Secure Extended Page Tables for VM Memory Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virtual machine (VM) implementations lack a comprehensive solution to prevent page remapping attacks by malicious or exploited Virtual Machine Monitors (VMMs) on memory address spaces, compromising the confidentiality and integrity of VM execution.
Innovation Solution
The introduction of Trusted Domain Extensions (TDX) with Secure Extended Page Tables (SEPT) managed by a Trusted Domain Resource Manager (TDRM) using specialized instructions, ensuring that page mappings for Trusted Domains (TDs) cannot be altered without proper authorization, and employing memory encryption to isolate TDs from the VMM.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional Extended Page Tables (EPT) are used for virtual memory management, then the VMM can flexibly manage memory address spaces, but the VMM becomes vulnerable to page remapping attacks that compromise VM confidentiality and integrity
Solution Approach 1:
The patent segments the memory management structure into two distinct components: traditional EPT for address translation and a new Secure EPT (SEPT) for security-critical page mapping. This segmentation allows the system to maintain flexible memory management through EPT while protecting against remapping attacks through SEPT, which stores only guest physical to host physical address mappings without allowing guest influence.
Solution Approach 2:
The SEPT acts as an intermediary layer between the guest VM and the host physical memory. By introducing this intermediate structure that the guest cannot access or modify, the patent prevents direct manipulation of page mappings while still allowing legitimate address translation through the coordinated EPT-SEPT system.
2Ease of operation
If the VMM has full access to memory address spaces for management, then memory allocation and mapping are flexible, but the VMM can perform unauthorized page remapping attacks
Solution Approach 1:
The patent applies different quality characteristics to different parts of the memory management system. The EPT maintains full flexibility for general memory management operations, while the SEPT implements strict security constraints for critical page mapping functions. This local differentiation allows flexible memory management where needed while preventing attacks where security is critical.
Solution Approach 2:
Instead of giving the guest full access to page table management (traditional approach), the patent inverts the model by creating a SEPT that the guest cannot access at all. The guest operates within its isolated SEPT namespace, while the VMM manages the mapping between SEPT and EPT, effectively reversing the traditional hierarchy of access control.
3Reliability
If a secure memory management system is implemented to prevent page remapping attacks, then VM confidentiality is protected, but the system complexity and overhead increase
Solution Approach 1:
The patent merges the security-critical SEPT with the existing EPT infrastructure, allowing both structures to coexist and work together. The SEPT and EPT are integrated through coordinated updates and shared translation logic, reducing the overall system complexity compared to implementing completely separate security and management paths.
Solution Approach 2:
The SEPT is pre-configured with secure page mappings before the guest VM operates. By establishing the secure mapping structure in advance and preventing guest modification, the system avoids the need for complex runtime security checks and validation, reducing operational overhead while maintaining strong security guarantees.
Data Source
AI summary
Examples include a processor including at least one untrusted extended page table (EPT), circuitry to execute a set of instructions of the instruction set architecture (ISA) of the processor to manage at least one secure extended page table (SEPT), and a physical address translation component to translate a guest physical address of a guest physical memory to a host physical address of a host physical memory using one of the at least one untrusted EPT and the at least one SEPT.