Secure Interface Control for Hypervisor Memory Paging

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing environments, there is a need for enhanced security measures to prevent malicious hypervisors from accessing secure guest storage, as existing systems are susceptible to malicious behavior that compromises data integrity and access.

Innovation Solution

Implementing a secure interface control that uses host program interruptions to inform the hypervisor of the need for machine intervention during paging operations and to encrypt or decrypt secure pages, ensuring that only authorized entities can access secure storage by utilizing a secure interface control that works in collaboration with hardware to manage and secure guest storage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If a hypervisor is given full access to manage guest memory paging, then memory management efficiency is improved, but security against malicious hypervisors deteriorates

Engineering Contradiction:

Improvememory management efficiencyVSAvoidsecurity against malicious hypervisors

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent introduces a secure interface control (firmware/hardware) as an intermediary between the untrusted hypervisor and the secure guest memory. This mediator verifies hypervisor requests, encrypts/decrypts pages appropriately, and prevents malicious access while allowing legitimate paging operations to proceed efficiently

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If secure encryption is applied to all guest pages, then security is improved, but access speed and memory operations deteriorate

Engineering Contradiction:

Improvesecurity of guest storageVSAvoidaccess speed to guest pages

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The patent applies encryption selectively rather than universally. Secure pages are encrypted when stored in host memory, but the encryption/decryption is managed transparently by the secure interface control. Well-behaved hypervisors can access decrypted pages efficiently, while malicious access is blocked, achieving both security and performance

Inventive Principle:

Principle #3Local quality

3Reliability

If the hypervisor is completely restricted from accessing secure pages, then security is improved, but legitimate memory management operations deteriorate

Engineering Contradiction:

Improveisolation from malicious hypervisorsVSAvoidlegitimate memory management

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The secure interface control acts as a trusted intermediary that receives paging requests from the hypervisor, verifies their legitimacy, and processes them appropriately. This allows well-behaved hypervisors to perform necessary memory management operations while blocking malicious access attempts

Inventive Principle:

Principle #24Intermediary (Mediator)

4Device complexity

If transparent paging is implemented without secure interface control, then system simplicity is improved, but susceptibility to malicious behavior increases

Engineering Contradiction:

Improvesystem architecture simplicityVSAvoidsusceptibility to malicious hypervisor behavior

Core Design Contradiction:

Device complexityVSObject-affected harmful factors

Solution Approach 1:

The secure interface control is integrated into the existing paging infrastructure as a trusted intermediary. It intercepts and processes paging requests, applying encryption/decryption and security checks transparently. This adds minimal complexity while effectively preventing malicious hypervisor behavior

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11403409B2Program interruptions for page importing/exporting

Publication Date: 2022.08.02 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

An example computer-implemented method includes presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page. The method further includes, in response to the exception, issuing, by the untrusted entity, an export call routine. The method further includes executing, by a secure interface control of the computing system, the export call routine.