Scalable asynchronous communication for encrypted virtual machines
Systems and methods for virtual machine communication in a virtualized environment can include identifying an encrypted guest memory location of a virtual machine (VM), the encrypted guest memory location associated with a virtual device, and copying a first set of encrypted data from the encrypted guest memory location to hypervisor memory to create a copied set of encrypted data. They can also include comparing a second set of encrypted data from the encrypted guest memory location with the copied set of encrypted data, and responsive to detecting a difference between the second set of encrypted data and the copied set of encrypted data, requesting, unencrypted data comprising a request related to the virtual device.
1. A method comprising:
identifying, by a hypervisor running on a host computer system, an encrypted guest memory location of a memory of a virtual machine (VM), the encrypted guest memory location associated with a virtual device;
copying, by the hypervisor, a first set of encrypted data from the encrypted guest memory location to a hypervisor memory that is separate from the memory of the VM to create a copied set of encrypted data in the hypervisor memory;
placing, by a guest operating system of the VM, a request for communication with the virtual device in the encrypted guest memory location to produce a second set of encrypted data at the encrypted guest memory location;
comparing, by the hypervisor, the second set of encrypted data from the encrypted guest memory location with the copied set of encrypted data in the hypervisor memory; and
responsive to detecting a difference between the second set of encrypted data and the copied set of encrypted data, requesting, by the hypervisor, unencrypted data comprising the request for communication with the virtual device by the guest operating system, the unencrypted data comprising a decrypted version of the second set of encrypted data.
2. The method of claim 1 , further comprising:
accessing, by the hypervisor, the unencrypted data corresponding to the second set of encrypted data in an unencrypted memory location that is accessible by the hypervisor; and
executing, by the hypervisor, the request for communication with the virtual device using the unencrypted data.
3. The method of claim 2 , further comprising:
responsive to requesting, by the hypervisor, the unencrypted data comprising the request for communication with the virtual device, copying data comprising the request for communication with the virtual device from the encrypted guest memory location to the unencrypted memory location.
4. The method of claim 3 , further comprising:
executing, by the hypervisor, a guest agent to copy the data comprising the request for communication with the virtual device from the encrypted guest memory location to the unencrypted memory location.
5. The method of claim 4 , further comprising transmitting, by the guest agent, a notification to the hypervisor indicating that the unencrypted data is available for the hypervisor to access.
6. The method of claim 1 , wherein comparing the second set of encrypted data from the encrypted guest memory location with the copied set of encrypted data in the hypervisor memory comprises periodically accessing the encrypted guest memory location to detect whether any change has been made to data in the encrypted guest memory location.
7. The method of claim 1 , wherein the encrypted guest memory location associated with the virtual device is dedicated to storing requests for the virtual device.
8. A system comprising:
a memory device;
a processing device operatively coupled to the memory device, to perform operations comprising:
identifying, by a hypervisor running on a host computer system, an encrypted guest memory location of a memory of a virtual machine (VM), the encrypted guest memory location associated with a virtual device;
copying, by the hypervisor, a first set of encrypted data from the encrypted guest memory location to a hypervisor memory that is separate from the memory of the VM to create a copied set of encrypted data in the hypervisor memory;
placing, by a guest operating system of the VM, a request for communication with the virtual device in the encrypted guest memory location to produce a second set of encrypted data at the encrypted guest memory location;
comparing, by the hypervisor, the second set of encrypted data from the encrypted guest memory location with the copied set of encrypted data in the hypervisor memory; and
responsive to detecting a difference between the second set of encrypted data and the copied set of encrypted data, requesting, by the hypervisor, unencrypted data comprising the request for communication with the virtual device by the guest operating system, the unencrypted data comprising a decrypted version of the second set of encrypted data.
9. The system of claim 8 , wherein the operations further comprise:
accessing, by the hypervisor, the unencrypted data corresponding to the second set of encrypted data in an unencrypted memory location that is accessible by the hypervisor; and
executing, by the hypervisor, the request for communication with the virtual device using the unencrypted data.
10. The system of claim 9 , wherein the operations further comprise:
responsive to requesting, by the hypervisor, the unencrypted data comprising the request for communication with the virtual device, copying data comprising the request for communication with the virtual device from the encrypted guest memory location to the unencrypted memory location.
11. The system of claim 10 , wherein the operations further comprise:
executing, by the hypervisor, a guest agent to copy the data comprising the request for communication with the virtual device from the encrypted guest memory location to the unencrypted memory location.
12. The system of claim 11 , wherein the operations further comprise transmitting, by the guest agent, a notification to the hypervisor indicating that the unencrypted data is available for the hypervisor to access.
13. The system of claim 8 , wherein comparing the second set of encrypted data from the encrypted guest memory location with the copied set of encrypted data in the hypervisor memory comprises periodically accessing the encrypted guest memory location to detect whether any change has been made to data in the encrypted guest memory location.
14. The system of claim 8 , wherein the encrypted guest memory location associated with the virtual device is dedicated to storing requests for the virtual device.
15. A non-transitory computer-readable media storing instructions that, when executed, cause a processing device to:
identify, by a hypervisor running on a host computer system, an encrypted guest memory location of a memory of a virtual machine (VM), the encrypted guest memory location associated with a virtual device;
copy, by the hypervisor, a first set of encrypted data from the encrypted guest memory location to a hypervisor memory that is separate from the memory of the VM to create a copied set of encrypted data in the hypervisor memory;
place, by a guest operating system of the VM, a request for communication with the virtual device in the encrypted guest memory location to produce a second set of encrypted data at the encrypted guest memory location;
compare, by the hypervisor, the second set of encrypted data from the encrypted guest memory location with the copied set of encrypted data in the hypervisor memory; and
responsive to detecting a difference between the second set of encrypted data and the copied set of encrypted data, request, by the hypervisor, unencrypted data comprising the request for communication with the virtual device by the guest operating system, the unencrypted data comprising a decrypted version of the second set of encrypted data.
16. The non-transitory computer-readable media of claim 15 , wherein the instructions further cause the processing device to:
access, by the hypervisor, the unencrypted data corresponding to the second set of encrypted data in an unencrypted memory location that is accessible by the hypervisor; and
execute, by the hypervisor, the request for communication with the virtual device using the unencrypted data.
17. The non-transitory computer-readable media of claim 16 , wherein the instructions further cause the processing device to:
responsive to requesting, by the hypervisor, the unencrypted data comprising the request for communication with the virtual device, copy data comprising the request for communication with the virtual device from the encrypted guest memory location to the unencrypted memory location.
18. The non-transitory computer-readable media of claim 17 , wherein the instructions further cause the processing device to:
execute, by the hypervisor, a guest agent to copy the data comprising the request for communication with the virtual device from the encrypted guest memory location to the unencrypted memory location.
19. The non-transitory computer-readable media of claim 18 , wherein the instructions further cause the processing device to transmit, by the guest agent, a notification to the hypervisor indicating that the unencrypted data is available for the hypervisor to access.
20. The non-transitory computer-readable media of claim 15 , wherein the encrypted guest memory location associated with the virtual device is dedicated to storing requests for the virtual device.