Secure management of operations on protected virtual machines

Patent metadata

Field	Value
Publication number	US-10176095-B2
Application number	US-201615243647-A
Country	US
Kind code	B2
Filing date	Aug 22, 2016
Priority date	May 5, 2014
Publication date	Jan 8, 2019
Grant date	Jan 8, 2019

Abstract

A virtual secure mode is enabled for a virtual machine operating in a computing environment that is associated with a plurality of different trust levels. First, a virtual secure mode image is loaded into one or more memory pages of a virtual memory space of the virtual machine. Then, the one or more memory pages of the virtual memory space are made inaccessible to one or more trust levels having a relatively lower trust level than a launching trust level that is used by a virtual secure mode loader to load the virtual secure mode image. A target virtual trust level is also enabled on a launching virtual processor for the virtual machine that is higher than the launching trust level.

First claim

What is claimed is:

1. A method for operating a computing architecture in a manner that can improve data security by facilitating a controlled transition from one security trust level to a different security trust level, the method comprising:
causing a virtual secure mode loader, which is an application being executed by a virtual machine that is executing on a computer system and which is different than a hypervisor that is also executing on the computer system, to load a virtual secure mode image into one or more memory pages of a virtual memory space of the virtual machine;
causing the hypervisor to make the one or more memory pages of the virtual memory space inaccessible to one or more trust levels that are relatively lower than a launching trust level that is used by the virtual secure mode loader to load the virtual secure mode image; and
causing the hypervisor to enable a target virtual trust level on a launching virtual processor for the virtual machine, the target virtual trust level being higher than the launching trust level.

2. The method of claim 1 , wherein the method further includes:
causing the hypervisor to enable the target virtual trust level on other virtual processors in the virtual machine.

3. The method of claim 1 , wherein causing the hypervisor to enable the target virtual trust level on the launching virtual processor includes processing a hypercall that has a parameter that identifies the virtual processor to be enabled.

4. The method of claim 3 , wherein the hypercall further includes a parameter identifying a context of use for the virtual processor.

5. The method of claim 1 , wherein the launching trust level and the target virtual trust level are included in a plurality of different trust levels, the plurality of different trust levels including at least three different trust levels.

6. The method of claim 1 , wherein causing the virtual secure mode loader to load is performed by processing a hypercall to the hypervisor or a virtual machine manager, the hypercall including a parameter that identifies the one or more memory pages.

7. The method of claim 1 , wherein the method further includes preparing the virtual secure mode image and wherein the preparing includes at least recording an internal state of the one or more memory pages.

8. The method of claim 7 , wherein the preparing further includes generating at least one hash of the virtual secure mode image.

9. The method of claim 8 , wherein generating the at least one hash includes generating a separate hash for each of the one or more memory pages.

10. The method of claim 8 , wherein the method further includes sending the at least one hash to a trusted platform module for attestation of software configuration for the virtual machine.

11. A computing system comprising:
one or more processors; and
one or more storage media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computing system to perform a method that can improve data security by facilitating a controlled transition from one security trust level to a different security trust level, the method comprising:
causing a virtual secure mode loader, which is an application being executed by a virtual machine that is executing on the computer system and which is different than a hypervisor that is also executing on the computer system, to load a virtual secure mode image into one or more memory pages of a virtual memory space of the virtual machine;
causing the hypervisor to make the one or more memory pages of the virtual memory space inaccessible to one or more trust levels that are relatively lower than a launching trust level that is used by the virtual secure mode loader to load the virtual secure mode image; and
causing the hypervisor to enable a target virtual trust level on a launching virtual processor for the virtual machine, the target virtual trust level being higher than the launching trust level.

12. The computing system of claim 11 , wherein the hypervisor further enables the target virtual trust level on other virtual processors in the virtual machine.

13. The computing system of claim 11 , wherein the hypervisor is included as a part of a virtual machine manager.

14. The computing system of claim 11 , wherein the launching trust level and the target virtual trust level are included in a plurality of different trust levels, the plurality of different trust levels including at least three different trust levels.

15. The computing system of claim 11 , wherein the hypervisor further prepares the virtual secure mode image and wherein the preparing includes at least recording an internal state of the one or more memory pages.

16. The computing system of claim 15 , wherein the hypervisor further prepares at least one hash of the virtual secure mode image.

17. The computing system of claim 16 , wherein the hypervisor generates a separate hash for each of the one or more memory pages.

18. The computing system of claim 16 , wherein the hypervisor sends the at least one hash to a trusted platform module for attestation of software configuration for the virtual machine.

19. The computing system of claim 11 , wherein the stored computer-executable instructions are further executable by the one or more processors for causing the computing system to instantiate:
a virtual secure mode module that keeps a record of devices associated with a plurality of different trust levels and that tracks which of a plurality of different virtual processors are associated with each of the plurality of different trust levels.

20. One or more hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors of a computer system to cause the computer system to perform a method that can improve data security by facilitating a controlled transition from one security trust level to a different security trust level, the method comprising:
causing a virtual secure mode loader, which is an application being executed by a virtual machine that is executing on the computer system and which is different than a hypervisor that is also executing on the computer system, to load a virtual secure mode image into one or more memory pages of a virtual memory space of the virtual machine;
causing the hypervisor to make the one or more memory pages of the virtual memory space inaccessible to one or more trust levels that are relatively lower than a launching trust level that is used by the virtual secure mode loader to load the virtual secure mode image;
causing the hypervisor to prepare the virtual secure mode image by at least recording an internal state of the one or more memory pages and by at least generating one or more hash for the virtual secure mode image;
causing the hypervisor to enable a target virtual trust level on a launching virtual processor for the virtual machine, the target virtual trust level being higher than the launching trust level; and
causing the hypervisor to enable the target virtual trust level on other virtual processors in the virtual machine.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Ferguson Niels T
• Samsonov Yevgeniy Anatolievich
• Kinshumann
• Chandrashekar Samartha
• Messec John Anthony
• Novak Mark Fishel
• Mccarron Christopher
• Tamhane Amitabh Prakash
• Wang Qiang
• Kruse David Matthew
• Ben-Zvi Nir
• Vinberg Anders Bertil

Classifications

• G06F12/08 Primary

  in hierarchically structured memory systems, e.g. virtual memory systems · CPC title

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title