System and method for pre-boot authentication of a secure client hosted virtualization in an information handling system
A client hosted virtualization system (CHVS) includes a processor to execute code, a component, and a non-volatile memory. The non volatile memory includes BIOS code and code to implement a virtualization manager. The virtualization manager is operable to initialize the CHVS, launch a virtual machine on the CHVS, and assign the component to the virtual machine, such that the virtual machine has control of the component. The CHVS is configurable to execute the BIOS and not the virtualization manager, or to execute the virtualization manager and not the BIOS.
1. A client hosted virtualization system (CHVS) comprising:
a processor to execute code;
a first component;
a second component; and
a non-volatile memory including:
first code to implement a basic input/output system to initialize the CHVS; and
second code to implement a virtualization manager to:
initialize the CHVS;
launch a first virtual machine on the CHVS;
assign the first component to the first virtual machine, such that the first virtual machine has control of the first component;
assign the second component to the first virtual machine, such that the first virtual machine has control of the second component;
determine a first digital signature for the CHVS based on the first component and the second component; and
provide the first digital signature to the first virtual machine;
wherein the CHVS operates in a first mode to execute the first code to initialize the CHVS and to not execute the second code to initialize the CHVS, and operates in a second mode to execute the second code to initialize the CHVS and to not execute the first code to initialize the CHVS.
2. The CHVS of claim 1 , wherein:
the virtualization manager is further to launch a second virtual machine on the CHVS; and
the first virtual machine assigns the first component to the second virtual machine, such that the second virtual machine has access to the first component.
3. The CHVS of claim 2 , wherein:
the virtualization manager is further to authenticate a user of the CHVS prior to assigning the first component to the first virtual machine; and
assigning the first component to the first virtual machine is in response to authenticating the user.
4. The CHVS of claim 3 , wherein assigning the first component to the second virtual machine is in response to authenticating the user.
5. The CHVS of claim 1 , wherein the first component is a select one of a trusted platform module, a general purpose encryption engine, a universal security hub, and a combination thereof.
6. The CHVS of claim 1 , wherein:
the first virtual machine compares the first digital signature with a second digital signature to determine if the CHVS has been tampered with; and
the virtualization manager is further to provide an indication that the CHVS has been tampered with in response to the comparison.
7. The CHVS of claim 6 , wherein the indication includes shutting off the CHVS.
8. A method of providing a client hosted virtualization system (CHVS), comprising:
storing first code in a non-volatile memory of the CHVS to implement a basic input/output system to initialize the CHVS;
storing second code in the non-volatile memory to implement a virtualization manager for the CHVS;
determining if a switch of the CHVS is in a first state or a second state;
executing the first code to the exclusion of the second code if the switch is in the first state; and
executing the second code to the exclusion of the first code if the switch is in the second state;
wherein in executing the second code, the method further comprises:
initializing the CHVS;
launching a first virtual machine on the CHVS;
assigning a first component to the first virtual machine, such that the first virtual machine has control of the first component;
assigning a second component to the first virtual machine, such that the first virtual machine has control of the second component;
determining a first digital signature for the CHVS based on the first component and the second component; and
providing the first digital signature to the first virtual machine.
9. The method of claim 8 , further comprising:
launching a second virtual machine on the CHVS; and
assigning by the first virtual machine the first component to the second virtual machine, such that the second virtual machine has access to the first component.
10. The method of claim 9 , further comprising:
authenticating a user of the CHVS prior to assigning the first component to the first virtual machine;
wherein assigning the first component to the first virtual machine is in response to authenticating the user.
11. The method of claim 10 , wherein assigning the first component to the second virtual machine is in response to authenticating the user.
12. The method of claim 8 , wherein the first component is a select one of a trusted platform module, a general purpose encryption engine, a universal security hub, and a combination thereof.
13. The method of claim 8 , further comprising:
comparing at the first virtual machine the first digital signature with a second digital signature to determine if the CHVS has been tampered with; and
providing an indication that the CHVS has been tampered with in response to the comparison.
14. Machine-executable code for an information handling system, wherein the machine-executable code is embedded in a non-transitory storage medium and includes instructions for carrying out a method, the method comprising:
storing first code in a non-volatile memory of the CHVS to implement a basic input/output system to initialize the CHVS;
storing second code in the non-volatile memory to implement a virtualization manager for the CHVS;
determining if a switch of the CHVS is in a first state or a second state;
executing the first code to the exclusion of the second code in response to determining that the switch is in the first state; and
executing the second code to the exclusion of the first code in response to determining that the switch is in the second state;
wherein in executing the second code, the method further comprises:
initializing the CHVS;
launching a first virtual machine on the CHVS;
assigning a first component to the first virtual machine, such that the first virtual machine has control of the first component;
assigning a second component to the first virtual machine, such that the first virtual machine has control of the second component;
determining a first digital signature for the CHVS based on the first component and the second component; and
providing the first digital signature to the first virtual machine.
15. The machine-executable code of claim 14 , the method further comprising:
launching a second virtual machine on the CHVS; and
assigning by the first virtual machine the first component to the second virtual machine, such that the second virtual machine has access to the first component.
16. The machine-executable code of claim 15 , the method further comprising:
authenticating a user of the CHVS prior to assigning the first component to the first virtual machine;
wherein assigning the first component to the first virtual machine is in response to authenticating the user.
17. The machine-executable code of claim 14 , the method further comprising:
comparing at the first virtual machine the first digital signature with a second digital signature to determine if the CHVS has been tampered with; and
providing an indication that the CHVS has been tampered with in response to the comparison.