Guest Process Same-Page Merging Prevention via Nonce Insertion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualized computing environments face challenges in preventing timing side-channel attacks, where malicious applications exploit shared memory pages to monitor target processes by flushing cache lines and measuring access times, and existing solutions like disabling page de-duplication are impractical or costly.
Innovation Solution
Implementing performance monitors to detect cache line flush instructions and modify program instructions or page mappings to make memory accesses predictable, or inserting NONCE values into critical pages to prevent same-page merging, allowing the system to mitigate or curtail timing side-channel attacks without relying on hypervisor controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If page de-duplication is disabled to prevent timing side-channel attacks, then security is improved, but memory resource efficiency deteriorates and application startup time increases
Solution Approach 1:
The patent applies local quality by making only critical memory pages unique through NONCE insertion while allowing non-critical pages to be de-duplicated. This selective approach protects against timing attacks on sensitive pages while maintaining memory efficiency for other pages, thus resolving the contradiction between security and resource efficiency.
Solution Approach 2:
The patent changes the parameter of memory page content by inserting NONCE values into critical pages, transforming them from identical copies to unique pages. This parameter change prevents same-page merging for critical pages while allowing it for non-critical pages, balancing security requirements with resource efficiency.
2Reliability
If page de-duplication is disabled to prevent timing side-channel attacks, then security is improved, but application startup time increases
Solution Approach 1:
The patent applies local quality by making only critical memory pages unique through NONCE insertion while allowing non-critical pages to be de-duplicated. This selective approach protects against timing attacks on sensitive pages while maintaining memory efficiency for other pages, thus resolving the contradiction between security and resource efficiency.
Solution Approach 2:
The patent changes the parameter of memory page content by inserting NONCE values into critical pages, transforming them from identical copies to unique pages. This parameter change prevents same-page merging for critical pages while allowing it for non-critical pages, balancing security requirements with resource efficiency.
3Reliability
If hypervisor controls are used to disable page de-duplication, then security is improved, but system complexity and control requirements increase
Solution Approach 1:
The patent applies self-service by enabling guest processes to autonomously protect their own critical memory pages through NONCE insertion without requiring hypervisor intervention or system-wide configuration changes. This reduces system complexity while maintaining security, as each process independently manages its own security requirements.
Solution Approach 2:
The patent changes the parameter of memory page content by inserting NONCE values into critical pages, transforming them from identical copies to unique pages. This parameter change prevents same-page merging for critical pages while allowing it for non-critical pages, balancing security requirements with resource efficiency.
Data Source
AI summary
In a virtualization environment, a guest process may protect itself from potential timing side-channel attacks by other guest processes on the same host machine by taking steps to avoid same-page merging for memory pages that it accesses. Pages that include critical code (e.g., cryptographic functions) or sensitive data (e.g., cryptography keys) may be designated as important pages to protect from such attacks. A placeholder location of a specified size for storing a non-deterministic value (e.g., a random or pseudorandom number) may be inserted into these pages when instantiated, making them unlikely to match pages accessed by other guests. Therefore, the host machine may be unlikely to identify them as pages for which there is a same-page merging opportunity. The values in the placeholder locations may be updated periodically or in response to certain events (e.g., context switches between guests or the detection of same-page merging).