Hypervisor Privacy Integrity via Host OS Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Type 2 hypervisors are vulnerable to malicious code infections within the host operating system, which can compromise the hypervisor and guest virtual machines due to shared privilege levels, necessitating measures to ensure privacy and integrity.
Innovation Solution
The hypervisor is made the most privileged component by preventing the host operating system from accessing its resources, using mechanisms like virtual machine containers and cryptographic checksums to enforce access controls and ensure data integrity, while allowing temporary access for necessary operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a Type 2 hypervisor executes within a host operating system, then the hypervisor can utilize host OS resources and management capabilities, but the hypervisor becomes vulnerable to malicious code infections within the host OS due to shared privilege levels
Solution Approach 1:
The system segments the hypervisor into two execution contexts: a privileged mode where the hypervisor runs with elevated permissions outside the host OS, and a unprivileged mode where it operates within the host OS environment. This segmentation allows the hypervisor to access necessary host resources while isolating it from malicious code infections, as the critical management functions run in the privileged context where they cannot be compromised by host OS processes
Solution Approach 2:
The patent implements a nested execution model where the hypervisor can execute both inside and outside the host operating system. The unprivileged hypervisor instance runs within the host OS (like a doll inside another doll), while a privileged hypervisor instance runs outside. The nested structure allows the inner unprivileged instance to access resources through the outer privileged instance, which acts as a protective layer against host OS malicious code
2Reliability
If the hypervisor is made the most privileged component by preventing host OS access, then privacy and integrity are protected, but access control complexity increases
Solution Approach 1:
The patent introduces a page table as an intermediary mechanism between the host OS and the hypervisor. The page table contains access control information that determines which host OS processes can access hypervisor memory regions. This intermediary structure provides automated access control based on page table entries, reducing the complexity of manual access control while ensuring hypervisor integrity. The page table acts as a gatekeeper that automatically enforces security policies without requiring complex software-based access control logic
Data Source
AI summary
Approaches for ensuring the privacy and integrity of a hypervisor. A host operating system manages a set of resources. The host operating system is prevented from accessing a portion of the resources belonging to or allocated by the hypervisor. The host operating system may be prevented from accessing resources belonging to or allocated by the hypervisor by transferring execution of the host operating system into a virtual machine container that does not have sufficient privilege to access any portion of the memory pages in which the hypervisor is executing. After the host operating system provides a requested resource to the hypervisor, the hypervisor may use a hardware component that establishes and enforces constraints on what portions of memory the host operating system is allowed to access to protect the requested resource from the host operating system.