Virtual Machine Monitor Key Material Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machines (VMs) face security risks due to shared resources, particularly in accessing key material, where unauthorized disclosure can occur when relying on untrusted VMs for key management operations.
Innovation Solution
Implementing a virtual machine monitor (VMM) that manages key material access through a secure programming interface, isolating VMs from each other and using an external or internal key material repository to enforce strict policy-based access control, reducing reliance on untrusted VMs for key management operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If key material is shared between requesting VM and privileged VM, then key management operations can be performed, but security risk increases due to potential unauthorized disclosure
Solution Approach 1:
The system segments key material management by creating separate key material repositories for different security domains (L1 and L2). The VMM is divided into separate modules (key management module, security policy module) that enforce domain-specific access controls. This segmentation prevents unauthorized cross-domain access while enabling legitimate key management operations within each domain.
Solution Approach 2:
The VMM acts as an intermediary between VMs and key material repositories, mediating all key management operations. The security policy module within the VMM serves as a mediator that enforces access control policies, allowing legitimate operations while blocking unauthorized access attempts. This intermediary layer eliminates direct trust requirements between VMs and key material.
2Adaptability or versatility
If untrusted VMs are used for key management operations, then operational flexibility is maintained, but security control is weakened
Solution Approach 1:
The VMM security policy module serves as a trusted intermediary that mediates all key management operations. Instead of relying on VMs to enforce their own security policies, the VMM intercepts and controls all access requests to key material repositories, enforcing security policies regardless of which VM initiates the request. This maintains operational flexibility while eliminating security weaknesses.
Solution Approach 2:
The system inverts the traditional trust model by not trusting VMs with key management decisions. Rather than allowing VMs to autonomously manage keys based on their own security policies, the system requires all key management operations to be approved by the VMM's security policy module, which enforces centralized security controls.
3Reliability
If strict policy-based access control is implemented, then security is enhanced, but system complexity increases
Solution Approach 1:
The VMM's security policy module serves multiple functions: it enforces access control policies, manages key material lifecycle operations, and coordinates between different security domains. By consolidating these functions into a single multi-functional module within the VMM, the system achieves strict policy-based access control without proportionally increasing overall system complexity.
Solution Approach 2:
The system merges the key management functionality and security policy enforcement into a unified VMM architecture. Rather than having separate complex systems for key management and security policy enforcement, these functions are combined within the VMM, reducing the number of separate components while maintaining comprehensive security control.
Data Source
AI summary
Methods and systems for key material management are disclosed. One system can include a virtual machine monitor (VMM) running on a host device and a number of virtual machines (VMs) running on the VMM, wherein the VMM is configured to perform key management to provide access by the number of VMs to key material required for the VMs to perform key management operations.