From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joel Schopp Subject: Re: Verifying Execution Integrity in Untrusted hypervisors Date: Mon, 28 Jul 2014 12:17:07 -0500 Message-ID: <53D68593.6020803@amd.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit To: Shiva V , Return-path: Received: from mail-by2lp0242.outbound.protection.outlook.com ([207.46.163.242]:57650 "EHLO na01-by2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750903AbaG1RTZ (ORCPT ); Mon, 28 Jul 2014 13:19:25 -0400 In-Reply-To: Sender: kvm-owner@vger.kernel.org List-ID: On 07/25/2014 03:11 PM, Shiva V wrote: > Hello, > I am exploring on finding a way to ensure runtime integrity of > > a executable in untrusted hypervisors. > > In particular, this is my requirements: > > 1. I have a 2 virtual machines. (A, B). > > 2. VM-A is running some service (exe) inside it. For example any resource > > accounting service intended to monitor for VM-B. > > 3. I need a way to verify run time integrity from VM-B of the executable > > running inside VM-A. > > 4. Both the vm's are not privileged vm's and are just normal client virtual > > machines. > > 5. Underlying hypervisor is untrusted. If the hypervisor is untrusted you have broken the root of trust and are going to be pretty out of luck. Any solution will require a level below the hypervisor that you trust. An example would be hardware that isolates memory from the hypervisor, ie https://www.google.com/patents/WO2013054528A1?cl=en&dq=Joel+Schopp&hl=en&sa=X&ei=YYPWU6aVJNProATe5IHACQ&ved=0CDMQ6AEwAw Another approach might be to start with something like a TPM and a trusted runtime UEFI. You could then have the guest call UEFI to do measurement with the TPM and use that for remote attestation. With such a method you could probably get to the point that you could measure something in guest memory at run-time, but you would have no assurance it hadn't been modified prior or after and was just temporarily correct, it would be a very point in time measurement.