Secure virtual machine and peripheral device communication
AssigneeRed Hat, Inc.
InventorMichael Tsirkin
Life of this patent
Estimating the term…
Abstract
A method includes exposing a public cryptographic key associated with a peripheral device of a computing system to a guest running on the computing system. The method further includes receiving, from the guest, a message including a cryptographic nonce value encrypted with the public cryptographic key. The method further includes producing the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key. The method further includes using a shared cryptographic key generated from the cryptographic nonce value to access contents of a direct memory access (DMA) buffer associated with the peripheral device.
Claims20
A method comprising:
- exposing, by a peripheral device of a computing system, a public cryptographic key associated with the peripheral device of the computing system to a guest operating system running on the computing system, wherein the computing system comprises a memory further comprising a first memory space associated with the guest operating system;
- receiving, by the peripheral device, from the guest operating system, a message comprising a cryptographic nonce value encrypted with the public cryptographic key;
- producing, by the peripheral device, the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key;
- generating, by the peripheral device, a shared cryptographic key from the cryptographic nonce value produced by decrypting the message;
- and
- accessing, by the peripheral device, contents of a direct memory access (DMA) buffer associated with the peripheral device within a second memory space of the memory of the computing system using the shared cryptographic key.
A peripheral device of a computing system, the peripheral device comprising:
- a memory;
- and
- a processing device operatively coupled to the memory, the processing device to:
- expose a public cryptographic key associated with the peripheral device to a guest operating system running on the computing system, wherein the computing system comprises a system memory comprising a first memory space associated with the guest operating system;
- receive, from the guest operating system, a message comprising a cryptographic nonce value encrypted with the public cryptographic key;
- produce the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key;
- generate a shared cryptographic key from the cryptographic nonce value produced by decrypting the message;
- and
- use the shared cryptographic key to access contents of a direct memory access (DMA) buffer associated with the peripheral device within a second memory space of the system memory.
A non-transitory computer readable storage medium including instructions that, when executed by a processing device of a peripheral device of a computing system, cause the processing device to perform one or more operations comprising:
- exposing a public cryptographic key associated with the peripheral device of the computing system to a guest operating system running on the computing system, wherein the computing system comprises a memory further comprising a first memory space associated with the guest operating system;
- receiving, from the guest operating system, a message comprising a cryptographic nonce value encrypted with the public cryptographic key;
- producing the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key;
- and
- generating a shared cryptographic key from the cryptographic nonce value produced by decrypting the message;
- using the shared cryptographic key to access contents of a direct memory access (DMA) buffer associated with the peripheral device within a second memory space of the memory of the computing system.
Dependencies are inferred from the claim text.