Blind Hypervisor Page Ownership Table for VM Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face challenges in protecting guest execution environments from unauthorized access by higher privilege processes, particularly in cloud platforms where data secrecy is critical and side-channel attacks can expose usage patterns.
Innovation Solution
The introduction of a 'blind hypervisor' that manages virtual machines without seeing all data associated with them, combined with a page ownership table system that allows each process to exclusively control access to physical memory pages, including preventing higher privilege processes from accessing owned pages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a hypervisor manages virtual machines with full access to their data, then system control and scheduling are improved, but data security and protection from unauthorized access deteriorate
Solution Approach 1:
The patent segments memory access control by introducing a page ownership table that divides physical memory into exclusively owned pages. Each process (including guest VMs) can claim exclusive ownership of specific pages, creating granular access control segments that prevent the hypervisor and other processes from accessing owned pages, thus resolving the contradiction between centralized control and data security.
Solution Approach 2:
The patent applies local quality by allowing different security properties for different memory pages. Owned pages have exclusive access permissions for their owning process, while non-owned pages maintain traditional hypervisor accessibility. This localized security attribute assignment enables the hypervisor to control non-owned pages while owned pages enjoy enhanced protection, balancing system control with data security.
2Device complexity
If traditional memory access control is used, then system simplicity is maintained, but vulnerability to side-channel attacks increases
Solution Approach 1:
The patent implements preliminary action by requiring processes to claim ownership of memory pages before accessing them. The page ownership table is pre-established and updated whenever ownership changes. This preliminary ownership declaration creates a security barrier that prevents side-channel attacks by ensuring that only the owning process can access its designated pages, blocking potential attack vectors before they can exploit memory access patterns.
3Reliability
If exclusive page ownership is implemented, then data isolation and security are improved, but system complexity and overhead increase
Solution Approach 1:
The patent applies self-service by enabling processes to autonomously claim ownership of memory pages they need without requiring hypervisor intervention for each allocation. The page ownership table automatically tracks and enforces ownership permissions, allowing the system to manage complex security relationships through automated rules rather than manual configuration, thus reducing operational complexity while maintaining strong data isolation.
Data Source
Figure 1
Figure 2
Figure 2
AI summary
A data processing system for processing data comprising: ownership circuitry to enforce ownership rights of memory regions, a given memory region having a given owning process specified from among a plurality of processes, said given owning process having exclusive rights to control access to said given memory region; and context switching circuitry responsive to receipt of an interrupt to trigger a context switch from a first active process to a second active process whereby one or more items of state for use in restarting said first process is saved to one or more context data memory regions owned by said first process and one or more items of state accessible to said second process and dependent upon processing by said first process is overwritten prior to commencing execution of said second process.