Hardware Virtualization Module for CPU Security Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization techniques fail to securely isolate central processing units (CPUs) and host resources from attacks by flawed or malicious software code executed within virtual machines, leading to potential system failures and security threats in computing systems.
Innovation Solution
A hardware-based apparatus, such as a hardware virtualization module (HVM), provides exclusive access control to CPUs and host resources, physically isolating them from virtual machines and intercepting interrupts based on prescribed policies, ensuring that only authorized access is granted, thereby preventing attacks and ensuring secure execution of virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtual machines are executed on CPUs using software-based virtualization, then virtualization functionality is provided, but CPUs are exposed to attacks by flawed or malicious software code
Solution Approach 1:
The system segments the virtualization function into a dedicated hardware virtualization module that physically separates CPU management from the host operating system and virtual machines. This module includes dedicated CPU interfaces and interrupt controllers that are isolated from both the host OS and VMs, creating security boundaries that prevent malicious code from compromising CPU operations while maintaining virtualization capabilities.
Solution Approach 2:
A hardware virtualization module acts as an intermediary between CPUs and virtual machines, inserting itself into the execution path. This module includes dedicated interrupt controllers and CPU interface circuits that mediate all interactions, ensuring that neither malicious VMs nor the host OS can directly access or compromise CPU operations without going through the secured hardware interface.
2Ease of operation
If virtual machines are allowed to access host resources, then virtual machine operations are enabled, but system failures and security threats occur
Solution Approach 1:
The system segments resource access paths by providing dedicated hardware interfaces in the virtualization module for each host resource (storage, network, I/O). Each resource connection is physically separated and controlled through the hardware module, preventing malicious VMs from directly accessing host resources while enabling legitimate VM operations through the secured interface.
Solution Approach 2:
The hardware virtualization module serves as an intermediary layer between virtual machines and host resources. All resource access requests from VMs must pass through this module's dedicated resource interface circuits, which enforce security policies and prevent unauthorized access to host resources while maintaining operational functionality.
3Ease of operation
If the host operating system controls CPU access, then system operations are managed, but security isolation between VMs and host is compromised
Solution Approach 1:
The critical CPU control function is extracted from the host operating system and placed in a dedicated hardware virtualization module. This module contains its own CPU interface circuits and control logic that are independent of the host OS, removing the security vulnerability where the host OS could be compromised by malicious VMs and use that access to control CPUs.
Solution Approach 2:
The hardware virtualization module becomes the intermediary that controls CPU access, positioned between the host OS and CPUs. The module includes dedicated CPU interface circuits that manage all CPU interactions, ensuring that the host OS cannot directly control CPUs without going through the secured hardware interface, thus maintaining security isolation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a method comprises providing an apparatus having exclusive access to each of one or more central processing units (CPUs) of a computing system and exclusive access to host resources of the computing system; and controlling, by the apparatus, execution of a virtual machine in the computing system based on the apparatus controlling access to any one of the CPUs or any one of the host resources according to prescribed policies for the virtual machine, the prescribed policies maintained exclusively by the apparatus.