Secure Interface Control for Virtual Memory Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud computing environments face challenges in ensuring secure data isolation and storage segregation, particularly due to the use of virtualization which alters the relationship between the operating system and hardware, introducing additional security configuration, management, and security concerns.

Innovation Solution

The implementation of a secure interface control that provides an additional layer of security for virtual machines by leveraging a lightweight trusted firmware interface between secure and untrusted entities, allowing the hypervisor to manage secure guest pages without maintaining shadow tables, while ensuring security in page mappings.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If virtualization is used to enable multi-tenant cloud computing, then resource sharing and flexibility are improved, but security isolation and data protection deteriorate

Engineering Contradiction:

Improveresource sharingVSAvoidsecurity isolation

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments the memory address space into secure and non-secure regions, and further divides secure memory into different secure domains (first secure domain, second secure domain, etc.). Each domain has its own page tables and access control mechanisms, enabling logical separation of data while allowing physical resource sharing. This resolves the contradiction by providing both resource efficiency through sharing and security through domain isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a secure interface control as an intermediary layer between the hypervisor and secure guest memory. This intermediary manages the boundaries between secure and non-secure memory regions, enforcing access control policies and maintaining security isolation while enabling controlled resource sharing between tenants.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If the hypervisor manages guest memory pages transparently, then operational simplicity is improved, but security control and data protection deteriorate

Engineering Contradiction:

Improvetransparent memory managementVSAvoidsecurity control

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments memory management into different modes: non-secure transparent management by the hypervisor, and secure managed mode where the secure interface control handles page translations for secure domains. This allows the hypervisor to maintain operational simplicity for non-secure memory while security-critical memory is managed through the secure interface control, resolving the contradiction between ease of operation and security control.

Inventive Principle:

Principle #1Segmentation

3Reliability

If shadow tables are maintained for secure page mappings, then security verification is improved, but system complexity and performance overhead worsen

Engineering Contradiction:

Improvesecurity verificationVSAvoidshadow tables

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the security verification function from the traditional shadow table mechanism and relocates it to the secure interface control and hardware support structures. Instead of maintaining comprehensive shadow tables in software, the system uses a lighter-weight approach where the secure interface control maintains only essential mapping information and leverages hardware assistance for security verification, reducing complexity while maintaining security.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent replaces the software-based shadow table mechanism with a hybrid approach involving the secure interface control and hardware support structures. This substitution eliminates the need for maintaining extensive shadow tables in memory, reducing system complexity and performance overhead while maintaining security verification through hardware-assisted validation and streamlined software control.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

4Quantity of substance

If multiple guests share the same physical storage, then storage efficiency is improved, but data isolation and security deteriorate

Engineering Contradiction:

Improvestorage efficiencyVSAvoiddata isolation

Core Design Contradiction:

Quantity of substanceVSReliability

Solution Approach 1:

The patent segments storage access rights by creating different secure domains, each with its own page tables and access control mechanisms. Even though multiple guests share physical storage, the segmentation of address spaces and access control ensures that data isolation is maintained at the logical level, resolving the contradiction between storage efficiency and data isolation.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentEP3935509B1Secure interface control high-level page management

Publication Date: 2025.02.12 INTERNATIONAL BUSINESS MACHINE CORPORATION

Figure 1
Figure 2
Figure 3

AI summary

A method is provided. The method is implemented by a secure interface control of a computer that prevents unauthorized accesses to locations in a memory of the computer. The secure interface control determines that a host absolute page is not previously mapped to a virtual page in accordance with securing the host absolute page and a host virtual page is not already mapped to an absolute page in accordance with securing the host absolute page.