Secured peripheral device communication via bridge device in virtualized computer system
Systems and methods for secured peripheral device communication via a bridge device in virtualized computer systems. An example method may comprise receiving, by a virtualized execution environment running on a computing system, a state measurement associated with a bridge device of the computing system; generating an ephemeral key; responsive to validating the state measurement, transmitting, to the bridge device, the ephemeral key encrypted using a device key associated with the bridge device; and transmitting, to the bridge device, an access request directed to a peripheral device accessible via the bridge device, wherein the access request is encrypted using a value derived from the ephemeral key.
1 . A method comprising:
receiving, by a virtualized execution environment running on a computing system, a state measurement associated with a bridge device of the computing system;
generating an ephemeral key;
responsive to validating the state measurement, transmitting, to the bridge device, the ephemeral key encrypted using a device key associated with the bridge device;
transmitting, to the bridge device, an access request directed to a peripheral device accessible via the bridge device, wherein the access request is encrypted using a value derived from the ephemeral key; and
responsive to receiving an interrupt from the bridge device, suspending the virtualized execution environment.
2 . The method of claim 1 , wherein the virtualized execution environment is represented by one of: a virtual machine or a container.
3 . The method of claim 1 , wherein the bridge device is a Peripheral Component Interconnect (PCI)-to-PCI bridge.
4 . The method of claim 1 , wherein the peripheral device is one of: a Peripheral Component Interconnect express (PCIe) device, a virtual function of the PCIe device, or a sub-function of the PCIe device.
5 . The method of claim 1 , where the bridge device is one of: a physical bridge device or a virtual bridge device.
6 . The method of claim 1 , wherein generating the ephemeral key comprises applying a predetermined transformation on an ephemeral value and the device key.
7 . The method of claim 1 , wherein validating the state measurement comprises:
comparing the state measurement of the bridge device with an expected state measurement of the bridge device.
8 . The method of claim 1 , wherein transmitting the ephemeral key includes encrypting the ephemeral key.
9 . The method of claim 8 , further comprising:
transmitting the validated state measurement using the device key associated with the bridge device.
10 . The method of claim 1 , wherein the access request is initiated by an application of the virtualized execution environment running on the computing system.
11 . The method of claim 1 ,
wherein the interrupt indicates that a configuration space of the bridge device has been altered.
12 . A bridge device of a computing system, the bridge device comprising:
a memory; and
a controller operatively coupled to the memory, the controller to:
receive an ephemeral key;
responsive to receiving, from a processor of the computing system, an encrypted access request directed to a peripheral device accessible via the bridge device, decrypt, the access request using the ephemeral key;
forward the decrypted access request to the peripheral device;
receive, from the peripheral device, a response to the access request;
encrypt the response using the ephemeral key;
forward the response to the processor; and
responsive to an alteration of a configuration space of the bridge device, transmit an interrupt command to the processor.
13 . The bridge device of claim 12 , wherein the controller is to:
obtain a current state measurement associated with the bridge device;
compare the current state measurement and a state measurement validated by the processor; and
determine whether the current state measurement matches the state measurement validated by the processor.
14 . The bridge device of claim 13 , wherein the controller is to forward the decrypted access request to the peripheral device responsive to determining that current state measurement matches the state measurement validated by the processor.
15 . The bridge device of claim 13 , wherein the controller is further to:
responsive to determining that current state measurement does not match the state measurement validated by the processor, transmit a reset command to the peripheral device.
16 . The bridge device of claim 13 , wherein the controller is further to:
responsive to determining that current state measurement does not match the state measurement validated by the processor, transmit the interrupt command to the processor.
17 . A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to:
receive, by a virtualized execution environment running on a computing system, a state measurement associated with a bridge device of the computing system;
generate an ephemeral key;
responsive to validating the state measurement, transmit, to the bridge device, the ephemeral key encrypted using a device key associated with the bridge device;
transmit, to the bridge device, an access request directed to a peripheral device accessible via the bridge device, wherein the access request is encrypted using a value derived from the ephemeral key; and
responsive to receiving an interrupt from the bridge device, suspend the virtualized execution environment.
18 . The non-transitory computer readable storage medium of claim 17 , wherein the virtualized execution environment is represented by one of: a virtual machine or a container.
19 . The non-transitory computer readable storage medium of claim 17 , wherein the bridge device is a Peripheral Component Interconnect (PCI)-to-PCI bridge.
20 . The non-transitory computer readable storage medium of claim 17 , wherein the peripheral device is one of: a Peripheral Component Interconnect express (PCIe) device, a virtual function of the PCIe device, or a sub-function of the PCIe device.