Blind Hypervisor Page Ownership Table for VM Isolation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing data processing systems face challenges in protecting guest execution environments from unauthorized access by higher privilege processes, particularly in cloud platforms where data secrecy is critical and side-channel attacks can expose usage patterns.

Innovation Solution

The introduction of a 'blind hypervisor' that manages virtual machines without seeing all data associated with them, combined with a page ownership table system that allows each process to exclusively control access to physical memory pages, including preventing higher privilege processes from accessing owned pages.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a hypervisor manages virtual machines with full access to their data, then system control and scheduling are improved, but data security and protection from unauthorized access deteriorate

Engineering Contradiction:
Improvesystem controlVSAvoiddata security
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent segments memory access control by introducing a page ownership table that divides physical memory into exclusively owned pages. Each process (including guest VMs) can claim exclusive ownership of specific pages, creating granular access control segments that prevent the hypervisor and other processes from accessing owned pages, thus resolving the contradiction between centralized control and data security.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by allowing different security properties for different memory pages. Owned pages have exclusive access permissions for their owning process, while non-owned pages maintain traditional hypervisor accessibility. This localized security attribute assignment enables the hypervisor to control non-owned pages while owned pages enjoy enhanced protection, balancing system control with data security.

Inventive Principle:
Principle #3Local quality

2Device complexity

If traditional memory access control is used, then system simplicity is maintained, but vulnerability to side-channel attacks increases

Engineering Contradiction:
Improvesystem simplicityVSAvoidside-channel attacks
Core Design Contradiction:
Device complexityVSObject-affected harmful factors

Solution Approach 1:

The patent implements preliminary action by requiring processes to claim ownership of memory pages before accessing them. The page ownership table is pre-established and updated whenever ownership changes. This preliminary ownership declaration creates a security barrier that prevents side-channel attacks by ensuring that only the owning process can access its designated pages, blocking potential attack vectors before they can exploit memory access patterns.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If exclusive page ownership is implemented, then data isolation and security are improved, but system complexity and overhead increase

Engineering Contradiction:
Improvedata isolationVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies self-service by enabling processes to autonomously claim ownership of memory pages they need without requiring hypervisor intervention for each allocation. The page ownership table automatically tracks and enforces ownership permissions, allowing the system to manage complex security relationships through automated rules rather than manual configuration, thus reducing operational complexity while maintaining strong data isolation.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3311271B1Protected exception handling
Publication Date: 2023.02.22 ARM LTD
  • EP3311271B1 patent drawingFigure 1
  • EP3311271B1 patent drawingFigure 2
  • EP3311271B1 patent drawingFigure 2

AI summary

A data processing system for processing data comprising: ownership circuitry to enforce ownership rights of memory regions, a given memory region having a given owning process specified from among a plurality of processes, said given owning process having exclusive rights to control access to said given memory region; and context switching circuitry responsive to receipt of an interrupt to trigger a context switch from a first active process to a second active process whereby one or more items of state for use in restarting said first process is saved to one or more context data memory regions owned by said first process and one or more items of state accessible to said second process and dependent upon processing by said first process is overwritten prior to commencing execution of said second process.