Hypervisor Privilege Enforcement via Address Space Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures, such as Supervisor Mode Access Prevention (SMAP) and Supervisor Mode Execution Prevention (SMEP), are insufficient in protecting against attacks that exploit mistakes in page tables, as they do not distinguish between code running in hypervisor mode and do not effectively prevent execution or data access at higher privilege levels.
Innovation Solution
The solution involves dividing the addressable memory space into chunks with specific policy settings that dictate execution and access capabilities, using enforcement logic in hardware and/or software to ensure that code executes or data is accessed only at permitted privilege levels, preventing unauthorized access or execution by separating the address space into chunks with associated policy settings and enforcing these policies through a hypervisor or hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Supervisor Mode Access Prevention (SMAP) and Supervisor Mode Execution Prevention (SMEP) are used to control data and execution access, then user mode versus supervisor mode access is protected, but protection against attacks exploiting page table mistakes is insufficient and hypervisor mode distinctions are not made
Solution Approach 1:
The address space is divided into multiple segments or regions, each with distinct access and execution policies. The enforcement logic evaluates the privilege level of the requesting code and compares it against the policy settings for the specific address space segment, allowing fine-grained control over what code can execute or access data at different privilege levels including hypervisor mode
Solution Approach 2:
Different policy settings are applied to different segments of the address space. Each segment can have customized execution and access policies tailored to its specific security requirements, allowing the system to enforce appropriate privilege levels for different regions while maintaining overall system security
2Reliability
If address space is divided into chunks with policy settings to enforce privilege level restrictions, then unauthorized code execution and data access are prevented, but system complexity increases due to enforcement logic and policy management
Solution Approach 1:
The enforcement logic automatically evaluates privilege levels and enforces policy settings without requiring manual intervention. The system self-regulates access control by comparing the requesting code's privilege level against the chunk's policy settings, reducing the need for complex external management mechanisms
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The subject disclosure is directed towards using hardware, a hypervisor, and/or privileged mode code to prevent system mode code from accessing user mode data and/or running user mode code at the system privilege level, or vice-versa. Also described is preventing non-hypervisor code from running in hypervisor mode or accessing hypervisor-only data, or vice-versa. A register maintained by hardware, hypervisor, or system mode code contains data access and execution polices for different chunks of addressable space with respect to which requesting entities (hypervisor mode code, system mode code, user mode code) have access to or can execute code in a given chunk. When receiving a request to execute code or access data with respect to an address, the request is processed to determine to which chunk the address corresponds. The policy for that chunk is evaluated to determine whether to allow or deny the request.