Hypervisor Memory Isolation Using Dual EPT Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data processing systems face security vulnerabilities due to malware infecting the operating system, allowing unauthorized access and modification of memory mappings, leading to potential system compromise and data breaches.
Innovation Solution
Platform Protection Technology (PPT) employs a hypervisor-based solution using extended page table (EPT) technology for second-level address translation, providing trusted execution environments (TEEs) that isolate trusted applications from untrusted environments, enabling dynamic memory allocation, sharing, and cleanup without requiring separate OS or hardware extensions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the OS has direct access to the MMU and can modify page tables, then memory management flexibility is improved, but system security deteriorates as malware can compromise memory mappings
Solution Approach 1:
The patent segments memory management into two distinct layers: the guest OS manages its own virtual-to-physical address translations using guest page tables, while the hypervisor manages the mapping from guest physical addresses to host physical addresses using EPT structures. This segmentation allows the guest OS to maintain flexibility in its own address space management while the hypervisor ensures security by controlling the final physical memory access mappings, preventing malware from compromising host memory.
Solution Approach 2:
The patent introduces EPT (Extended Page Tables) as an intermediary layer between the guest OS memory management and the host physical memory. The EPT structures act as a mediator that translates guest physical addresses to host physical addresses, allowing the guest OS to operate with full memory management capabilities while the hypervisor maintains security control through the intermediate EPT mapping layer, preventing direct unauthorized access to host memory.
2Reliability
If a hypervisor-based solution with EPT is implemented for memory isolation, then system security is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service mechanisms where the hardware automatically performs nested address translation through EPT without requiring complex software intervention. The CPU's memory management unit automatically handles the two-level translation process (guest virtual to guest physical, then guest physical to host physical) through hardware-supported EPT structures, reducing the complexity of software-based security mechanisms while maintaining strong isolation guarantees.
Solution Approach 2:
The patent replaces complex software-based memory isolation mechanisms with hardware-supported EPT structures. The memory management unit in the CPU provides native support for nested page table translation, substituting what would otherwise require complex software implementation with dedicated hardware functionality, thereby reducing overall system complexity while enhancing security.
3Reliability
If nested address translation with EPT is used for isolation, then memory isolation effectiveness is improved, but performance overhead increases
Solution Approach 1:
The patent implements preliminary action by pre-establishing EPT mapping structures during guest OS initialization and page table updates. The hypervisor proactively configures EPT entries to reflect the guest's memory mappings before they are needed for execution, ensuring that the nested translation path is already optimized and cached in hardware structures, thereby minimizing performance overhead during actual memory access operations.
Solution Approach 2:
The patent utilizes parameter changes in the form of EPT configuration parameters that can be dynamically adjusted to optimize performance. The hypervisor can modify EPT mapping parameters, such as page size and access permissions, to balance isolation effectiveness with performance requirements, allowing large page mappings for frequently accessed memory regions to reduce translation overhead while maintaining security for sensitive areas.
Data Source
AI summary
A data processing system (DPS) uses platform protection technology (PPT) to protect some or all of the code and data belonging to certain software modules. The PPT may include a virtual machine monitor (VMM) to enable an untrusted application and a trusted application to run on top of a single operating system (OS), while preventing the untrusted application from accessing memory used by the trusted application. The VMM may use a first extended page table (EPT) to translate a guest physical address (GPA) into a first host physical address (HPA) for the untrusted application. The VMM may use a second EPT to translate the GPA into a second HPA for the trusted application. The first and second EPTs may map the same GPA to different HPAs. Other embodiments are described and claimed.