US 9,792,143 B1Granted

Platform secure execution modes

AssigneeAmazon Technologies, Inc.

InventorsNachiketh Rao Potlapally, Derek Del Miller, Mark Bradley Davis, Matthew Shawn Wilson, Eric Jason Brandwine, Anthony Nicholas Liguori, Rahul Gautam Patel

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

The performing of virtual machine (VM)-based secure operations is enabled using a trusted co-processor that is able to operate in a secure mode to perform operations in a multi-tenant environment that are protected from other VMs and DOM-0, among other domains and components. A customer VM can contact a VM manager (VMM) to perform an operation with respect to sensitive data. The VMM can trigger secure mode operation, whereby memory pages are marked and access blocked to entities outside a trusted enclave. The trusted co-processer can measure the VMM and compare the result against an earlier result to ensure that the VMM has not been compromised. Once the operations are performed, the trusted co-processor can return the results, and the VMM can exit the secure mode such that access to the marked pages and customer data is restored.

Claims18

Dependent claims

A host computer system, comprising:

at least one processor configured to operate a virtual machine manager (VMM);
a peripheral device including a co-processor configured to communicate with the VMM;
and
memory storing instructions that, when executed by the at least one processor, cause the host computer system to:
cause the co-processor to generate a first hash value of code for the VMM;
receive a request from a customer virtual machine (VM) running on the VMM, the customer VM associated with a customer having an account with a provider of the host computer system, the request involving an operation involving data indicated to be sensitive data for the customer;
cause the host computer system to operate in a secure mode wherein memory pages within the customer VM for the request are marked for access restricted to the customer VM and the co-processor;
cause the co-processor to generate a second hash value of code for the VMM;
receive, from the co-processor, result data for the operation in response to coprocessor determining that the second hash value matches the first hash value;
and
cause the host computer system to cease operating in the secure mode and remove the access restriction from the memory pages within the customer VM.

8 more elements

A computer-implemented method, comprising:

receiving a request from a guest virtual machine (VM) to a virtual machine manager (VMM) executing on a processor of a computing system, the request involving an operation associated with sensitive data for a user associated with the guest VM;
causing the computing machine to operate in a secure mode, the secure mode causing one or more memory pages within the guest VM to be marked for access restricted to the guest VM and the trusted co-processor;
restricting access to the sensitive data to at most the guest VM and a trusted co-processor;
causing information for the request to be submitted to the trusted co-processor, the trusted co-processor configured to compare one or more current values for the VMM with one or more previously-determined values for the VMM to determine whether an unexpected modification has occurred to the VMM;
receiving result data from the trusted co-processor in response to the trusted co-processor determining that the unexpected modification has not occurred to the VMM and the trusted coprocessor thereafter having performed the operation;
and
providing the result data to the guest VM, access to the one or more memory pages within the VM being re-enabled for any component having the access before the restricting.

4 more elements

A system, comprising:

at least one processor configured to operate a virtual machine manager (VMM);
and
memory storing instructions that, when executed by the at least one processor, cause the system to:
receive a request from a guest virtual machine (VM) to the VMM, the request involving an operation associated with sensitive data for a user associated with the guest VM;
operate in a secure mode in response to receiving the request, the secure mode causing one or more memory pages within the guest VM for the operation to be marked for access restricted to the guest VM and the trusted co-processor;
restrict access to the sensitive data to at most the guest VM and a trusted co-processor of the system;
cause information for the request to be submitted to the trusted co-processor, the trusted co-processor configured to compare one or more current values for the VMM with one or more previously-determined values for the VMM to determine whether an unexpected modification has occurred to the VMM;
receive result data from the trusted co-processor in response to the trusted co-processor determining that the unexpected modification has not occurred to the VMM and the trusted co-processor thereafter having performed the operation;
and
provide the result data to the guest VM, access to the one or more memory pages within the guest VM being re-enabled for any component having the access before the restricting.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/921,555Filed 23 Oct 2015
Granted: 17 Oct 2017
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
G06F 21/72
To assure secure computing or processing of information: in cryptographic circuits