Securing results of privileged computing operations

摘要

A formalized set of interfaces (e.g., application programming interfaces (APIs)) is described, that uses a security scheme, such as asymmetric (or symmetric) cryptography, in order to secure the results of privileged operations on systems such as the operating system (OS) kernel and/or the hypervisor. The interface allows a public key to be included into a request to perform a privileged operation on a hypervisor and/or kernel. The kernel and/or hypervisor use the key included in the request to encrypt the results of the privileged operation. In some embodiments, the request itself can also be encrypted, such that any intermediate parties are not able to read the parameters and other information of the request.

主权项

1. A computer implemented method for securing data in a virtualized computing environment, said method comprising:
providing an interface to receive application programming interface (API) requests on a host computing device, the host computing device including at least one of: a hypervisor or a kernel; receiving, by the host computing device, a request to perform a privileged operation on the hypervisor or the kernel, the request being encrypted using a first key, the request including a second key as a parameter with the request, wherein the second key is used to at least encrypt information by the hypervisor or the kernel; wherein the hypervisor or the kernel is configured to decrypt the request and execute the privileged operation to produce a set of results on the host computing device, the set of results comprising hypervisor or kernel information including abnormal state information; encrypting, by the hypervisor or the kernel, the set of results by using the second key provided with the request, the set of results encrypted before the set of results are communicated out of the hypervisor or the kernel to an external location; and communicating the set of results encrypted with the second key to a location that is external with respect to the host computing device, wherein the set of results is decrypted using a private key.