Memory Aliasing for Secure Virtual Machine Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing applications, especially virtual computing, memory sharing between virtual machines is hindered by security issues, making it challenging to efficiently utilize shared hardware resources and increase VM density due to concerns about sensitive information leakage across isolation boundaries.
Innovation Solution
Implementing safe sharing of memory pages using aliased physical memory, where deduplicated virtual memory pages are marked as shared and allocated unique physical memory address ranges, ensuring read-only access to prevent information leakage, and utilizing an aliasing memory controller to translate aliased addresses for secure caching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If memory sharing between virtual machines is implemented, then memory efficiency and VM density are improved, but security risks and information leakage between isolated boundaries increase
Solution Approach 1:
The patent segments memory access permissions by creating separate permission sets for different virtual machines accessing the same physical memory page. Each VM is assigned specific read/write permissions for particular pages, allowing selective sharing while maintaining isolation. This resolves the contradiction by enabling memory efficiency through sharing while preventing security risks through granular permission control.
Solution Approach 2:
The patent introduces a memory management intermediary layer that mediates access between virtual machines and shared physical memory. This intermediary enforces permission policies, translates virtual addresses, and controls which VMs can access which memory pages. The intermediary acts as a security gatekeeper that enables memory sharing while preventing unauthorized access and information leakage.
2Quantity of substance
If physical memory is shared between virtual machines, then overall memory consumption is reduced, but the complexity of managing memory isolation and access control increases
Solution Approach 1:
The patent merges multiple virtual memory pages from different virtual machines into shared physical memory pages when their contents are identical or can be made identical. This consolidation reduces overall memory consumption while the system automatically manages the complexity of tracking which VMs share which pages through data structure optimizations.
Solution Approach 2:
The patent changes the parameter of memory address representation by introducing aliasing, where multiple virtual addresses from different VMs map to the same physical memory location. This parameter change simplifies management by allowing the system to track shared pages through alias relationships rather than complex permission matrices, reducing management complexity while enabling memory sharing.
Data Source
AI summary
A computer system and methods are disclosed for mitigating side-channel attacks using memory aliasing. The computer system includes a memory, a memory controller and a cache. Responsive to determining to share a memory location among processes, the address of the memory may be aliased to another address within the same address space, with the address and aliased address assigned to respective ones of the processes. The memory controller manages the address space according to an aliasing region and a non-aliasing region, with addresses corresponding to the non-aliasing region being passed through to the memory. Addresses corresponding to the aliasing region are translated by the memory controller to match corresponding non-aliased memory addresses allowing aliased and non-aliased addresses to access same memory locations. A cache may cache accesses to memory addresses, including the non-aliased and aliased addresses, with different cache locations for selected according to the respective addresses of memory.