Peer-to-Peer Bus Access Control Logic for Virtual Machine Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems with multiple virtual machines, peer-to-peer communications between peripheral devices can break the desired partitioning between virtual machines, leading to unforeseen consequences, and existing solutions like ACS P2P Request Redirect increase transaction latency.
Innovation Solution
Implementing access control logic in peripheral devices or a switch on the bus to forward peer-to-peer communications while inhibiting access between functional entities assigned to different virtual machines, using entity identifiers and access permission tables to manage access levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ACS P2P Request Redirect is used to validate peer-to-peer requests, then access control between virtual machines is improved, but transaction latency increases
Solution Approach 1:
The patent applies preliminary action by pre-configuring access control rules and entity identifier mappings in the access control logic before peer-to-peer transactions occur. The system establishes entity identifiers for functional entities and pre-defines their access permissions, allowing the access control logic to make immediate decisions without requiring real-time validation through the root complex, thus reducing transaction latency while maintaining security
Solution Approach 2:
The patent introduces an intermediary access control logic component that sits between peripheral devices and the root complex. This intermediary handles access control decisions locally using pre-configured rules, eliminating the need for every peer-to-peer request to be redirected to the root complex for validation, thereby reducing latency while maintaining proper access control enforcement
2Productivity
If peer-to-peer communications are allowed between peripheral devices, then device functionality and performance are improved, but virtual machine partitioning security is compromised
Solution Approach 1:
The patent applies local quality by assigning unique entity identifiers to specific functional entities within peripheral devices and configuring granular access control rules for each entity. This allows the system to permit peer-to-peer communications for authorized entity pairs while blocking unauthorized access, enabling selective security enforcement at the entity level rather than device-wide restrictions, thus maintaining both functionality and security
Solution Approach 2:
The patent changes the parameter of access control from binary (allowed/blocked at device level) to granular (allowed/blocked at entity level) by introducing entity identifiers as a new parameter. The access control logic uses these identifiers to dynamically determine whether to permit or block peer-to-peer transactions based on pre-configured access rules, enabling fine-grained control that maintains security while allowing necessary communications
Data Source
AI summary
Computing apparatus includes a central processing unit (CPU), which is configured to run concurrently multiple virtual machines, including at least first and second virtual machines. A peripheral component bus is connected to communicate with the CPU. Multiple peripheral devices are connected to communicate via the bus with the CPU and with others of the peripheral devices, including at least first and second peripheral devices that are each respectively partitioned into at least first and second functional entities, which are respectively assigned to serve the at least first and second virtual machines. Access control logic is configured to forward peer-to-peer communications initiated by the functional entities between the peripheral devices over the bus while inhibiting access in the peer-to-peer communications between the functional entities that are assigned to different ones of the virtual machines.