Hypervisor Page Table Isolation for Trusted Memory Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data processing systems face security vulnerabilities due to OS malware compromising memory access through page table modifications, leading to system havoc, and existing trusted execution environments require separate OS or hardware support, increasing resource constraints and performance costs.
Innovation Solution
Platform Protection Technology (PPT) employs second-level address translation using Extended Page Tables (EPTs) managed by a hypervisor, providing dynamic memory allocation and isolation without requiring a separate OS or hardware extensions, ensuring secure memory access and sharing between trusted and untrusted entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the OS has direct access to the MMU and page tables, then memory management is simplified and efficient, but the system becomes vulnerable to malware attacks that can modify page table entries
Solution Approach 1:
The patent segments the page table management into two distinct layers: guest page tables managed by the OS for virtual-to-physical address translation, and host page tables managed by the hypervisor for virtual-guest-to-physical address translation. This segmentation isolates the security-critical host page tables from OS malware while preserving OS control over guest address space management.
Solution Approach 2:
The patent introduces the hypervisor as an intermediary layer between the OS and the MMU hardware. The hypervisor manages host page tables that act as a mediator, translating guest physical addresses to host physical addresses, thereby preventing direct OS access to the actual physical memory mapping while maintaining efficient address translation through the MMU.
2Reliability
If separate trusted execution environments with dedicated OS or hardware support are implemented, then security isolation is improved, but resource constraints and performance costs increase
Solution Approach 1:
The patent merges the trusted execution environment functionality into the existing virtualization infrastructure. The hypervisor, which already runs at a higher privilege level than the OS, extends its memory management capabilities to provide security isolation for trusted applications without requiring a separate OS or additional hardware support, thereby avoiding the performance overhead of layered execution environments.
Solution Approach 2:
The hypervisor serves multiple functions: it manages virtual memory for virtual machines, provides security isolation for trusted applications through host page tables, and controls MMU operations. This multi-functionality eliminates the need for dedicated hardware support or separate OS for trusted execution, reducing resource constraints while maintaining security isolation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments described herein relate to platform security. For example, an apparatus comprises circuitry to execute instructions of a trusted execution environment, an untrusted execution environment, and a hypervisor; security circuitry to execute firmware to perform security operations, the security circuitry to provide a key to be used for encryption of data associated with the trusted execution environment; and memory management circuitry. The memory management circuitry is to: provide access by the untrusted execution environment to a first one or more page tables to translate a first guest virtual address to a first guest physical address associated with the untrusted execution environment and to provide access by the hypervisor to a second one or more page tables to translate the guest physical address to a host physical address; determine an isolated physical memory region; associate a plurality of entries of a table in the isolated physical memory region with the trusted execution environment, each entry of the plurality of entries to store information corresponding to a page table entry of a third one or more page tables associated with the trusted execution environment, the information including a corresponding guest physical address, page attributes, and permissions; and access an entry of the plurality of entries to provide security for address translations associated with the trusted execution environment.