Memory Isolation Domains Using SLAT for Secure Virtualized Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization technologies face challenges in providing effective memory isolation without significant overhead, particularly in container solutions where kernel vulnerabilities can compromise isolation, and existing methods do not adequately prevent unauthorized access to protected memory.
Innovation Solution
Implementing memory isolation domains with second-level address translation tables (SLAT) that restrict access permissions, allowing the host to manage and enforce memory access permissions across multiple domains, preventing unauthorized access by tracking or being informed of guest-physical address ranges and transitions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full VM isolation is used, then memory isolation security is improved, but system overhead increases
Solution Approach 1:
The patent segments memory isolation into two levels: full VM isolation for strong security boundaries, and container-level isolation using namespaces for lighter-weight separation within the same kernel. This segmentation allows the system to apply strong isolation where needed while reducing overhead in scenarios with lower security requirements.
Solution Approach 2:
The patent applies different isolation qualities to different memory regions and processes. Critical system components and sensitive data receive full VM-level isolation, while less sensitive workloads can operate with container-level isolation. This local differentiation optimizes the balance between security and overhead by not applying maximum isolation uniformly across all resources.
2Productivity
If container solution is used, then resource isolation efficiency is improved, but security reliability deteriorates due to shared kernel
Solution Approach 1:
The patent introduces kernel modules and security agents as intermediaries between containers and the shared kernel. These intermediaries enforce strict access controls, monitor for security violations, and can isolate compromised containers without affecting the entire system. This intermediary layer preserves the efficiency of container sharing while mitigating the security risks of kernel sharing.
Solution Approach 2:
The patent implements feedback mechanisms through security agents that continuously monitor container behavior, access patterns, and system state. When anomalies or security violations are detected, the system responds by tightening isolation, blocking access, or isolating the problematic container. This feedback loop maintains security reliability while allowing efficient resource sharing under normal conditions.
3Ease of manufacture
If kernel provides isolation, then implementation simplicity is improved, but security against kernel vulnerabilities deteriorates
Solution Approach 1:
The patent segments the isolation mechanism into kernel-provided namespaces for simple resource separation and user-space security agents for enforcing security policies. This segmentation allows the kernel to provide basic isolation infrastructure simply, while security-critical functions are handled by user-space components that can be updated and hardened independently, reducing the attack surface of the kernel itself.
Solution Approach 2:
The patent introduces user-space security agents as intermediaries between applications and the kernel namespace infrastructure. These agents enforce security policies, validate access requests, and can revoke permissions without kernel modifications. This intermediary approach maintains implementation simplicity by using existing kernel facilities while improving security against kernel vulnerabilities by moving security-critical logic to user space.
Data Source
AI summary
Physical memory isolation in a virtualized system is described. A notification is received from a guest in the virtualized system that an address space isolation component has been created in the guest. At the host of the virtualized system, a memory isolation domain that is bound with the address space isolation component is created. The memory isolation domain includes a set of second level address translation tables dedicated for that memory isolation domain. Guest-physical address (GPA) range(s) are received from the guest that are mapped into memory of the guest, and memory access permissions for the GPA range(s) are received and are being mapped for a process into the created memory isolation domain. The host determines whether the mapping for the process into the created memory isolation domain is permitted. If not permitted, the mapping is blocked thereby preventing access. If permitted, the mapping is granted thereby allowing access.