Reverse Shadow Page Tables for Encrypted Nested VMs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies do not support encrypted VM memory in nested virtualization, as a malicious Level 2 guest VM can bypass encryption by marking memory as non-encrypted, making it accessible to the Level 0 hypervisor, thus compromising security.
Innovation Solution
Implementing a reverse shadow page table configuration where the Level 1 hypervisor generates a shadow page table using the Level 2 and Level 1 page tables, maintaining memory pages of the Level 2 virtual machine encrypted by keeping the shadow page table in the Level 1 hypervisor, ensuring that the Level 0 hypervisor cannot access unencrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a Level 2 guest VM is allowed to mark memory as non-encrypted, then the VM gains flexibility in memory management, but security is compromised as the Level 0 hypervisor can access unencrypted data
Solution Approach 1:
The patent inverts the traditional shadow page table approach by having the Level 1 hypervisor generate shadow page tables that map Level 2 guest virtual addresses directly to Level 0 host physical addresses, rather than the conventional approach where Level 2 could mark pages as non-encrypted. This inversion ensures all Level 2 memory remains encrypted while maintaining proper address translation through the reversed shadow table mechanism.
Solution Approach 2:
The Level 1 hypervisor acts as an intermediary that generates shadow page tables to mediate between Level 2 guest virtual addresses and Level 0 host physical addresses. This intermediary layer prevents direct access to unencrypted memory by the Level 0 hypervisor while still allowing the Level 2 VM to manage its memory flexibly through the encrypted interface.
2Ease of operation
If traditional shadow page tables are used in nested virtualization, then address translation works correctly, but encrypted memory cannot be protected from Level 0 hypervisor access
Solution Approach 1:
The patent reverses the traditional shadow page table configuration where instead of Level 0 generating shadow tables from Level 1, the Level 1 hypervisor generates shadow page tables that map Level 2 guest virtual addresses to Level 0 host physical addresses. This inverted approach maintains address translation functionality while ensuring all memory remains encrypted and protected from unauthorized Level 0 access.
3Reliability
If all Level 2 memory is kept encrypted, then security is maintained, but address translation complexity increases in nested virtualization
Solution Approach 1:
The Level 1 hypervisor serves as an intermediary that manages the complexity of address translation by generating shadow page tables that directly map Level 2 guest virtual addresses to Level 0 host physical addresses. This intermediary approach maintains strong encryption for all Level 2 memory while the Level 1 hypervisor handles the translation complexity, keeping the Level 0 hypervisor simple and secure.
Data Source
AI summary
Systems and methods for memory management for virtual machines. An example method may comprise running, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine running a Level 1 hypervisor which manages a Level 2 virtual machine having encrypted memory pages. The Level 1 hypervisor may generate a shadow page table where each shadow page table entry of the plurality of shadow page table entries maps a Level 2 guest virtual address of a Level 2 address space associated with the Level 2 virtual machine to a corresponding Level 1 guest physical address of a Level 1 address space associated with the Level 1 virtual machine. The Level 0 hypervisor may generate a Level 0 page table comprising a plurality of Level 0 page table entries that maps a Level 1 guest physical address to a corresponding Level 0 host physical address.