Virtualized trusted descriptors
Embodiments of information processing systems and associated components can include logic operable to perform operations in a virtualized system including a plurality of guest operating systems using descriptors. The descriptors specify a set of commands defining the operations in a plurality of security domains and specify permission to a plurality of resources selectively for the plurality of guest operating systems.
1. An electronic circuit comprising:
a module configured to perform operations specified by a descriptor comprising a set of commands that define the operations, a digital signature that verifies validity of the descriptor, and a security domain identifier that specifies access to resources in a plurality of security domains, wherein:
the module comprises logic that tags signed descriptors with the security domain identifier by combining the descriptor with the security domain identifier before signing the descriptor.
2. The electronic circuit according to claim 1 wherein:
the module is configured to receive the security domain identifier and to digitally sign the descriptor incorporating the security domain identifier within the signed descriptor.
3. The electronic circuit according to claim 1 wherein:
the module comprises logic that enables controlled signing of descriptors using the security domain identifier, wherein the security domain identifier is specified by a virtual machine monitor configured to specify the security domain identifier distinctively for a plurality of guest operating systems in a virtualized system and protect integrity of the security domain identifier.
4. The electronic circuit according to claim 1 wherein:
the module comprises logic that virtualizes the descriptor by combining the security domain identifier with the descriptor and then signing the combined security domain identifier and descriptor, the security domain identifier set by a supervisory virtual machine monitor for usage by a guest operating system that is operable when signing the descriptor, wherein the descriptor is tagged with the security domain identifier but unable to modify the security domain identifier.
5. The electronic circuit according to claim 1 wherein:
the module comprises logic that authenticates descriptors and grants the authenticated descriptors elevated permissions only when the security domain identifier used for authentication is the same as the security domain identifier used when signing the descriptor.
6. The electronic circuit according to claim 1 wherein:
the module comprises logic that elevates permissions only to resources specified by the security domain identifier to be owned by a guest operating system associated specifically with the descriptor but not to other resources.
7. An information processing system comprising:
logic operable to perform operations in a virtualized system including a plurality of guest operating systems using descriptors that specify a set of commands defining the operations in a plurality of security domains and that specify permission to a plurality of resources selectively for the plurality of guest operating systems; and
a module including logic stored in a memory, the logic stored in the memory configured to tag signed descriptors with a security domain identifier by combining the descriptor with the security domain identifier before signing the descriptor.
8. The information processing system according to claim 7 further comprising:
a virtual machine monitor operable to allocate a plurality of resources among a plurality of users, the virtual machine monitor configured to run the plurality of guest operating systems, and set the security domain identifier distinctively for selected ones of the plurality of guest operating systems, wherein the selected guest operating system is operable when signing a descriptor associated with the guest operating system by tagging the descriptor with the security domain identifier but is unable to modify the security domain identifier.
9. The information processing system according to claim 7 further comprising:
at least one descriptor comprising a set of commands that define the operations, a digital signature that verifies validity of the descriptor, and the security domain identifier that specifies access to resources in a plurality of security domains in a virtualized system.
10. The information processing system according to claim 7 further comprising:
the module including executable logic stored in the memory that receives the security domain identifier and digitally signs the descriptor wherein the security domain identifier is incorporated within the signed descriptor.
11. The information processing system according to claim 7 further comprising:
the module including executable logic stored in the memory that enables controlled signing of descriptors using the security domain identifier specified by a virtual machine monitor configured to specify the security domain identifier distinctively for a selected one of the plurality of guest operating systems and protect integrity of the security domain identifier.
12. The information processing system according to claim 7 further comprising:
the module including executable logic stored in the memory that virtualizes the descriptor by combining the security domain identifier with the descriptor and then signing the combined security domain identifier and descriptor, the security domain identifier set by a supervisory virtual machine monitor for usage by a guest operating system that is unable to modify the security domain identifier, the module operable when signing the descriptor, wherein the descriptor is tagged with the security domain identifier.
13. The information processing system according to claim 7 further comprising:
the module including executable logic stored in the memory that authenticates descriptors and grants the authenticated descriptors elevated permissions only when the security domain identifier used for authentication is the same as the security domain identifier used when signing the descriptor.
14. The information processing system according to claim 7 further comprising:
the module including executable logic stored in the memory that elevates permissions only to resources specified by the security domain identifier to be owned by a guest operating system associated specifically with the descriptor but not to other resources.
15. A method for securing an information system comprising:
performing operations in a system including a plurality of entities;
controlling the performance of operations using a plurality of descriptors;
specifying in one or more of the plurality of descriptors a set of commands defining the operations in a plurality of security domains;
specifying in one or more of the plurality of descriptors permission to a plurality of resources selectively for the plurality of entities;
digitally signing one or more of the plurality of descriptors incorporating a security domain identifier within the signed descriptor; and
tagging digitally signed descriptors with the security domain identifier by combining one or more of the plurality of descriptors with the security domain identifier before signing the descriptor.
16. The method for securing an information system according to claim 15 further comprising:
allocating a plurality of resources among a plurality of users in a virtualized system including a plurality of guest operating systems;
specifying in one or more of the plurality of descriptors permission to a plurality of resources selectively for the plurality of guest operating systems;
running the plurality of guest operating systems; and
setting a security domain identifier distinctively for selected one or more of the plurality of guest operating systems wherein the plurality of guest operating systems are operable when signing the one or more of the plurality of descriptors by tagging the descriptor with the security domain identifier while unable to modify the security domain identifier.
17. The method for securing an information system according to claim 15 further comprising:
receiving a security domain identifier specified to identify distinctively one or more of a plurality of guest operating systems and protect integrity of the security domain identifier;
enabling controlled signing of descriptors using the security domain identifier; and
virtualizing a descriptor by hashing the security domain identifier in combination with the descriptor and then signing the descriptor.
18. The method for securing an information system according to claim 15 further comprising:
authenticating descriptors;
granting the authenticated descriptors elevated permissions only when the security domain identifier used for authentication is the same as the security domain identifier used when signing the descriptor; and
elevating permissions only to resources specified by the security domain identifier to be owned by a guest operating system associated specifically with a descriptor but not to other resources.