Dynamic EPT and SPT Switching for Processor Trojan Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing systems face challenges in securely verifying the execution state of processors, particularly in virtualization environments, due to hardware Trojans and the inability to copy architecturally-invisible TLB contents, leading to potential false-positive indications of Trojan interference.
Innovation Solution
Implementing dynamic switching between extended page tables (EPT) and shadow page tables (SPT) to enable periodic verification of processor states, using a replay co-processor to compare execution states and detect Trojan interference by transitioning between EPT and SPT modes during verification intervals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If shadow page tables are used for verification, then measurement precision of processor state is improved, but device complexity increases due to maintaining dual page table structures
Solution Approach 1:
The system dynamically switches between EPT mode and SPT mode based on verification requirements. During normal operation, EPT is used for performance. During verification intervals, the system transitions to SPT mode to enable accurate processor state copying and verification, then switches back to EPT mode afterward.
Solution Approach 2:
The system implements periodic verification by alternating between EPT mode for normal processing and SPT mode for verification intervals. This periodic switching allows the system to maintain both high performance during normal operation and accurate verification capability when needed.
2Productivity
If EPT mode is used for normal processing, then productivity is improved, but reliability decreases due to inability to copy TLB contents for verification
Solution Approach 1:
The system dynamically changes its operational mode based on whether verification is needed. In EPT mode, the system achieves high processing speed. When verification is required, it transitions to SPT mode where accurate state copying becomes possible, thus maintaining both productivity and reliability.
Solution Approach 2:
The system uses SPT as an intermediary structure that enables verification. By switching to SPT mode during verification intervals, the system can create accurate copies of processor state including TLB contents, allowing verification without compromising the performance benefits of EPT mode during normal operation.
3Measurement precision
If dynamic switching between EPT and SPT is implemented, then false positives are reduced, but device complexity increases due to mode transition mechanisms
Solution Approach 1:
The system implements dynamic mode switching between EPT and SPT to reduce false positives in Trojan detection. By using SPT mode during verification, the system can accurately compare processor states, thereby improving detection reliability despite the added complexity of managing two operational modes.
Solution Approach 2:
The system performs periodic verification by switching to SPT mode at scheduled intervals, executing verification operations, then returning to EPT mode. This periodic approach minimizes the impact of mode switching complexity while ensuring accurate Trojan detection through regular verification cycles.
Data Source
AI summary
Implementations disclosed describe a system and a method to execute a virtual machine on a processing device, receive a request to access a memory page identified by a guest virtual memory address (GVA) in an address space of the virtual machine, translate the GVA to a guest physical memory address (GPA) using a guest page table (GPT) comprising a GPT entry mapping the GVA to the GPA, translate the GPA to a host physical address (HPA) of the memory page, store, in a translation lookaside buffer (TLB), a TLB entry mapping the GVA to the HPA, modify the GPT entry to designate the memory page as accessed, detect an attempt by an application to modify the GPT entry; generate, in response to the attempt to modify the GPT entry, a page fault; and flush, in response to the page fault, the TLB entry.