host using the data migrated from the source host to the destination host.