Hypervisor Range-Based Pointer Validation for VM Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machine management systems face inefficiencies in validating pointers to prevent data access from privileged memory, which can lead to resource overhead and security risks due to the need for page walks.
Innovation Solution
A multilevel guest page table is used, where the page upper directory maps a contiguous set of entries to privileged pages, allowing for a simple range-based validation of pointers to determine if they reference privileged or guest memory, thereby aborting or allowing virtual machine functions accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional pointer validation methods are used, then security can be maintained, but computing resource consumption increases and validation efficiency decreases
Solution Approach 1:
The patent pre-organizes the page table structure during virtual machine initialization, creating a multilevel page table where privileged pages are mapped to contiguous entries in the upper directory. This preliminary structuring enables efficient range-based validation during runtime without requiring complex page walks, thus maintaining security while reducing computing resource consumption during pointer validation operations
Solution Approach 2:
The patent changes the validation approach from checking individual page table entries to checking whether a pointer falls within a predetermined contiguous range in the upper directory. This parameter change from granular entry-by-entry validation to range-based validation significantly reduces the computational resources required while maintaining the same security level
2Reliability
If traditional pointer validation methods are used, then security can be maintained, but validation speed decreases
Solution Approach 1:
The patent pre-organizes the page table structure during virtual machine initialization, creating a multilevel page table where privileged pages are mapped to contiguous entries in the upper directory. This preliminary structuring enables efficient range-based validation during runtime without requiring complex page walks, thus maintaining security while reducing computing resource consumption during pointer validation operations
Solution Approach 2:
The patent changes the validation approach from checking individual page table entries to checking whether a pointer falls within a predetermined contiguous range in the upper directory. This parameter change from granular entry-by-entry validation to range-based validation significantly reduces the computational resources required while maintaining the same security level
3Productivity
If multilevel page table with contiguous entry mapping is used, then validation efficiency improves, but page table complexity increases
Solution Approach 1:
The patent segments the page table into a multilevel structure with an upper directory and lower directories, where the upper directory contains contiguous entries specifically for privileged pages. This segmentation allows efficient range-based validation by checking only the upper directory level, improving validation efficiency while organizing complexity in a manageable hierarchical structure
Solution Approach 2:
The patent applies local quality by making only the upper directory entries for privileged pages contiguous and specially organized, while other parts of the page table maintain their traditional structure. This localized optimization improves validation efficiency for privileged page access without requiring complete restructuring of the entire page table system
4Productivity
If multilevel page table with contiguous entry mapping is used, then validation efficiency improves, but context switching overhead increases
Solution Approach 1:
The patent pre-organizes the page table structure during virtual machine initialization, creating a multilevel page table where privileged pages are mapped to contiguous entries in the upper directory. This preliminary structuring enables efficient range-based validation during runtime without requiring complex page walks, thus maintaining security while reducing computing resource consumption during pointer validation operations
Solution Approach 2:
The patent changes the validation approach from checking individual page table entries to checking whether a pointer falls within a predetermined contiguous range in the upper directory. This parameter change from granular entry-by-entry validation to range-based validation significantly reduces the computational resources required while maintaining the same security level
Data Source
AI summary
A method performed by a physical computing system includes, with a hypervisor, determining that a multilevel guest page table includes an upper directory that maps a set of contiguous entries to privileged pages, with the hypervisor, determining that, within the multilevel page table, only the set of contiguous entries map to the privileged pages, with the hypervisor, receiving a request from the guest to execute a virtual machine function, receiving a pointer as a parameter for the virtual machine function, and in response to determining that the pointer references a memory address that is within a range associated with the set of contiguous entries, aborting the virtual machine function.