Encrypted memory guest/host communication
Systems and methods for enabling a Virtual Machine (VM) and hypervisor to communicate are disclosed. An example method includes sending data from a hypervisor to a virtual machine (VM) by storing, by the hypervisor, the data to an encrypted memory page of the VM, wherein the data stored by the hypervisor to the encrypted memory page is not encrypted. The method also includes processing, by the VM, the data stored to the encrypted memory page according to a decryption routine to generate scrambled data. The method also includes looking up, by the VM, the scrambled data in a translation table to obtain unscrambled data, wherein the unscrambled data is the data as it was originally stored to the encrypted memory page by the hypervisor.
1. A method comprising:
receiving, by a virtual machine (VM) and from a hypervisor, data scrambled according to a decryption routine that is known to both the VM and the hypervisor;
looking up, by the VM and based on the data scrambled according to the decryption routine, plaintext data in a translation table in guest memory of the VM, wherein the translation table is generated by sending a pattern of bits from the hypervisor to the VM, wherein the pattern of bits is known to the VM and the hypervisor; and
performing, by the VM, a function based on the plaintext data.
2. The method of claim 1 , wherein the translation table is a VM-to-hypervisor translation table generated during a setup routine responsive to instantiation of the VM.
3. The method of claim 1 , comprising:
encrypting, by the VM, unencrypted data using an encryption key to generate encrypted data;
sending the encrypted data from the VM to the hypervisor by storing, by the VM, the encrypted data to an encrypted memory page of the VM designated by the VM for communication with the hypervisor; and
looking up, by the hypervisor, the encrypted data in a hypervisor-to-VM translation table to obtain the unencrypted data without using the encryption key.
4. The method of claim 3 , wherein the hypervisor-to-VM translation table is generated during a setup routine by sending a first pattern of bits from the VM to the hypervisor, wherein the first pattern of bits is known to the VM and the hypervisor.
5. The method of claim 3 , wherein encrypting the unencrypted data comprises adding padding to the unencrypted data to form a chunk of unencrypted data, and encrypting the chunk of unencrypted data to generate the encrypted data.
6. The method of claim 1 , wherein receiving the data scrambled according to the decryption routine comprises receiving the data scrambled according to the decryption routine by a driver executing on the VM from a virtual device executing on the hypervisor.
7. A system comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
receive, by a virtual machine (VM) and from a hypervisor, data scrambled according to a decryption routine that is known to both the VM and the hypervisor;
look up, by the VM and based on the data scrambled according to the decryption routine, plaintext data in a translation table in guest memory of the VM; and
perform, by the VM, a function based on the plaintext data, wherein the translation table is a VM-to-hypervisor translation table generated by the processing device during a setup routine responsive to instantiation of the VM, wherein the processing device is further to send a pattern of bits from the hypervisor to the VM to enable the VM to generate the VM-to-hypervisor translation table during the setup routine, wherein the pattern of bits is known to the VM and the hypervisor.
8. The system of claim 7 , the processing device further to:
encrypt, by the VM, unencrypted data using an encryption key to generate encrypted data;
send the encrypted data from the VM to the hypervisor by storing, by the VM, the encrypted data to an encrypted memory page of the VM designated by the VM for communication with the hypervisor; and
look up, by the hypervisor, the encrypted data in a hypervisor-to-VM translation table to obtain the unencrypted data without using the encryption key.
9. The system of claim 8 , wherein the processing device is further to:
send a first pattern of bits from the VM to the hypervisor to enable the hypervisor to generate the hypervisor-to-VM translation table during the setup routine, wherein the first pattern of bits is known to the VM and the hypervisor.
10. The system of claim 8 , wherein to encrypt the unencrypted data, the processing device is to add padding to the unencrypted data to form a chunk of unencrypted data, and encrypt the chunk of unencrypted data to generate the encrypted data.
11. The system of claim 7 , wherein to receive the data scrambled according to the decryption routine, the processing device is to receive the data scrambled by the decryption routine by a driver executing on the VM from a virtual device executed on the hypervisor.
12. A non-transitory computer readable medium, having instructions stored thereon that, when executed by a processing device, cause the processing device to:
receive, by a virtual machine (VM) and from a hypervisor, data scrambled according to a decryption routine that is known to both the VM and the hypervisor look up, by the VM and based on the data scrambled according to the decryption routine, plaintext data in a translation table in guest memory of the VM; and
perform, by the VM, a function based on the plaintext data, wherein the translation table is a VM-to-hypervisor translation table generated by the processing device during a setup routine responsive to instantiation of the VM, wherein the processing device is further to: send a pattern of bits from the hypervisor to the VM to enable the VM to generate the VM-to-hypervisor translation table, wherein a pre-specified pattern of bits is known to the VM and the hypervisor.
13. The non-transitory computer readable medium of claim 12 , the processing device further to:
encrypt, by the VM, unencrypted data using an encryption key to generate encrypted data;
send the encrypted data from the VM to the hypervisor by storing, by the VM, the encrypted data to an encrypted memory page of the VM designated by the VM for communication with the hypervisor; and
look up, by the hypervisor, the encrypted data in a hypervisor-to-VM translation table to obtain the unencrypted data without using the encryption key.
14. The non-transitory computer readable medium of claim 13 , wherein the hypervisor-to-VM translation table is generated by the processing device during the setup routine by sending a first pattern of bits from the VM to the hypervisor, wherein the first pattern of bits is known to the VM and the hypervisor.
15. The non-transitory computer readable medium of claim 13 , wherein to encrypt the unencrypted data, the processing device is to add padding to the unencrypted data to form a chunk of unencrypted data, and encrypt the chunk of unencrypted data to generate the encrypted data.