# US 10,769,272 B2 · Technology to protect virtual machines from malicious virtual machine managers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,272 B2 - Document ID: US10769272B2 - Status: Granted - Kind: B2 - Application number: 15/721,553 - Filed: 2017-09-29 - Published: 2019-04-04 - Granted: 2020-09-08 - Earliest claimed: 2017-09-29 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: David M. Durham; Karanvir S. Grewal; Sergej Deutsch; Michael Lemay - Web page: https://patentgrep.com/patent/US10769272B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 9/45554: {Instruction set architectures of guest OS and hypervisor or native processor differ, e.g. Bochs or VirtualPC on PowerPC MacOS} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, apparatuses and methods may provide for technology that associates a key domain of a plurality of key domains with a customer boot image, receives the customer boot image from the customer, and verifies the integrity of the customer boot image that is to be securely installed at memory locations determined from an untrusted privileged entity (e.g., a virtual machine manager). ## Claims ### Claim 1 A system comprising: a system agent that manages actions for an associated guest virtual machine that is to be provisioned; and a semiconductor hardware device provided between the system agent and memory of the system, the semiconductor hardware device comprising: a substrate; and logic coupled to the substrate, wherein the logic is implemented at least partly in one or more of configurable logic or fixed-functionality hardware logic, the logic coupled to the substrate working in conjunction with the system agent to: associate, using a key for a customer, a key domain of a plurality of key domains with a customer boot image associated with the guest virtual machine, the key being unknown to a virtual machine manager associated with the guest virtual machine; receive the customer boot image from the customer; partition, by at least the system agent, the customer boot image as a sequence of protocol data units (PDUs); load content of each PDU of the sequence of PDUs consecutively into a sequential page of the memory, wherein each page is loaded into a page table of the guest virtual machine and the logic keeps track of loading using a global transaction count for the key domain and a location in memory of the page; and verify an integrity of the customer boot image that is to be installed in the key domain by checking, using the key, a value calculated using the page location, content, and the global transaction count of each of the loaded PDUs. ### Claim 2 (depends on 1) The system according to claim 1, wherein the page table is to include one or more mappings of virtual addresses to physical addresses of the memory. ### Claim 3 (depends on 1) The system according to claim 1, wherein the system is to be provided in a cloud-based server. ### Claim 4 (depends on 1) The system according to claim 1, wherein the key domain is to be associated with the customer boot image based on the customer key received from the customer. ### Claim 5 (depends on 1) The system according to claim 1, wherein, to associate the key domain with the customer boot image, the logic coupled to the substrate is to create a new key domain to store the customer boot image. ### Claim 6 (depends on 1) The system according to claim 1, wherein, to associate the key domain with the customer boot image, the logic coupled to the substrate is to select the key domain among the plurality of key domains to store the customer boot image. ### Claim 7 (depends on 2) The system according to claim 2, wherein after a leaf page of the page table is completely filled with consecutive PDUs, the semiconductor hardware device moves to a previous PDU level. ### Claim 8 A semiconductor package apparatus of a system including a system agent that manages actions of an associated quest virtual machine that is to be provisioned, the semiconductor package apparatus comprising: a substrate; and logic coupled to the substrate, wherein the logic is implemented at least partly in one or more of configurable logic or fixed-functionality hardware logic, the logic coupled to the substrate working in conjunction with the system agent to: associate, using a key for a customer, a key domain of a plurality of key domains with a customer boot image associated with the guest virtual machine, the key being unknown to a virtual machine manager associated with the guest virtual machine; receive the customer boot image from a customer; partition, in conjunction with the system agent, the customer boot image as a sequence of protocol data units (PDUs); load content of each PDU of the sequence of PDUs consecutively into a sequential page in a memory, wherein each page is loaded into a page table of the guest virtual machine and the logic keeps track of loading using a global transaction count for the key domain and a location in memory of the page; and verify an integrity of the customer boot image that is to be installed in the key domain by checking, using the key, a value calculated using the page location, content and the global transaction count of each of the loaded PDUs. ### Claim 9 (depends on 8) The semiconductor package apparatus according to claim 8, wherein the page table is to include one or more mappings of virtual addresses to physical addresses of the memory. ### Claim 10 (depends on 8) The semiconductor package apparatus according to claim 8, wherein the semiconductor package apparatus is to be provided in a cloud-based server. ### Claim 11 (depends on 8) The semiconductor package apparatus according to claim 8, wherein the key domain is to be associated with the customer boot image based on the customer key received from the customer. ### Claim 12 (depends on 8) The semiconductor package apparatus according to claim 8, wherein, to associate the key domain with the customer boot image, the logic coupled to the substrate is to create a new key domain to store the customer boot image. ### Claim 13 (depends on 8) The semiconductor package apparatus according to claim 8, wherein, to associate the key domain with the customer boot image, the logic coupled to the substrate is to select the key domain among the plurality of key domains to store the customer boot image. ### Claim 14 (depends on 9) The semiconductor package apparatus according to claim 9, wherein after a leaf page of the page table is completely filled with consecutive protocol data units (PDUs), the semiconductor package apparatus moves to a previous PDU level. ### Claim 15 A method performed by a logic of a semiconductor hardware device in conjunction with a system agent, executing on the semiconductor hardware device, wherein the system agent manages actions of an associated quest virtual machine that is to be provisioned and the logic is implemented at least partly in one or more of configurable logic or fixed-functionality hardware logic of the semiconductor hardware device, the method comprising: associating, using a key for a customer, a key domain of a plurality of key domains with a customer boot image associated with the guest virtual machine, the key being unknown to a virtual machine manager associated with the guest virtual machine; receiving the customer boot image from a customer; partitioning, by at least the system agent, the customer boot image as a sequence of protocol data units (PDUs); loading content of each PDU of the sequence of PDUs consecutively into a sequential page of a memory, wherein each page is loaded into a page table of the guest virtual machine and the logic keeps track of loading using a global transaction count for the key domain and a location in memory of the page; and verifying an integrity of the customer image that is to be installed in the key domain by checking, using the key, a value calculated using the page location, content, and the global transaction count of each of the loaded PDUs. ### Claim 16 (depends on 15) The method according to claim 15, wherein the page table is to include one or more mappings of virtual addresses to physical addresses of the memory.