Secure virtual machine and peripheral device communication
A method includes exposing a public cryptographic key associated with a peripheral device of a computing system to a guest running on the computing system. The method further includes receiving, from the guest, a message including a cryptographic nonce value encrypted with the public cryptographic key. The method further includes producing the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key. The method further includes using a shared cryptographic key generated from the cryptographic nonce value to access contents of a direct memory access (DMA) buffer associated with the peripheral device.
1 . A method comprising:
exposing, by a peripheral device of a computing system, a public cryptographic key associated with the peripheral device of the computing system to a guest operating system running on the computing system, wherein the computing system comprises a memory further comprising a first memory space associated with the guest operating system;
receiving, by the peripheral device, from the guest operating system, a message comprising a cryptographic nonce value encrypted with the public cryptographic key;
producing, by the peripheral device, the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key;
generating, by the peripheral device, a shared cryptographic key from the cryptographic nonce value produced by decrypting the message; and
accessing, by the peripheral device, contents of a direct memory access (DMA) buffer associated with the peripheral device within a second memory space of the memory of the computing system using the shared cryptographic key.
2 . The method of claim 1 , wherein receiving the cryptographic nonce value encrypted with the public cryptographic key comprises:
retrieving, by the peripheral device, the cryptographic nonce value from a pre-determined address of a memory of the peripheral device.
3 . The method of claim 1 , wherein the shared cryptographic key is used by the peripheral device and a processing device of the computing system to access the contents of the DMA buffer within the second memory space.
4 . The method of claim 1 , wherein exposing the public cryptographic key associated with the peripheral device of the computing system to the guest operating system running on the computing system comprises:
storing, by the peripheral device, the public cryptographic key in a configuration space of the peripheral device.
5 . The method of claim 1 , wherein using the shared cryptographic key to access the contents of the DMA buffer comprises:
responsive to receiving a first request to read the contents of the DMA buffer within the second memory space, decrypting, by the peripheral device with the shared cryptographic key, the contents of the DMA buffer.
6 . The method of claim 5 , further comprising:
responsive to receiving a second request comprising data to be stored at the DMA buffer, encrypting the data with the shared cryptographic key; and
storing, by the peripheral device, the data encrypted with the shared cryptographic key in the DMA buffer within the second memory space.
7 . The method of claim 1 , wherein the peripheral device is at least one of an encrypted storage device or a networking device.
8 . A peripheral device of a computing system, the peripheral device comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
expose a public cryptographic key associated with the peripheral device to a guest operating system running on the computing system, wherein the computing system comprises a system memory comprising a first memory space associated with the guest operating system;
receive, from the guest operating system, a message comprising a cryptographic nonce value encrypted with the public cryptographic key;
produce the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key;
generate a shared cryptographic key from the cryptographic nonce value produced by decrypting the message; and
use the shared cryptographic key to access contents of a direct memory access (DMA) buffer associated with the peripheral device within a second memory space of the system memory.
9 . The peripheral device of claim 8 , wherein to receive the cryptographic nonce value encrypted with the public cryptographic key, the processing device is to:
retrieve the cryptographic nonce value from a pre-determined address of the memory.
10 . The peripheral device of claim 8 , wherein the shared cryptographic key is used by the peripheral device and a processing device of the computing system to access the contents of the DMA buffer within the second memory space.
11 . The peripheral device of claim 8 , wherein to expose the public cryptographic key associated with the peripheral device to the guest operating system running on the computing system, the processing device is to:
store the public cryptographic key in a configuration space of the peripheral device.
12 . The peripheral device of claim 8 , wherein to use the shared cryptographic key to access the contents of the DMA buffer, the processing device is to:
responsive to receiving a first request to read the contents of the DMA buffer within the second memory space, decrypt, with the shared cryptographic key, the contents of the DMA buffer.
13 . The peripheral device of claim 12 , wherein the processing device is further to:
responsive to receiving a second request comprising data to be stored at the DMA buffer, encrypt the data with the shared cryptographic key; and
store the data encrypted with the shared cryptographic key in the DMA buffer within the second memory space.
14 . A non-transitory computer readable storage medium including instructions that, when executed by a processing device of a peripheral device of a computing system, cause the processing device to perform one or more operations comprising:
exposing a public cryptographic key associated with the peripheral device of the computing system to a guest operating system running on the computing system, wherein the computing system comprises a memory further comprising a first memory space associated with the guest operating system;
receiving, from the guest operating system, a message comprising a cryptographic nonce value encrypted with the public cryptographic key;
producing the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key; and
generating a shared cryptographic key from the cryptographic nonce value produced by decrypting the message;
using the shared cryptographic key to access contents of a direct memory access (DMA) buffer associated with the peripheral device within a second memory space of the memory of the computing system.
15 . The non-transitory computer readable storage medium of claim 14 , wherein receiving the cryptographic nonce value encrypted with the public cryptographic key comprises:
retrieving the cryptographic nonce value from a pre-determined address of a memory of the peripheral device.
16 . The non-transitory computer readable storage medium of claim 14 , wherein the shared cryptographic key is used by the peripheral device and a processing device of the computing system to access the contents of the DMA buffer within the second memory space.
17 . The non-transitory computer readable storage medium of claim 14 , wherein exposing the public cryptographic key associated with the peripheral device of the computing system to the guest operating system running on the computing system comprises:
storing the public cryptographic key in a configuration space of the peripheral device.
18 . The non-transitory computer readable storage medium of claim 14 , wherein using the shared cryptographic key to access the contents of the DMA buffer comprises:
responsive to receiving a first request to read the contents of the DMA buffer within the second memory space, decrypting, with the shared cryptographic key, the contents of the DMA buffer.
19 . The non-transitory computer readable storage medium of claim 14 , wherein the one or more operations further comprise:
responsive to receiving a second request comprising data to be stored at the DMA buffer, encrypting the data with the shared cryptographic key; and
storing the data encrypted with the shared cryptographic key in the DMA buffer within the second memory space.
20 . The non-transitory computer readable storage medium of claim 14 , wherein the peripheral device is at least one of an encrypted storage device or a networking device.