Address Translation Circuitry Secure Memory Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualization environments, it is challenging to enable multiple virtual machines to access secure memory without introducing an additional privilege level for the hypervisor, as existing systems lack the necessary privilege distinction within the secure domain, allowing secure virtual machines to potentially modify address translation mechanisms and access each other's secure data.
Innovation Solution
A data processing apparatus with address translation circuitry that uses a trusted virtual machine identifier managed by the hypervisor to control access to secure memory, allowing trusted virtual machines to access secure memory while maintaining separation through a two-stage page table system, where the hypervisor manages the second stage page table to ensure secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If multiple virtual machines are allowed to access secure memory without additional privilege levels, then device complexity is reduced, but security reliability deteriorates as virtual machines could potentially modify address translation mechanisms and access each other's secure data
Solution Approach 1:
The patent segments the address translation mechanism into two distinct stages: first stage page table managed by the virtual machine and second stage page table managed by the hypervisor. This segmentation allows multiple virtual machines to access secure memory while maintaining security through layered control, resolving the contradiction between reduced complexity and maintained security reliability.
Solution Approach 2:
The patent introduces a trusted virtual machine identifier as an intermediary mechanism that mediates between virtual machines and secure memory access. This identifier acts as a trust credential that the hypervisor verifies before allowing access to the second stage page table, enabling secure multi-tenant access without additional privilege levels while maintaining data isolation.
2Ease of operation
If a single privilege level is used for both hypervisor and virtual machines in secure domain, then ease of operation is improved, but security control capability deteriorates as the hypervisor cannot enforce address translation control
Solution Approach 1:
The patent implements dynamic access control where the hypervisor can selectively enable or disable access to the second stage page table based on the trusted virtual machine identifier. This dynamic control allows the system to maintain a simple single-level privilege structure while providing adaptable security control capabilities that activate only when needed for secure memory access.
Solution Approach 2:
The patent changes the control parameter from privilege level to trusted identifier verification. Instead of using different privilege levels to control access, the system uses a trusted virtual machine identifier parameter that the hypervisor checks to determine whether to allow access to secure memory through the second stage page table, maintaining operational simplicity while providing necessary control.
3Reliability
If trusted virtual machine identifiers are verified for each access request, then secure data protection is improved, but processing speed deteriorates due to additional verification overhead
Solution Approach 1:
The patent performs preliminary verification of the trusted virtual machine identifier when the virtual machine first requests access to secure memory. The hypervisor verifies the identifier and sets up the appropriate address translation mappings in advance, so that subsequent accesses to secure memory do not require repeated verification, thus maintaining security while reducing processing overhead for normal operations.
Solution Approach 2:
The patent implements a nested address translation structure where the first stage page table (managed by virtual machine) is nested within the second stage page table (managed by hypervisor). This nested structure allows the system to verify trust credentials at the outer layer while providing fast direct access through the inner layer for authenticated virtual machines, balancing security verification with access speed.
Data Source
AI summary
Processing circuitry executes hypervisor software to support the execution of multiple virtual machines on the processing circuitry. A memory system stores data for access by the processing circuitry and includes secure memory and non-secure memory . The secure memory is only accessible via a secure access request. Address translation circuitry is responsive to an access request issued by a current virtual machine specifying a virtual address, to perform an address translation process to identify a physical address in the memory, and to cause a modified access request to be issued to the memory system specifying the physical address. The hypervisor software sets a trusted virtual machine identifier if the current virtual machine is to be trusted to access the secure memory. The address translation circuitry can only cause the modified access request to be issued as a secure access request to the secure memory if the trusted identifier is set.