Hardware Partitioning for Cloud Servers Without Hypervisor Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing environments, such as bare-metal and VM environments, lead to inefficient use of computing resources and security vulnerabilities due to the allocation of entire servers or shared resources, which can be exploited by hypervisors.
Innovation Solution
A cloud computing system that statically partitions a cloud server's computing resources using processor cores, DVM interposers, and interrupt interposers to ensure secure and efficient use by individual customers without hypervisor intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If entire servers are allocated to individual customers (bare-metal environment), then security is improved, but resource utilization efficiency deteriorates
Solution Approach 1:
The patent divides a physical server into multiple isolated partitions using hardware-based virtualization (Intel VT-x, AMD-V). Each partition is assigned to a different customer and includes dedicated processor cores, memory, and I/O resources. This segmentation allows multiple customers to share a single server with enhanced security isolation, resolving the contradiction between security and resource utilization efficiency.
2Productivity
If server resources are shared among multiple customers (VM environment), then resource utilization efficiency is improved, but security vulnerabilities increase due to hypervisor exploitation
Solution Approach 1:
The patent extracts and eliminates the hypervisor layer from the system architecture. Instead of using software-based virtualization that requires a hypervisor, the invention implements hardware-based partitioning where the server's memory management unit (MMU) and processor directly enforce isolation between partitions. This removes the security vulnerability associated with hypervisor exploitation while maintaining resource sharing capabilities.
Solution Approach 2:
The patent introduces hardware-based interposers as intermediary components between processor cores and memory/I/O devices. These interposers enforce partition boundaries and prevent unauthorized access between partitions at the hardware level, providing secure resource sharing without requiring a software hypervisor. This intermediary mechanism resolves the security concerns of shared resources.
3Reliability
If hardware partitioning is implemented without hypervisor, then security is improved by eliminating hypervisor vulnerabilities, but system complexity increases due to direct hardware management
Solution Approach 1:
The patent enables partitions to self-manage their resources through hardware-based mechanisms. Each partition has dedicated processor cores that directly manage their own memory and I/O resources without requiring hypervisor intervention. The hardware automatically enforces isolation boundaries, allowing partitions to operate independently and reducing overall system complexity despite the absence of a hypervisor.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system for hardware partitions for a cloud server includes one or more processor cores. A first processor core executes instructions to partition at least a portion of the one or more processor cores into one or more partitions. The system includes one or more distributed virtual memory (DVM) interposers, each DVM interposer including a respective partition identifier that identifies a partition. Each DVM interposer, responsive to receiving a DVM message that includes a partition identifier that differs from the partition identifier of the DVM interposer, performs a preventative action. The system includes one or more interrupt interposers. Each interrupt interposer is associated with a processor core of the one or more processor cores. Each interrupt interposer prevents a first interrupt originating from the associated processor core from being provided to a processor core that is outside the partition of the associated processor core.