Protecting a memory from unauthorized access

Patent metadata

Field	Value
Publication number	US-10102151-B2
Application number	US-201514934421-A
Country	US
Kind code	B2
Filing date	Nov 6, 2015
Priority date	Nov 6, 2015
Publication date	Oct 16, 2018
Grant date	Oct 16, 2018

Abstract

A method includes generating a set of virtual-machine-specific (VMS) encryption keys for a dedicated virtual machine, storing the set of VMS encryption keys in a protected memory, storing a first look-up table in the protected memory, and replacing an encryption key stored in a crypto unit with at least one VMS encryption key of the set of VMS encryption keys in an operation mode where the dedicated virtual machine is executed by a processor. The protected memory is selectively excluded from access by operating systems executable on a computer system. The look-up table being accessible only by firmware of the computer system.

First claim

What is claimed is:

1. A computer program product comprising a computer-readable storage medium having a set of instructions stored therein which, when executed by a processor, causes the processor to protect contents of a memory in a computer system from unauthorized access by:
receiving, by a firmware component and from a hypervisor, a request for a dedicated virtual machine (VM);
generating, by the firmware component, a set of virtual-machine-specific (VMS) encryption keys for VM data stored by the dedicated VM in a protected memory region to which the firmware component has access;
establishing, by the firmware component, the dedicated VM in a first look-up table by recording to the first look-up table a first identifier corresponding to the dedicated VM and the set of VMS encryption keys generated by the firmware component for the dedicated VM, the first look-up table being stored in the protected memory region only accessible by the firmware component;
transmitting, by the firmware component, to the hypervisor the first identifier;
executing, by the firmware component, a start routine for the dedicated VM including:
transferring hypervisor content from a cache to a main memory;
clearing the cache;
recording initial VM data to the cache using a host key;
accessing, by the firmware component, the VM data stored in the protected memory region by using the set of VMS encryption keys corresponding to the dedicated VM in the first look-up table;
storing the initial VM data in the protected memory region for the dedicated VM by using access provided by the set of VMS encryption keys; and
recording the set of VMS encryption keys and a host identifier to the cache; and
responsive to an interruption of the dedicated VM, replacing the set of VMS encryption keys recorded to the cache with the hypervisor content including the host key;
wherein:
the protected memory region of the firmware component is a firmware-controlled memory selectively excluded from access by all operating systems and hypervisors executable on the computer system; and
the first look-up table is accessible only by the firmware component of the computer system.

2. The computer program product of claim 1 , further comprising: applying an encryption key of the set of VMS encryption keys stored in the cache to pages for processing by the processor.

3. The computer program product of claim 1 , wherein the set of VMS encryption keys are generated by the firmware component and/or hardware of the computer system.

4. The computer program product of claim 1 , further comprising:
replacing a host encryption key in the cache with at least one VMS encryption key from the set of VMS encryption keys upon initializing the dedicated VM.

5. The computer program product of claim 1 , further comprising:
sharing a secure memory region between a set of virtual machines, the secure memory region being encrypted by a VMS encryption key of the set of VMS encryption keys.

6. The computer program product of claim 1 , further comprising:
providing a second look-up table for storing a second set of VMS encryption keys of a second level virtual machine.

7. The computer program product of claim 1 , wherein the establishing the dedicated VM in a first look-up table is initiated by the hypervisor, responsive to the request for a dedicated virtual machine.

8. The computer program product of claim 1 , wherein the protected memory region is assigned, by the firmware component, for use by the dedicated VM.

9. The computer program product of claim 1 , further comprising:
creating, by the dedicated VM, a second dedicated VM according to a hierarchical structure; and
sharing, by the firmware component, the set of VMS encryption keys with the second dedicated VM for parallel operation of the dedicated VM and the second dedicated VM while exchanging stored VM data including the VM data and the initial VM data through the protected memory region.

10. A computer system comprising:
a processor set; and
a computer readable storage medium;
wherein:
the processor set is structured, located, connected, and/or programmed to run program instructions stored on the computer readable storage medium; and
the program instructions which, when executed by the processor set, causes the processor set to protect contents of a memory in the computer system from unauthorized access by:
receiving, by a firmware component and from a hypervisor, a request for a dedicated virtual machine (VM);
generating, by the firmware component, a set of virtual-machine-specific (VMS) encryption keys for VM data stored by the dedicated VM in a protected memory region to which the firmware component has access;
establishing, by the firmware component, the dedicated VM in a first look-up table by recording to the first look-up table a first identifier corresponding to the dedicated VM and the set of VMS encryption keys generated by the firmware component for the dedicated VM, the first look-up table being stored in the protected memory region only accessible by the firmware component;
transmitting, by the firmware component, to the hypervisor the first identifier;
executing, by the firmware component, a start routine for the dedicated VM including:
transferring hypervisor content from a cache to a main memory;
clearing the cache;
recording initial VM data to the cache using a host key;
accessing, by the firmware component, the VM data stored in the protected memory region by using the set of VMS encryption keys corresponding to the dedicated VM in the first look-up table;
storing the initial VM data in the protected memory region for the dedicated VM by using access provided by the set of VMS encryption keys; and
recording the set of VMS encryption keys and a host identifier to the cache; and
responsive to an interruption of the dedicated VM, replacing the set of VMS encryption keys recorded to the cache with the hypervisor content including the host key;
wherein:
the protected memory region of the firmware component is a firmware-controlled memory selectively excluded from access by all operating systems and hypervisors executable on the computer system; and
the first look-up table is accessible only by the firmware component of the computer system.

11. The computer system of claim 10 , further comprising: applying an encryption key of the set of VMS encryption keys stored in the cache to pages for processing by the processor set.

12. The computer system of claim 10 , wherein the set of VMS encryption keys are generated by the firmware component and/or hardware of the computer system.

13. The computer system of claim 10 , further comprising:
replacing a host encryption key in the cache with at least one VMS encryption key from the set of VMS encryption keys upon initializing the dedicated VM.

14. The computer system of claim 10 , further comprising:
sharing a secure memory region between a set of virtual machines, the secure memory region being encrypted by a VMS encryption key of the set of VMS encryption keys.

15. The computer system of claim 10 , further comprising:
providing a second look-up table for storing a second set of VMS encryption keys of a second level virtual machine.

16. The computer program product of claim 1 , wherein at least one VMS encryption key of the set of VMS encryption keys is identified in the first look-up table by a machine identifier for the dedicated VM.

17. The computer system of claim 10 , wherein at least on VMS encryption key of the set of VMS encryption keys is identified in the first look-up

Assignees

• IBM

Inventors

• Axnix Christine
• Gaertner Ute
• Lang Jakob C
• Nunez Mencias Angel

Classifications

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0485

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title