Protected Walk-based Shadow Paging for Page Table Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Out-of-band monitors face inefficiencies in allowing OS manipulation of translation regimes without prior validation, leading to overhead and inefficiencies in page table management.
Innovation Solution
Implementing Protected Walk-based Shadow Paging using multiple level page tables and a hypervisor configuration register with a protected table walk bit to control and verify page table access, allowing OS to write and read while preventing unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Shadow Paging is used to trap all address translation regime changes and page faults to the out-of-band monitor, then security monitoring capabilities are improved, but computing resource consumption increases significantly
Solution Approach 1:
The patent segments the page table access control into two distinct modes: a first mode where the OS can write to page tables without trapping, and a second mode where the MMU can read page tables without trapping. This segmentation allows the system to maintain security monitoring capabilities while reducing the frequency of traps to the out-of-band monitor, thereby lowering computing resource consumption.
Solution Approach 2:
The patent dynamically switches between two attribute states for page tables: a first attribute that permits OS writes and a second attribute that permits MMU reads. The out-of-band monitor controls the transition between these attributes, allowing the system to adapt its security monitoring intensity based on current operational needs, thus balancing security and performance.
2Ease of operation
If the OS is allowed to write to page tables without prior validation, then ease of operation is improved, but system security deteriorates due to potential unauthorized modifications
Solution Approach 1:
The patent implements preliminary action by requiring the OS to write to page tables in a controlled first mode, where writes are permitted without immediate trapping. The out-of-band monitor then validates these changes before transitioning to the second mode where MMU reads are allowed. This preliminary validation approach maintains ease of operation while ensuring security.
Solution Approach 2:
The out-of-band monitor acts as an intermediary between the OS and the MMU regarding page table access. It receives writes from the OS, validates them, and then controls the transition to a state where MMU reads are permitted. This intermediary role ensures that security is maintained while allowing operational flexibility.
3Speed
If the MMU is allowed to read page tables without trapping to the monitor, then processing speed is improved, but security control is weakened
Solution Approach 1:
The patent segments page table access into two distinct operational modes: a first mode optimized for OS writes and a second mode optimized for MMU reads. By separating these access patterns, the system can allow fast MMU reads in the second mode without trapping, while maintaining security control through the monitor's ability to transition between modes and validate changes.
Solution Approach 2:
The patent enables continuous MMU read operations in the second mode without interruption from traps to the monitor. This continuity of useful action maintains high processing speed for address translation, while the monitor retains security control by managing transitions between modes and validating page table changes before they occur.
4Reliability
If frequent context switches to the hypervisor are performed for page table verification, then security is improved, but system performance deteriorates
Solution Approach 1:
The patent implements periodic action by performing hypervisor verification only at specific transition points between the first and second modes, rather than continuously. The out-of-band monitor validates page tables when transitioning from the write-permissive first mode to the read-permissive second mode, reducing the frequency of context switches while maintaining security.
Solution Approach 2:
The patent enables self-service by allowing the OS to perform page table writes in the first mode without immediate hypervisor intervention. The hypervisor then performs batch verification and mode transitions, allowing the OS to continue operations with minimal interruptions, thus improving overall system performance while maintaining verification security.
Data Source
AI summary
A Protected Walk-based Shadow Paging (PWSP) method includes storing a multiple level first stage (S1) page tables structure in second stage (S2) page tables. The method includes: when an S1 page table in an S2 page table entry is marked with a writable attribute: (i) permitting an operating system (OS) to write to the S1 page table, (ii) blocking a memory management unit (MMU) from reading the S1 page table for translation, and (iii) in response, verifying the S1 page table for translation and changing the marking of the S1 page table in the S2 page table entry to a read-only attribute, enabling the MMU to subsequently read the S1 page table. The method further includes: when the S1 page table in the S2 page table entry is marked with the read-only attribute: (i) permitting the OS to read the S1 page table for translating from a virtual address to an intermediate physical address, (ii) blocking the OS from writing to the S1 page table, and (iii) in response to blocking the OS, updating the S1 page table and changing the marking of the S1 page table in the S2 page table entry to the device memory attribute, enabling the OS to write to the S1 page table. Blocking the MMU from reading the S1 page table for translation may include generating a device memory permissions fault, and blocking the OS from writing to the S1 page table may include generating a read-only prefetch permissions fault.