Software-Filtered NVMe Memory Access for Secure VM Admin Commands
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for assigning non-volatile memory devices to virtual machines allow full access, which can lead to harmful operations such as re-programming firmware, impacting data security, and incur high I/O overhead and latency, especially when using solutions like SCSI drives or custom ASICs.
Innovation Solution
Implement a software filtered NVMe interface that intercepts and filters admin commands from virtual machines, using host admin queues to protect non-volatile memory from harmful operations while allowing high performance access, and switches between filtered and unfiltered modes based on command activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If full access to non-volatile memory is allowed via NVMe interface, then data access performance is improved, but security risks increase due to harmful operations such as firmware re-programming
Solution Approach 1:
A software filter layer is introduced between the virtual machine and the non-volatile memory device. This intermediary monitors and filters admin commands, allowing legitimate data access operations while blocking harmful operations such as firmware re-programming. The filter enables high-performance NVMe access while preventing security threats by selectively intercepting malicious commands before they reach the memory device.
2Reliability
If SCSI interface is used to attach non-volatile memory, then security is improved by preventing direct access, but I/O overhead and latency increase
Solution Approach 1:
The system applies different access modes to different operational contexts. In unfiltered mode, full NVMe performance is enabled for normal data access operations. In filtered mode, command monitoring is activated to block harmful operations. This local differentiation allows the system to achieve both high performance for legitimate operations and security for protected operations, avoiding the universal performance penalty of SCSI interfaces.
3Object-affected harmful factors
If custom ASIC or firmware is installed on non-volatile memory device, then harmful operations are prevented, but device complexity and maintenance difficulty increase
Solution Approach 1:
Instead of modifying the memory device itself with custom ASICs or firmware, a software filter running on the host system serves as an intermediary. This approach prevents harmful operations through software-based command filtering rather than hardware modifications, significantly reducing device complexity and making the system easier to maintain and update without requiring custom hardware components.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Techniques of implementing software filtered non-volatile memory in a computing device are disclosed herein. In one embodiment, a method includes detecting an entry being written to a guest admin submission queue (gASQ) by a memory driver of a virtual machine hosted on the computing device. Upon detecting the entry written to the gASQ by the memory driver, the command in the entry is analyzed to determine whether the command is allowed based on a list of allowed or disallowed commands. In response to determining that the command in the entry is not allowed, without sending the command to the non-volatile memory, generating an execution result of the command in response to the entry being written to the gASQ by the memory driver. As such, potentially harmful commands from the memory driver are prevented from being executed by the non-volatile memory.