Storing diagnostic state of secure virtual machines

Patent metadata

Field	Value
Publication number	US-12019772-B2
Application number	US-202117474220-A
Country	US
Kind code	B2
Filing date	Sep 14, 2021
Priority date	Sep 14, 2021
Publication date	Jun 25, 2024
Grant date	Jun 25, 2024

Abstract

At least one request to store diagnostic state of a virtual machine is obtained. Based on obtaining the at least one request, a store of diagnostic state of the virtual machine is performed to provide stored diagnostic state of the virtual machine. The performing the store includes encrypting the diagnostic state of the virtual machine that is unencrypted and being stored to prevent a reading of the diagnostic state of the virtual machine by an untrusted entity prior to encrypting the diagnostic state of the virtual machine that is unencrypted and being stored.

First claim

What is claimed is:

1. A computer program product for facilitating processing within a computing environment, the computer program product comprising:
one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media to perform a method comprising:
obtaining at least one request to store diagnostic state of a virtual machine; and
performing, based on obtaining the at least one request, the store of the diagnostic state of the virtual machine to provide stored diagnostic state of the virtual machine, wherein the performing the store includes encrypting the diagnostic state of the virtual machine that is unencrypted and being stored to prevent a reading of the diagnostic state of the virtual machine by an untrusted entity prior to encrypting the diagnostic state of the virtual machine that is unencrypted and being stored, and wherein the performing the store of the diagnostic state comprises:
determining that a unit of memory for which contents are to be stored is unencrypted; and
encrypting the unit of memory, based on determining that the unit of memory is unencrypted, wherein units of memory that are encrypted are not re-encrypted.

2. The computer program product of claim 1 , wherein the stored diagnostic state of the virtual machine includes contents of memory of the virtual machine.

3. The computer program product of claim 1 , wherein the stored diagnostic state of the virtual machine includes contents of one or more processor registers of the virtual machine.

4. The computer program product of claim 1 , wherein the method further comprises obtaining an initiate store diagnostic state request to initiate storing of the diagnostic state of the virtual machine, the initiate store diagnostic state request to be used to obtain a first encryption key to be used in encrypting at least a portion of the diagnostic state of the virtual machine that is unencrypted and being stored.

5. The computer program product of claim 4 , wherein the obtaining the at least one request includes obtaining a store diagnostic processor state request, and wherein based on obtaining the store diagnostic processor state request, the performing the store of the diagnostic state includes:
encrypting at least select contents of at least one processor of the virtual machine using the first encryption key to provide encrypted processor contents; and
storing the encrypted processor contents.

6. The computer program product of claim 1 , wherein the obtaining the at least one request includes obtaining a convert from secure memory request, and wherein based on obtaining the convert from secure memory request, the performing the store of the diagnostic state includes:
encrypting at least select contents of memory of the virtual machine that are unencrypted using a second encryption key to provide encrypted contents of memory, the encrypted contents of memory including the unit of memory; and
storing the encrypted contents of memory.

7. The computer program product of claim 1 , wherein the obtaining the at least one request includes obtaining a convert from secure memory request, and wherein based on obtaining the convert from secure memory request, the performing the store of the diagnostic state includes
encrypting the unit of memory using a second encryption key.

8. The computer program product of claim 1 , wherein the stored diagnostic state includes encrypted contents of memory, and wherein the method further comprises:
obtaining a store diagnostic memory state request; and
storing, based on obtaining the store diagnostic memory state request, metadata to be used to decrypt the encrypted contents of memory.

9. The computer program product of claim 8 , wherein the metadata includes one or more select component values to be used to create one or more select values to be used to decrypt the encrypted contents of memory.

10. The computer program product of claim 1 , wherein the method further includes:
obtaining a complete request to complete the storing of the diagnostic state; and
providing, based on obtaining the complete request, data to be used to decrypt encrypted stored diagnostic state of the virtual machine.

11. The computer program product of claim 10 , wherein the data includes a second encryption key used in decryption of encrypted contents of memory and a nonce value to be used to create one or more select values to be used in encryption, and wherein at least a portion of the data is encrypted.

12. The computer program product of claim 1 , wherein the state of the virtual machine includes select secure configuration data of the virtual machine.

13. The computer program product of claim 1 , wherein the virtual machine is a secure virtual machine in which access to the state of the secure virtual machine is denied except for limited memory areas designated as shared by the secure virtual machine.

14. A computer system for facilitating processing within a computing environment, the computer system comprising:
a memory; and
at least one processor in communication with the memory, wherein the computer system is configured to perform a method, said method comprising:
obtaining at least one request to store diagnostic state of a virtual machine; and
performing, based on obtaining the at least one request, the store of the diagnostic state of the virtual machine to provide stored diagnostic state of the virtual machine, wherein the performing the store includes encrypting the diagnostic state of the virtual machine that is unencrypted and being stored to prevent a reading of the diagnostic state of the virtual machine by an untrusted entity prior to encrypting the diagnostic state of the virtual machine that is unencrypted and being stored, and wherein the performing the store of the diagnostic state comprises:
determining that a unit of memory for which contents are to be stored is unencrypted, and
encrypting the unit of memory, based on determining that the unit of memory is unencrypted, wherein units of memory that are encrypted are not re-encrypted.

15. The computer system of claim 14 , wherein the method further comprises obtaining an initiate store diagnostic state request to initiate storing of the diagnostic state of the virtual machine, the initiate store diagnostic state request to be used to obtain a first encryption key to be used in encrypting at least a portion of the diagnostic state of the virtual machine that is unencrypted and being stored.

16. The computer system of claim 15 , wherein the obtaining the at least one request includes obtaining a store diagnostic processor state request, and wherein based on obtaining the store diagnostic processor state request, the performing the store of the diagnostic state includes:
encrypting at least select contents of at least one processor of the virtual machine using the first encryption key to provide encrypted processor contents; and
storing the encrypted processor contents.

17. The computer system of claim 14 , wherein the obtaining the at least one request includes obtaining a convert from secure memory request, and wherein based on obtaining the convert from secure memory request, the performing the store of the diagnostic state includes:
encrypting at least select contents of memory of the virtual machine that are unencrypted using a second encryption key to provide encrypted contents of memory, the encrypted contents of memory including the unit of memory; and
storing the encrypted contents of memory.

18. The computer

Assignees

• IBM

Inventors

• Bradbury Jonathan D
• Hendel Torsten
• Buendgen Reinhard Theodor
• Imbrenda Claudio
• Borntraeger Christian
• Frank Janosch Andreas

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title