Process Virtual Machine Hypervisor for Strong Data Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing process virtual machines (PVMs) lack strong security boundaries between executing processes, leading to potential data access issues among processes sharing an operating system, which can compromise security and efficiency, especially in cloud computing environments.

Innovation Solution

Implement a multi-process PVM with a hypervisor that enforces data resource permissions and translates I/O requests to maintain isolation between processes, using data resource translation rules to ensure each process accesses only its designated data resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If processes share an operating system in a traditional PVM, then resource utilization is improved, but security boundaries between processes deteriorate

Engineering Contradiction:

Improveresource utilizationVSAvoidsecurity boundaries

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent segments data resources into distinct namespaces, each associated with a specific process. The hypervisor maintains separate data resource translations for each process, creating isolation boundaries while allowing all processes to share the same operating system and hardware resources. This segmentation resolves the contradiction by enabling secure multi-tenancy.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The hypervisor acts as an intermediary between processes and data resources. It intercepts data resource requests from processes, translates them according to process-specific rules, and ensures isolation is maintained. This intermediary layer enables secure resource sharing without compromising security boundaries.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If system virtual machines are used to provide strong security boundaries, then security is improved, but overhead and latency increase

Engineering Contradiction:

Improvesecurity boundariesVSAvoidoverhead and latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts the security boundary enforcement from the operating system level and places it at the hypervisor level within the PVM. By removing the need for full system virtualization, the solution maintains strong security boundaries while eliminating the associated overhead of system VMs, thus reducing latency.

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If data resource access is fully isolated between processes, then security is improved, but ease of operation deteriorates

Engineering Contradiction:

Improvedata resource isolationVSAvoiddata access simplicity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements self-service through automatic data resource translation. Processes make standard data access requests without needing to know about isolation mechanisms. The hypervisor automatically translates requests according to process-associated rules, providing transparent isolation that maintains ease of operation while ensuring security.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12373236B1Providing strong security boundaries in process virtual machines

Publication Date: 2025.07.29 AMAZON TECH INC

AI summary

Systems and methods are provided for strongly isolating processes executing in a process virtual machine (PVM), to provide a security boundary similar to that provided by a system virtual machine (SVM). The PVM can include a hypervisor that supports execution of multiple processes within the PVM. The hypervisor can intermediate data resource requests from the processes and apply translation rules to such requests, which rules can isolate data resources accessible to each process from data resources available to other processes of the PVM.