VM State Isolation via Hardware Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In processing systems, the hypervisor remains vulnerable to security threats as it has access to the state information of virtual machines (VMs), which can lead to data exposure and control flow attacks, especially in untrusted cloud environments where the VM owner does not trust the hypervisor.
Innovation Solution
Implementing a hardware encryption module to cryptographically isolate the state information of VMs by encrypting data written to memory and decrypting data read from memory, while selectively exposing decrypted values to the hypervisor through a guest hypervisor communication block, ensuring that only the necessary state information is accessible to the hypervisor during exit conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the hypervisor has access to VM state information for management operations, then the hypervisor can perform necessary VM control functions, but the security of VM data is compromised and the hypervisor becomes a security vulnerability
Solution Approach 1:
The patent introduces an encryption module as an intermediary component between the hypervisor and VM state information. This module encrypts VM state data before it is stored in memory and selectively decrypts only the specific portions needed for hypervisor operations. The encryption module acts as a trusted mediator that preserves hypervisor functionality while preventing unauthorized access to VM data, thus resolving the contradiction between operational ease and data security.
2Adaptability or versatility
If the hypervisor can access all VM state information, then complete VM control is achieved, but the risk of data exposure and control flow attacks increases
Solution Approach 1:
The patent implements local quality by applying different security treatments to different portions of VM state information. Rather than encrypting all state data uniformly or leaving it all accessible, the system selectively encrypts sensitive portions while leaving non-sensitive portions accessible to the hypervisor. This granular approach maintains complete VM control capability while minimizing data exposure risk by applying security measures only where necessary.
3Reliability
If VM state information is encrypted to protect security, then data confidentiality is improved, but the hypervisor cannot access the information for management operations
Solution Approach 1:
The patent applies preliminary action by pre-encrypting VM state information before it is written to memory, rather than encrypting it on-demand during hypervisor access. The encryption module is configured in advance to encrypt specific state portions and to automatically decrypt only the necessary portions when the hypervisor needs them. This preliminary setup enables both strong confidentiality protection and seamless hypervisor access without real-time encryption/decryption overhead.
4Adaptability or versatility
If all VM state data is made visible to the hypervisor for management, then operational flexibility is maintained, but security vulnerabilities increase allowing potential attacks
Solution Approach 1:
The patent applies segmentation by dividing VM state information into distinct segments or portions, each with different security requirements. The encryption module treats each segment independently, encrypting sensitive segments while leaving non-sensitive segments accessible. This segmentation approach maintains operational flexibility by keeping necessary state information visible to the hypervisor while isolating and protecting vulnerable segments from potential attacks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A processing system [100] includes a processor [102] that implements registers [115, 116] to define a state of a virtual machine (VM) [200] running on the processor. The processor detects exit conditions [605] of the VM. The processing system also includes a memory element [103] to store contents of the registers in a first data structure [120] that is isolated from a hypervisor [202] of the VM in response to the processor detecting an exit condition. The VM is to selectively expose [625] contents of a subset of the registers to the hypervisor.