Physical memory access control and isolation method

Abstract

The invention relates to a physical memory access control and isolation method. The method comprises the steps of obtaining first owner information (VMID) of a virtual machine and first task information (TID) of a task according to a memory access request sent by the task in the virtual machine; according to a virtual address generated by the request, looking for a system page table, and finding aphysical address corresponding to the virtual address; looking for a physical page attribute table, and obtaining second owner information (VMID) and second task information (TID) corresponding to the physical address; and at least according to the first owner information (VMID), the first task information (TID), the second owner information (VMID) and the second task information (TID), determining whether memory access is allowed or not. The problem of illegal access of a virtual machine management program, other tasks in the virtual machine and illegal codes of the current task in a virtualplatform to current task data can be well solved.

Description

technical field [0001] The invention relates to a physical memory access control and isolation method, in particular to a method for adding physical page attributes to realize the physical memory access control and isolation method at the task level in a virtual machine. Background technique [0002] AMD's SEV technology can encrypt the physical memory used by the virtual machine. The encrypted key can only be accessed by the security processor. The keys used by different virtual machines are different, and the keys used by the virtual machine and the hypervisor are also different, so it can ensure that the memory of the virtual machine cannot be accessed by other virtual machines or hypervisors. access. There are three main security risks in this kind of memory protection based on encryption: 1) If the attacker cracks the encryption algorithm, the protection will be completely invalid or there are some loopholes in the algorithm implementation, which will reduce the protec...

AI Technical Summary

Problems solved by technology

There are three main security risks in this kind of memory protection based on encryption: 1) If the attacker cracks the encryption algorithm, the protection will be completely invalid or there are some loopholes in the algorithm implementation, which will reduce the protection strength; 2) The data is not complete. The attacker can modify the encrypted data and the CPU cannot dynamically detect the changes in the data in real time; 3) The same key is used between the tasks inside the virtual machine, so the encrypted data is transparent to the tasks inside the virtual machine , the attacker can still exploit the vulnerabilities of the virtual machine to access the data that should be protected

Images