Re: Verifying Execution Integrity in Untrusted hypervisors

[Joel Schopp <joel.schopp@amd.com>]

On 07/25/2014 03:11 PM, Shiva V wrote:
> Hello,
> I am exploring on finding a way to ensure runtime integrity of 
>
> a executable in untrusted hypervisors.
>
> In particular, this is my requirements:
>
> 1. I have a 2 virtual machines. (A, B). 
>
> 2. VM-A is running some service (exe) inside it. For example any resource 
>
> accounting service intended to monitor for VM-B.
>
> 3. I need a way to verify run time integrity from VM-B of the executable 
>
> running inside VM-A.
>
> 4. Both the vm's are not privileged vm's and are just normal client virtual 
>
> machines.
>
> 5. Underlying hypervisor is untrusted.
If the hypervisor is untrusted you have broken the root of trust and are
going to be pretty out of luck.

Any solution will require a level below the hypervisor  that you trust. 
An example would be hardware that isolates memory from the hypervisor,
ie
https://www.google.com/patents/WO2013054528A1?cl=en&dq=Joel+Schopp&hl=en&sa=X&ei=YYPWU6aVJNProATe5IHACQ&ved=0CDMQ6AEwAw

Another approach might be to start with something like a TPM and a
trusted runtime UEFI.  You could then have the guest call UEFI to do
measurement with the TPM and use that for remote attestation.  With such
a method you could probably get to the point that you could measure
something in guest memory at run-time, but you would have no assurance
it hadn't been modified prior or after and was just temporarily correct,
it would be a very point in time measurement.