Secure debugging in a trustable computing environment

Patent metadata

Field	Value
Publication number	US-10366227-B2
Application number	US-201615352063-A
Country	US
Kind code	B2
Filing date	Nov 15, 2016
Priority date	Nov 15, 2016
Publication date	Jul 30, 2019
Grant date	Jul 30, 2019

Abstract

A trusted component commences a debugging session, based on determining that debugging of a virtual machine is to be initiated. The commencing of the debugging session includes generating encryption information to be provided to a client for which debugging is to be performed. The encryption information includes a key that is encrypted and to be used to encrypt a debug request to debug the virtual machine. The trusted component obtains an encrypted debug request indicating one or more operations to be performed to debug the virtual machine. The one or more operations are performed by the trusted component to obtain debugging results for the virtual machine.

First claim

What is claimed is:

1. A computer program product for facilitating debugging within a computing environment, the computer program product comprising:
a computer readable storage device readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
determining, by a trusted component of the computing environment, that debugging of a virtual machine of the computing environment is to be initiated, the determining being based on an encrypted communication inaccessible to a hypervisor, the encrypted communication having been sent by a client via the hypervisor to the trusted component;
commencing, by the trusted component, a debugging session, based on the determining that debugging of the virtual machine is to be initiated, the commencing the debugging session comprising:
generating encryption information to be provided to the client for which debugging of the virtual machine is to be performed, the encryption information being inaccessible to the hypervisor and including a symmetric key that is encrypted and to be used by the client to encrypt a debug request to debug the virtual machine; and
forwarding the encryption information to the client via the hypervisor;

obtaining, by the trusted component, an encrypted debug request sent by the client via the hypervisor indicating one or more operations to be performed to debug the virtual machine, the encrypted debug request encrypted using the symmetric key;
performing, by the trusted component, the one or more operations specified in the encrypted debug request to obtain debugging results for the virtual machine;
encrypting, by the trusted component, the debugging results using the symmetric key to provide encrypted debugging results;
providing, by the trusted component, the encrypted debugging results to the client via the hypervisor; and
wherein encrypting the debugging result using the symmetric key facilitates preventing the hypervisor from accessing data or context of the virtual machine.

2. The computer program product of claim 1 , wherein the hypervisor is coupled to the trusted component and manages the virtual machine.

3. The computer program product of claim 1 , wherein the generating the encryption information comprises:
generating the symmetric key;
encrypting the symmetric key to provide an encrypted symmetric key; and
including the encrypted symmetric key in the encryption information.

4. The computer program product of claim 3 , wherein the encryption information further includes a random sequence number generated by the trusted component.

5. The computer program product of claim 4 , wherein the commencing the debugging session further comprises storing the encryption information in a buffer, the buffer accessible by the hypervisor, the hypervisor coupled to the trusted component and to the client and managing the virtual machine.

6. The computer program product of claim 5 , wherein the obtaining the encrypted debug request is based on the client obtaining the buffer from the hypervisor and creating the encrypted debug request.

7. The computer program product of claim 3 , wherein the encrypting the symmetric key to provide the encrypted symmetric key comprises encrypting the symmetric key using a negotiated key, the negotiated key negotiated between the trusted component and the client.

8. The computer program product of claim 1 , wherein the method further comprises decrypting, by the trusted component, the encrypted debug request to obtain the one or more operations to be performed.

9. The computer program product of claim 8 , wherein the encrypted debug request further includes a sequence number, and wherein the method further comprises:
comparing the sequence number with a current sequence number; and
performing the one or more operations based on the comparing indicating the sequence number has a particular relationship with respect to the current sequence number.

10. A computer system for facilitating debugging within a computing environment, the computer system comprising:
a memory; and
a processor in communication with the memory, wherein the computer system is configured to perform a method, said method comprising:
determining, by a trusted component of the computing environment, that debugging of a virtual machine of the computing environment is to be initiated, the determining being based on an encrypted communication inaccessible to a hypervisor, the encrypted communication having been sent by a client via the hypervisor to the trusted component;
commencing, by the trusted component, a debugging session, based on the determining that debugging of the virtual machine is to be initiated, the commencing the debugging session comprising:
generating encryption information to be provided to the client for which debugging of the virtual machine is to be performed, the encryption information being inaccessible to the hypervisor and including a symmetric key that is encrypted and to be used by the client to encrypt a debug request to debug the virtual machine; and
forwarding the encryption information to the client via the hypervisor;

obtaining, by the trusted component, an encrypted debug request sent by the client via the hypervisor indicating one or more operations to be performed to debug the virtual machine, the encrypted debug request encrypted using the symmetric key;
performing, by the trusted component, the one or more operations specified in the encrypted debug request to obtain debugging results for the virtual machine;
encrypting, by the trusted component, the debugging results using the symmetric key to provide encrypted debugging results;
providing, by the trusted component, the encrypted debugging results to the client via the hypervisor; and
wherein encrypting the debugging result using the symmetric key facilitates preventing the hypervisor from accessing data or context of the virtual machine.

11. The computer system of claim 10 , wherein the generating the encryption information comprises:
generating the symmetric key;
encrypting the symmetric key to provide an encrypted symmetric key; and
including the encrypted symmetric key in the encryption information.

12. The computer system of claim 10 , wherein the method further comprises decrypting, by the trusted component, the encrypted debug request to obtain the one or more operations to be performed.

13. A computer-implemented method of facilitating debugging within a computing environment, the computer-implemented method comprising:
determining, by a trusted component of the computing environment, that debugging of a virtual machine of the computing environment is to be initiated, the determining being based on an encrypted communication inaccessible to a hypervisor, the encrypted communication having been sent by a client via the hypervisor to the trusted component;
commencing, by the trusted component, a debugging session, based on the determining that debugging of the virtual machine is to be initiated, the commencing the debugging session comprising:
generating encryption information to be provided to the client for which debugging of the virtual machine is to be performed, the encryption information being inaccessible to the hypervisor and including a symmetric key that is encrypted and to be used by the client to encrypt a debug request to debug the virtual machine; and
forwarding the encryption information to the client via the hypervisor;

obtaining, by the trusted component, an encrypted debug request sent by the client via the hypervisor indicating one or more operations to be performed to debug the virtua

Assignees

• IBM

Inventors

• Bacher Utz
• Buendgen Reinhard T
• Carstens Heiko
• Dingel Dominik

Classifications

• H04L9/3271

  using challenge-response · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F11/3664

  Physics · mapped topic

• H04L9/0656

  Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher · CPC title