Dynamic Firewall Control for MPU Protection in VM Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems with MMU and SMMU are vulnerable to attacks, compromising the security of virtual machines and devices, necessitating higher privilege protection.
Innovation Solution
Implementing a dynamic firewall mechanism involving a memory protection unit (MPU) and hypervisor to set and adjust protection ranges based on permission information, combining static and dynamic firewalls for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a hypervisor utilizes an MMU to perform virtualization and isolation operations on VMs, then resource allocation and address translation efficiency are improved, but the system becomes vulnerable to attacks that can compromise VM security
Solution Approach 1:
The patent introduces a firewall as an intermediary component between the hypervisor and the MMU. This firewall intercepts and filters memory access requests, blocking malicious attacks before they reach the MMU while allowing legitimate traffic to pass through. The firewall acts as a mediator that protects the MMU from exploitation without interfering with its normal virtualization and address translation functions, thus maintaining productivity while improving reliability.
2Productivity
If a hypervisor utilizes an SMMU to perform virtualization and isolation operations on devices, then device management efficiency is improved, but the system becomes vulnerable to attacks that can compromise device security
Solution Approach 1:
The patent introduces a firewall as an intermediary component between the hypervisor and the SMMU. This firewall intercepts and filters device access requests, blocking malicious attacks before they reach the SMMU while allowing legitimate traffic to pass through. The firewall acts as a mediator that protects the SMMU from exploitation without interfering with its normal device virtualization and address translation functions, thus maintaining productivity while improving reliability.
3Reliability
If traditional static firewall protection is implemented between MPU and hypervisor, then basic security is provided, but the system cannot adapt to dynamic attack patterns and changing permission requirements
Solution Approach 1:
The patent implements a dynamic firewall that can adjust its filtering rules in real-time based on changing system conditions, attack patterns, and permission requirements. Unlike static firewalls with fixed rules, this dynamic firewall can modify its behavior adaptively, allowing it to respond to new threats while maintaining basic security protection. This resolves the contradiction by providing both reliable security and adaptability.
Data Source
AI summary
A computing system includes a memory, an MPU, and a processor. The MPU is arranged to: receive permission information of the memory; and perform a protection operation through a dynamic firewall. The processor is arranged to execute a root manager and a hypervisor. The root manager is arranged to provide the permission information to the MPU. The hypervisor is arranged to: receive the permission information from the MPU; set the dynamic firewall according to the permission information; and provide the dynamic firewall to the MPU.