Re: Verifying Execution Integrity in Untrusted hypervisors

[Jan Kiszka <jan.kiszka@siemens.com>]

On 2014-07-28 19:17, Joel Schopp wrote:
> 
> On 07/25/2014 03:11 PM, Shiva V wrote:
>> Hello,
>> I am exploring on finding a way to ensure runtime integrity of 
>>
>> a executable in untrusted hypervisors.
>>
>> In particular, this is my requirements:
>>
>> 1. I have a 2 virtual machines. (A, B). 
>>
>> 2. VM-A is running some service (exe) inside it. For example any resource 
>>
>> accounting service intended to monitor for VM-B.
>>
>> 3. I need a way to verify run time integrity from VM-B of the executable 
>>
>> running inside VM-A.
>>
>> 4. Both the vm's are not privileged vm's and are just normal client virtual 
>>
>> machines.
>>
>> 5. Underlying hypervisor is untrusted.
> If the hypervisor is untrusted you have broken the root of trust and are
> going to be pretty out of luck.
> 
> Any solution will require a level below the hypervisor  that you trust. 
> An example would be hardware that isolates memory from the hypervisor,
> ie
> https://www.google.com/patents/WO2013054528A1?cl=en&dq=Joel+Schopp&hl=en&sa=X&ei=YYPWU6aVJNProATe5IHACQ&ved=0CDMQ6AEwAw

The hypervisor has full control of and insight into the guest vCPU
state. Only protecting some portions of guest memory seems insufficient.

We rather need encryption of every data that leaves the CPU or moves
from guest to host mode (and decryption the other way around). I guess
that would have quite some performance impact and is far from being easy
to integrate into modern processors. But, who knows...

Jan

-- 
Siemens AG, Corporate Technology, CT RTC ITP SES-DE
Corporate Competence Center Embedded Linux