Hypervisor Segmentation for Secure Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face security vulnerabilities due to the increased complexity of hypervisor code when it controls both scheduling and secure functions, which can lead to security weaknesses.
Innovation Solution
Implementing a data processing apparatus with multiple privilege modes, where hypervisor code operates in the highest privilege mode for secure functions and scheduling code executes in a lower privilege mode, allowing for reduced complexity and enhanced security by delegating secure functions to other code and using memory protection circuitry to manage access rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the hypervisor code controls both scheduling and secure functions, then the system can be managed with a single privilege mode, but the hypervisor code complexity increases leading to security weaknesses
Solution Approach 1:
The patent segments the hypervisor functionality by separating scheduling code from secure function code. The scheduling code executes in a first privilege mode and controls scheduling of both application code and hypervisor code, while secure functions execute in a second privilege mode. This segmentation reduces the complexity of the hypervisor code by removing scheduling responsibilities, thereby improving security.
Solution Approach 2:
The scheduling code acts as an intermediary between the application code and the secure function code. It receives scheduling requests, determines which code should execute next, and manages the transition between different code segments. This intermediary role allows the hypervisor code to focus solely on secure functions without the burden of scheduling complexity.
2Adaptability or versatility
If the hypervisor code operates in the highest privilege mode for all functions, then it has full access to system resources, but this increases the attack surface and security risks
Solution Approach 1:
The patent applies local quality by assigning different privilege modes to different code segments based on their specific needs. The scheduling code operates in a first privilege mode with sufficient rights to manage scheduling, while secure functions operate in a second privilege mode with restricted access rights. This ensures that code only has the minimum necessary privileges to perform its function, reducing the attack surface.
Solution Approach 2:
The system dynamically changes the privilege mode parameter based on which code is executing. When scheduling code runs, the system is in the first privilege mode; when secure functions execute, the system transitions to the second privilege mode. This parameter change ensures that full system access is only available when absolutely necessary, thereby maintaining security.
3Ease of operation
If scheduling code executes in the highest privilege mode, then it can directly control all code execution, but this concentrates security risks in a single code base
Solution Approach 1:
The patent segments the control functionality by creating a separate scheduling code that operates independently from the hypervisor code. The scheduling code executes in the first privilege mode and handles all scheduling decisions, while the hypervisor code executes in the second privilege mode and handles secure functions. This segmentation distributes security risks across multiple code bases with different privilege levels.
Solution Approach 2:
The patent extracts the scheduling functionality from the hypervisor code and places it in a separate scheduling code module. This extraction removes the scheduling complexity from the hypervisor code, allowing the hypervisor to focus solely on secure functions. The scheduling code, operating in the first privilege mode, maintains full scheduling control while being a separate, auditable code base.
Data Source
AI summary
A data processing system operates in a plurality of modes including a first privilege mode and a second privilege mode with the first privilege mode giving rights of access that are not available in the second privilege mode. Application code executes in the second privilege mode and generates function calls to hypervisor code which executes in the first privilege mode. These function calls are to perform a secure function requiring the rights of access which are only available in the first privilege mode. Scheduling code which executes in the second privilege mode controls scheduling of both the application code and the hypervisor code. Memory protection circuitry operating with physical addresses serves to control access permissions required to access different regions within the memory address space using configuration data which is written by the hypervisor code. The hypervisor code temporarily grants access to different regions within the physical memory address space to the system in the second privilege mode as needed to support the execution of code scheduled by the scheduling code.