Using a Minimal Hypervisor to Protect Sensitive Algorithms and Keys from Reverse Engineering

We propose a protection mechanism for sensitive algorithms and cryptographic keys on potentially vulnerable networked computers. We utilize an extremely minimal hypervisor, stored in a computer's BIOS along with the code or keys to be protected, to launch a single instance of the Linux operating system. For efficiency and simplicity, the operating system is given nearly full direct access to the computer's hardware with the exception of the BIOS and memory reserved for the hypervisor. The hypervisor only allows Linux black box access to the protected code through a hypercall interface. This prevents even an attacker who has obtained administrative access from copying the code off of the computer for reverse engineering or maintaining access to the cryptographic keys once the attack is discovered.