Instruction Blocking Facility for Virtual Processor Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems lack an efficient method to block specific instructions from being executed in a virtual machine environment, leading to potential security risks and compatibility issues when emulating different processor architectures.
Innovation Solution
A computer program product that sets an instruction blocking value in a logical processor to permit or block the execution of instructions based on their function codes, causing a program exception if an unauthorized function code is detected, thereby controlling the execution of instructions within a virtual machine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If instruction blocking is implemented in a virtual machine environment, then security and compatibility are improved, but device complexity increases due to the need for additional instruction blocking logic and function code verification mechanisms
Solution Approach 1:
The patent introduces an instruction blocking facility as an intermediary layer between the virtual processor and the physical processor. This facility includes control registers (IBCR, IBMR, IBECR) that act as mediators to intercept and filter instructions before they reach the execution units. The facility verifies function codes against blocked function code lists and intercepts multi-function instructions, preventing unauthorized operations without requiring complex modifications to the core processor architecture.
Solution Approach 2:
The instruction blocking facility is segmented into distinct functional components: control register management, function code verification units, multi-function instruction interception logic, and exception generation mechanisms. Each segment handles specific aspects of instruction blocking independently, allowing the system to achieve comprehensive security through modular, manageable components rather than a monolithic complex structure.
2Reliability
If comprehensive instruction blocking is implemented to prevent unauthorized functions, then security is improved, but processing speed deteriorates due to additional verification steps for each instruction
Solution Approach 1:
The system performs preliminary action by pre-configuring blocked function code lists in control registers (IBCR, IBMR) during system initialization or security policy updates. When instructions are executed, the verification process simply compares the instruction's function code against these pre-established blocked lists rather than performing complex real-time analysis, significantly reducing the verification overhead for each instruction.
Solution Approach 2:
The instruction blocking facility includes self-service mechanisms where the control registers automatically manage the blocked function code lists and the verification logic autonomously intercepts and evaluates instructions without requiring external intervention for each verification operation. The facility generates program exceptions automatically when blocked instructions are detected, eliminating the need for additional software layers to handle each security check.
Data Source
AI summary
In a processor supporting execution of a plurality of functions of an instruction, an instruction blocking value is set for blocking one or more of the plurality of functions, such that an attempt to execute one of the blocked functions, will result in a program exception and the instruction will not execute, however the same instruction will be able to execute any of the functions that are not blocked functions.