Secure Virtual Machine Execution via Distributed Hardware Isolation

The patent divides the secure hardware execution resources into multiple distinct secure execution environments (SEEs), each isolated from the others. Each SEE operates as an independent secure context with its own execution state, preventing cross-VM security breaches while allowing multiple VMs to simultaneously utilize secure hardware resources through proper allocation and management by the secure monitor.

The patent creates a universal secure execution infrastructure where a single secure hardware portion can serve multiple virtual machines through the creation of multiple isolated secure execution environments. The secure monitor manages the allocation and switching between different SEEs, allowing the same physical secure hardware resources to be universally utilized by multiple VMs while maintaining strict isolation boundaries, thus achieving both security and resource efficiency.

The patent implements a nested security architecture where secure execution environments are stored in shared memory but are protected by multiple layers of isolation mechanisms. The secure execution environments are nested within the secure hardware portion's protected address space, and the secure monitor provides an additional layer of control. This nested structure allows efficient shared memory usage while maintaining security through hierarchical protection boundaries that prevent unauthorized access even if outer layers are compromised.