Guest Physical Address Mapping in Secure Extended Page Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual machine (VM) implementations lack effective solutions to enhance the self-protection of VM memory space, particularly against page remapping attacks, and conventional systems fail to isolate customer workloads from the Trusted Computing Base (TCB) of cloud service providers, increasing the TCB significantly.
Innovation Solution
The introduction of Trust Domain Extensions (TDX) with Secure Extended Page Tables (SEPT) and a Trust Domain Resource Manager (TDRM) to manage memory encryption and integrity, ensuring that guest physical address mappings are secure and isolated from hypervisor interference, using a processor architecture that supports memory encryption via MK-TME and CPU-managed Memory Ownership Table (MOT) to enforce cryptographic isolation between tenant workloads and CSP software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional extended page tables (EPT) are used for memory management, then virtual machine memory can be accessed, but the system becomes vulnerable to page remapping attacks and loses memory confidentiality
Solution Approach 1:
The patent segments the extended page table into two distinct structures: a conventional EPT for address translation and a new Page Attribute Table (PAT) for storing memory attributes. This segmentation allows the system to maintain both address translation functionality and secure attribute management, preventing page remapping attacks while preserving memory access capabilities.
Solution Approach 2:
The patent introduces a new memory attribute storage structure (PAT) that acts as an intermediary between the EPT and the memory management unit. This intermediary stores protected memory attributes that cannot be modified by the VMM, thereby preventing malicious page remapping while still allowing legitimate memory management operations through the EPT.
2Ease of operation
If the VMM is given full control over extended page tables, then memory management is flexible, but the VMM can perform malicious page remapping attacks
Solution Approach 1:
The patent applies local quality by differentiating the accessibility and modifiability of different memory attributes. The PAT structure allows certain attributes to be read by the VMM for legitimate management operations, while critical security attributes are marked as non-writable and non-modifiable, thereby preventing malicious remapping while preserving operational flexibility.
Solution Approach 2:
The patent implements preliminary anti-action by pre-establishing the PAT structure with protected attributes before the VMM can perform any page remapping operations. The protected attributes are set with restricted access permissions in advance, preventing the VMM from performing malicious page remapping attacks while still allowing legitimate memory management.
3Adaptability or versatility
If memory attributes are made modifiable for flexibility, then memory management becomes adaptable, but security protection against unauthorized changes is weakened
Solution Approach 1:
The patent applies local quality by differentiating the accessibility and modifiability of different memory attributes. The PAT structure allows certain attributes to be read by the VMM for legitimate management operations, while critical security attributes are marked as non-writable and non-modifiable, thereby preventing malicious page remapping while preserving operational flexibility.
Data Source
AI summary
Methods and apparatus to set guest physical address mapping attributes for a trusted domain In one embodiment, the method includes executing a first one or more of instructions to establish a trusted domain and executing a second one or more of the instructions to add a first memory page to the trusted domain, where the first memory page is private to the trusted domain and a first set of page attributes is set for the first memory page based on the second one or more of the instructions, where the first set of page attributes indicates how the first memory page is mapped in a secure extended page table. The method further includes storing the first set of page attributes for the first memory page in the secure extended page table at a storage location responsive to executing the second one or more of the instructions.