Secured peripheral device communication in virtualized computer system
Systems and methods for securing assigned peripheral device in virtualized computer system. An example method may comprise receiving, by a virtualized execution environment, a state measurement associated with a peripheral device of the computing system. Generating a guest cryptographic key. Responsive to validating the state measurement, transmitting, to the peripheral device, the guest cryptographic key encrypted using the device cryptographic key. Transmitting, to the peripheral device, an access request that is cryptographically signed using a first value derived from the device cryptographic key or a second value derived from the guest cryptographic key and encrypted using a third value derived from the guest cryptographic key.
1 . A method comprising:
receiving, by a virtualized execution environment running on a computing system, a state measurement comprising a hash function associated with a peripheral device of the computing system;
retrieving, by the virtualized execution environment, a device cryptographic key generated by the peripheral device and stored on the peripheral device;
generating a guest cryptographic key based on applying a hash transformation to an ephemeral value;
responsive to validating the state measurement, transmitting, to the peripheral device, the guest cryptographic key encrypted using the device cryptographic key; and
transmitting, to the peripheral device, an access request that is cryptographically signed using at least one of: a first value derived from the device cryptographic key or a second value derived from the guest cryptographic key and encrypted using a third value derived from the guest cryptographic key.
2 . The method of claim 1 , wherein validating the state measurement comprises:
comparing the state measurement with an expected state measurement.
3 . The method of claim 1 , wherein the ephemeral value is a random value.
4 . The method of claim 1 , wherein the virtualized execution environment is represented by one of: a virtual machine or a container.
5 . A peripheral device of a computing system, the peripheral device comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
generate a device cryptographic key associated with the peripheral device;
transmit, to a virtualized execution environment running on the computing system, a state measurement comprising a hash function associated with the peripheral device;
provide the device cryptographic key to the virtualized execution environment;
receive, from the virtualized execution environment, a guest cryptographic key generated based on applying a hash transformation to an ephemeral value and encrypted using the device cryptographic key; and
receive, from the virtualized execution environment, an access request that is cryptographically signed using at least one of: a first value derived from the device cryptographic key or a second value derived from the guest cryptographic key and encrypted using a third value derived from the guest cryptographic key.
6 . The peripheral device of claim 5 , wherein, to receive the guest cryptographic key cryptographically signed using the device cryptographic key, the processing device is to:
verify that the guest cryptographic key has not been compromised using the device cryptographic key; and
store the guest cryptographic key in a configuration space of the peripheral device.
7 . The peripheral device of claim 5 , responsive to receiving the access request, the processing device is to:
decrypt the access request using the guest cryptographic key; and
validate the access request using the device cryptographic key.
8 . The peripheral device of claim 7 , wherein the processing device is further to:
responsive to validating the access request, execute the access request.
9 . The peripheral device of claim 7 , wherein the processing device is further to:
responsive to failing validation of the access request, transmit, to the virtualized execution environment, a validation failure, wherein the validation failure indicates that the peripheral device has been compromised.
10 . The peripheral device of claim 5 , wherein the device cryptographic key associated with the peripheral device is stored in a configuration space of the peripheral device.
11 . The peripheral device of claim 5 , wherein the virtualized execution environment is represented by one of: a virtual machine or a container.
12 . A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to:
receive, by a virtualized execution environment running on the processing device, a state measurement comprising a hash function associated with a peripheral device of the computing system;
retrieve, by the virtualized execution environment, a device cryptographic key generated by the peripheral device and stored on the peripheral device;
generate a guest cryptographic key based on applying a hash transformation to an ephemeral value;
responsive to validating the state measurement, transmit, to the peripheral device, the guest cryptographic key encrypted using the device cryptographic key; and
transmit, to the peripheral device, an access request that is cryptographically signed using at least one of: a first value derived from the device cryptographic key or a second value derived from the guest cryptographic key and encrypted using a third value derived from the guest cryptographic key.
13 . The non-transitory computer readable storage medium of claim 12 , wherein, to validate the state measurement, the instructions cause the processing device to:
verify that the state measurement has not been compromised using the device cryptographic key; and
compare the state measurement with an expected state measurement.
14 . The non-transitory computer readable storage medium of claim 12 , wherein the ephemeral value is a short-term value that is generated in response to validating the state measurement.
15 . The non-transitory computer readable storage medium of claim 12 , wherein the virtualized execution environment is represented by one of: a virtual machine or a container.