Multiple Kernel Page Tables for Application-Level Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing kernel data isolation methods in operating systems are inefficient and lack application-grained protection, requiring hardware modifications or affecting data globally, and do not effectively prevent attacks like privilege escalation and Spectre-V2.
Innovation Solution
Implementing multiple kernel page tables, where each application is bound to a specific page table, ensuring data isolation and compatibility by using a page table management module and private memory allocator to manage memory allocation and access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a unified kernel address space is used, then kernel code and data access is simplified and synchronized, but data isolation between applications is lost and security vulnerabilities are exposed
Solution Approach 1:
The patent divides the unified kernel address space into multiple isolated address spaces, one for each application. Each application gets its own page tables and memory view, separating kernel code and data access from other applications while maintaining simplified access within each application's context.
Solution Approach 2:
The patent introduces a mediator mechanism that translates between different application address spaces and the unified physical memory. The mediator handles page table switching and memory access translation, allowing each application to access kernel data independently without direct conflicts.
2Reliability
If hardware-based isolation (EPT, TEE) is used, then data isolation between applications is achieved, but performance cost increases and hardware dependencies are introduced
Solution Approach 1:
The patent replaces hardware-based isolation mechanisms (EPT, TEE) with a software-based page table isolation system. The isolation is achieved through software-managed page tables and memory views rather than hardware virtualization extensions, eliminating hardware dependencies while maintaining data isolation.
Solution Approach 2:
The patent creates separate page table structures for each application, copying and isolating memory views at the software level. This copying approach achieves isolation without requiring hardware support, as the isolation is implemented through software-managed memory mappings.
3Adaptability or versatility
If software-based isolation (CGroup, Name Space) is used, then access control is provided, but data isolation at application granularity is not achieved
Solution Approach 1:
The patent segments the kernel address space at the application level by creating separate page tables for each application. This segmentation achieves true data isolation at application granularity, where each application can only access its own allocated memory and cannot see or access data from other applications.
Solution Approach 2:
The patent adds a new dimension to memory management by introducing application-specific page tables as a separate layer. Instead of isolating at the system level (CGroup) or file level (Name Space), the isolation is implemented at the memory view level, creating a hierarchical structure that provides fine-grained data isolation.
Data Source
AI summary
A method and system for kernel data isolation based on multiple kernel page tables is provided. Through creating multiple kernel page tables in a kernel system and binding specific applications to a corresponding page table for operation, each internal process of the application remains consistent with the corresponding page table in terms of kernel address space, and the kernel address spaces of different applications are isolated from each other due to existence of the different page tables. The system includes a page table management module and a private memory management module. The present disclosure protects private application data at the granularity of applications in the same kernel at very low costs to prevent data breach caused by read attacks on kernel address space or privilege escalation attacks, maintains privilege level division of kernel address spaces, and ensures transparency of private memories among applications and general IO capability of private memories.