Hypervisor Secure Enclave Memory Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing systems with virtualization technologies are vulnerable to attacks, particularly due to the lack of effective protection for secure enclaves, which can be compromised by malicious guest operating systems, leading to potential code theft and reverse engineering.
Innovation Solution
Implementing a data processing system with multi-level address translation controlled by a hypervisor, where memory pages in a secure enclave are encrypted, and hashes are generated and stored outside the guest OS, allowing the hypervisor to determine access rights and prevent unauthorized access, while encrypting and decrypting register files based on secure enclave boundaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory pages are stored in a secure enclave with encryption, then security against code theft and reverse engineering is improved, but access complexity and system overhead increase
Solution Approach 1:
The system divides memory into secure enclave pages and non-secure pages, with the hypervisor managing separate access paths for each. Secure pages are encrypted and stored in protected memory regions, while non-secure pages use standard access mechanisms. This segmentation allows security-critical operations to be isolated without affecting overall system performance.
Solution Approach 2:
The hypervisor acts as an intermediary between guest OSes and secure enclave memory pages. It intercepts memory access requests, verifies permissions, and manages encryption/decryption operations. This intermediary layer protects secure pages while maintaining controlled access for authorized operations, reducing the burden on individual guest OSes.
2Reliability
If hashes are generated and stored outside the guest OS, then protection against malicious code is improved, but system overhead and access time increase
Solution Approach 1:
Hash values for secure enclave pages are pre-computed and stored in a protected data structure accessible to the hypervisor but not to guest OSes. This preliminary preparation allows the hypervisor to quickly verify page integrity during access operations without requiring real-time hash computation, significantly reducing access time overhead.
Solution Approach 2:
The system automatically generates and maintains hash values for secure enclave pages without requiring manual intervention. The hypervisor autonomously manages the hash data structure, updating it as pages are added or modified, which eliminates the time cost of manual hash management while maintaining continuous protection.
3Reliability
If register files are encrypted and decrypted based on secure enclave boundaries, then security is improved, but processing speed decreases
Solution Approach 1:
Register file encryption and decryption are performed periodically at secure enclave boundaries rather than continuously. The hypervisor encrypts register files when exiting a secure enclave and decrypts them when entering, allowing high-speed processing within enclaves while maintaining security at boundaries. This periodic approach minimizes the impact on overall processing speed.
Data Source
AI summary
A data processing system has a processor, a system memory, and a hypervisor. The system memory stores program code and data in a plurality of memory pages. The hypervisor controls SLAT (second level address translation) read, write, and execute access rights of the plurality of memory pages. A portion of the plurality of memory pages are classified as being in a secure enclave portion of the system memory and a portion is classified as being in an unsecure memory area. The portion of the memory pages classified in the secure enclave is encrypted and a hash is generated for each of the memory pages. During an access of a memory page, the hypervisor determines if the accessed memory page is in the secure enclave or in the unsecure memory area based on the hash. In another embodiment, a method for accessing a memory page in the secure enclave is provided.