Entropy pools for virtual machines

Patent metadata

Field	Value
Publication number	US-9495190-B2
Application number	US-54616709-A
Country	US
Kind code	B2
Filing date	Aug 24, 2009
Priority date	Aug 24, 2009
Publication date	Nov 15, 2016
Grant date	Nov 15, 2016

Abstract

In the host operating system of a computing device, entropy data is collected based at least in part on each of one or more hardware components of the computing device. An entropy pool is updated based at least in part on the collected entropy data, and data from the entropy pool is provided to a guest operating system running as a virtual machine of the computing device. The guest operating system maintains a guest operating system entropy pool based on the data from the entropy pool provided by the host operating system. The guest operating system accesses the guest operating system entropy pool and uses the guest operating system entropy pool as a basis for generating values including random numbers.

First claim

What is claimed is:

1. One or more computer storage devices having stored thereon instructions for a program managed by a virtual machine manager that, when executed by one or more processors of a computing device, cause the one or more processors to:
access, through virtualized resources, an entropy pool generated based at least in part on each of one or more hardware components of the computing device, the program running in a virtualized hardware system, the entropy pool having been obtained from a host operating system on the computing device, wherein the entropy pool is transferred from the host operating system to a virtualized component of the virtual machine manager, stored in the virtualized component, and accessed by a guest operating system via the program managed by the virtual machine manager;
use the entropy pool as a basis for generating a random number for creation of a cryptographic key;
request additional entropy data from a host operating system;
receive, from the host operating system, the additional entropy data; and
incorporate the additional entropy data into the entropy pool of the program.

2. One or more computer storage devices as recited in claim 1 , wherein at least a portion of the entropy pool is mapped into a memory space of the virtual machine manager by the host operating system.

3. One or more computer storage devices as recited in claim 1 , wherein the entropy pool is obtained from the host operating system via a basic input/output system (BIOS) table of the program.

4. One or more computer storage devices as recited in claim 1 , the instructions further causing the one or more processors to:
receive the additional entropy data from the host operating system at particular intervals.

5. One or more computer storage devices as recited in claim 1 , the instructions further causing the one or more processors to:
obtain a first sequence counter value for the program; and
store the random number and the first sequence counter value for the program.

6. One or more computer storage devices as recited in claim 5 , the instructions further causing the one or more processors to:
receive a request to use the random number;
obtain the stored first sequence counter value;
obtain a second sequence counter value for the program when the request is received;
compare the second sequence counter value to the first sequence counter value;
use the random number based at least on the first sequence counter value and the second sequence counter value being the same;
based at least on the first sequence counter value and the second sequence counter value not being the same:
regenerate the entropy pool of the program,
generate a new random number based on the regenerated entropy pool, and
use the new random number.

7. A method in a computing device, the method comprising:
collecting entropy data based at least in part on each of one or more hardware components of the computing device;
updating an entropy pool on a host operating system based at least in part on the collected entropy data;
providing data from the entropy pool on the host operating system to an entropy pool existing on a guest operating system running as a virtual machine of the computing device, wherein the data provided to the entropy pool existing on the guest operating system is used to generate a first random number, and wherein providing the data from the entropy pool to the guest operating system comprises providing the data from the entropy pool to the guest operating system at least when the guest operating system is booted;
cloning the guest operation system;
changing, in response to the guest operating system being cloned, a first sequence counter value for a first copy of the guest operating system and keeping a second sequence counter value for a second copy of the guest operating system unchanged;
storing one of the first sequence number or the second sequence number as a current sequence number;
providing data from the entropy pool on the host operating system to an entropy pool on the cloned virtual machine and using the entropy pool on the cloned virtual machine to generate a second random number; and
determining whether to use one of the first random number of the second random number based at least on whether the first sequence number or the second sequence number matches the current sequence number.

8. A method as recited in claim 7 , further comprising providing additional data from the entropy pool to the guest operating system while the guest operating system is running.

9. A method as recited in claim 8 , further comprising providing the additional data from the entropy pool to the guest operating system in response to a request for additional entropy from the guest operating system.

10. A method as recited in claim 8 , further comprising:
collecting additional entropy data based at least in part on each of the one or more hardware components of the device; and
updating the entropy pool based at least in part on the additional collected entropy data.

11. A method as recited in claim 7 , wherein providing the data from the entropy pool to the guest operating system comprises including at least part of the entropy pool in a memory space of the virtual machine where a basic input/output system (BIOS) table used by the guest operating system is stored.

12. A method as recited in claim 7 , wherein the method is implemented in a host operating system of the computing device.

13. A method as recited in claim 7 , wherein the first copy comprises a saved snapshot copy of the guest operating system, and the second copy comprises a copy of the guest operating system that continues running.

14. A method in a guest operating system of a computing device, the method comprising:
generating a value based on an entropy pool, the entropy pool existing on the guest operating system, the entropy pool having been obtained from another entropy pool existing on a host operating system on the computing device;
obtaining a first current sequence counter value for the guest operating system when the value is generated;
storing a record of the generated value and the first current sequence counter value for the guest operating system;
receiving a request to use the generated value;
obtaining the stored first current sequence counter value;
obtaining a second current sequence counter value for the guest operating system when the request is received;
comparing the first current sequence counter value to the second current sequence counter value;
based at least on the first current sequence counter value and the second current sequence counter value being the same, then using the generated value for creation of a cryptographic key; and
based at least on the first current sequence counter value and the second current sequence counter value not being the same:
regenerating the entropy pool,
generating a new value based on the regenerated entropy pool, and
using the new value for creation of a cryptographic key.

15. A system comprising:
one or more processors; and
one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors to perform operations including:
collecting entropy data based at least in part on each of one or more hardware components of the computing device;
updating an entropy pool on a host operating system based at least in part on the collected entropy data;
providing data from the entropy pool on the host operating system to an entropy pool existing on a guest operating system running as a virtua

Assignees

• Ellison Carl M
• Field Scott A
• Baker Brandon S
• Microsoft Technology Licensing Llc

Inventors

• Ellison Carl M
• Field Scott A
• Baker Brandon S

Classifications

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F7/588

  Random number generators, i.e. based on natural stochastic processes · CPC title

• G06F7/584

  using finite field arithmetic, e.g. using a linear feedback shift register · CPC title

• G06F2009/45579

  I/O management, e.g. providing access to device drivers or storage · CPC title

• G06F7/58

  Random or pseudo-random number generators · CPC title