System and method for providing secure virtual machines
The present invention provides improved security in a virtual machine. By extending the capabilities of modern secure processors, privacy of computation is provided from both the owner of the equipment and other users executing on the processor, which is an advantageous feature for rentable, secure computers. In addition to the hardware extensions required to secure a virtualizable computer, an infrastructure for the deployment of such processors is also provided. Furthermore, a signaling flow to establish the various relationships between the owner, user and manufacturer of the equipment is disclosed.
1. A method for hosting a secure virtual machine, instantiated by a user, on a computer processor provided by an owner, comprising the steps of:
booting said computer processor with a zone manager image to start a zone manager session in accordance with a computer processor private key;
procuring at said computer processor a first public/private key pair (K ZM , K ZM −1 ) associated with the zone manager session;
generating a certificate (C(ZM)) for the public key (K ZM ) of said first public/private key pair using said private key associated with said computer processor;
receiving, at said computer processor running the zone manager, a secure virtual machine instantiation command from said owner as requested by said user, said secure virtual machine instantiation command including a certificate of said user (C(user));
creating between said zone manager and said user a secure communication channel;
creating, at said computer processor running the zone manager, a second public/private key pair (K SVM , K SVM −1 ) associated with the secure virtual machine;
generating a certificate (C(SVM)) for the public key of said second public/private key pair with the private key of said first public/private key pair; and
creating, between said secure virtual machine and said user a second secure communication channel certified by C(user) and C(SVM).
2. The method according to claim 1 , further comprising the step of:
booting the computer processor from a program stored in a private boot area.
3. The method according to claim 1 , further comprising the step of:
downloading said zone manager image to said computer processor, and verifying at said computer processor a validation value pertaining to said zone manager image, as a precondition for said booting of said computer processor with said zone manager image.
4. The method according to claim 1 , further comprising the step of:
associating with said secure virtual machine a cryptographic key for accessing particular content stored in a shared memory of said computer processor.
5. The method according to claim 1 , wherein a security aspect of said secure communication channel relies on said certificate pertaining to said user.
6. The method according to claim 5 , further comprising the step of:
providing said certificate pertaining to said user to said zone manager.
7. The method according to claim 5 , wherein said secure communication channel is secured by means of public key cryptography.
8. The method according to claim 1 , further comprising the step of:
updating a capability matrix with access permissions for said virtual machine.
9. The method according to claim 1 , further comprising the steps of:
preparing said secure virtual machine by providing it with a boot program; and
starting said secure virtual machine.
10. A non-transitory computer-readable medium storing computer-readable instructions that, when executed on a computer processor for hosting a secure virtual machine, instantiated by a user, on the computer processor, comprise the steps of:
booting said computer processor with a zone manager image to start a zone manager session in accordance with a computer processor private key;
procuring at said computer processor a first public/private key pair (K ZM , K ZM −1 ) associated with the zone manager session;
generating a certificate (C(ZM)) for the public key (K ZM ) of said first public/private key pair using said private key associated with said computer processor;
receiving, at said computer processor running the zone manager, a secure virtual machine instantiation command from said owner as initiated by said user, said secure virtual machine instantiation command including a certificate of said user (C(user));
creating between said zone manager and said user a secure communication channel;
creating, at said computer processor running the zone manager, a second public/private key pair (K SVM , K SVM −1 ) associated with the secure virtual machine; and
generating a certificate (C(SVM)) for the public key of said second public/private key pair with the private key of said first public/private key pair; and
creating, between said secure virtual machine and said user a second secure communication channel certified by C(user) and C(SVM).
11. The non-transitory computer-readable medium according to claim 10 , storing computer-readable instructions that further comprise the step of:
booting the computer processor from a program stored in a private boot area.
12. The non-transitory computer-readable medium according to claim 10 , storing computer-readable instructions that further comprise the step of:
downloading said zone manager image to said computer processor, and verifying at said computer processor a validation value pertaining to said zone manager image, as a precondition for said booting of said computer processor with said zone manager image.
13. The non-transitory computer-readable medium according to claim 10 , storing computer-readable instructions that further comprise the step of:
associating with said secure virtual machine a cryptographic key for accessing particular content stored in a shared memory of said computer processor.
14. The non-transitory computer-readable medium according to claim 10 , wherein a security aspect of said secure communication channel relies on said certificate pertaining to said user.
15. The non-transitory computer-readable medium according to claim 14 , storing computer-readable instructions that further comprise the step of:
providing said certificate pertaining to said user to said zone manager.
16. The non-transitory computer-readable medium according to claim 14 , wherein said secure communication channel is secured by means of public key cryptography.
17. The non-transitory computer-readable medium according to claim 10 , storing computer-readable instructions that further comprise the step of:
updating a capability matrix with access permissions for said virtual machine.
18. The non-transitory computer-readable medium according to claim 10 , storing computer-readable instructions that further comprise the step of:
preparing said secure virtual machine by providing it with a boot program; and
starting said secure virtual machine.