Secure VM Large-Page Translation With Trusted Page Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual machine management approaches limit secure guests to small pages due to security and performance concerns, preventing the realization of processing advantages offered by larger pages, such as faster address translation and reduced cache misses.
Innovation Solution
Implement a secure interface control in a trusted computing environment to determine and set security properties for large pages used by secure guests, ensuring they meet predefined requirements, allowing efficient translation and allocation while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure guests are limited to small pages, then security requirements are met, but processing efficiency deteriorates due to increased cache misses and overhead
Solution Approach 1:
The patent segments the page table into multiple levels (e.g., first-level page tables pointing to second-level page tables), allowing large guest pages to be represented through hierarchical structures. This segmentation enables secure guests to use large pages for better cache performance while maintaining security through controlled access at each level of the hierarchy.
Solution Approach 2:
The patent introduces an intermediary mechanism (the secure interface control and trusted execution environment) that mediates between the secure guest and the host hypervisor. This intermediary verifies security requirements and manages large page allocations, allowing secure guests to benefit from large page performance while preventing security violations.
2Productivity
If large pages are used for secure guests, then processing efficiency improves by reducing cache misses, but security control deteriorates due to inability to granularly manage page permissions
Solution Approach 1:
The patent segments large pages into smaller constituent pages for security management purposes. The page table hierarchy allows the system to track and control access to individual small pages that compose larger logical pages, enabling granular security policies even when guests operate with large page semantics.
Solution Approach 2:
The patent adds an additional dimension to page management by introducing hierarchical page tables with multiple levels. This dimensional expansion allows the system to simultaneously support large page sizes for performance while maintaining fine-grained security control through the intermediate level of abstraction provided by the hierarchical structure.
3Device complexity
If host hypervisor controls all guest memory, then resource management is simplified, but trust requirements increase as hypervisor administrators must be fully trustworthy
Solution Approach 1:
The patent extracts critical security functions from the traditional host hypervisor and places them in a separate trusted execution environment. This extraction creates a secure interface control that independently verifies security requirements for large page allocations, reducing the trust requirements for the host hypervisor while maintaining simplified resource management.
Solution Approach 2:
The patent introduces an intermediary trusted execution environment that sits between the host hypervisor and secure guests. This intermediary handles security-critical operations such as verifying large page allocations and managing page table hierarchies, allowing the host to maintain resource management control without requiring full trust for security operations.
Data Source
AI summary
The computer-implemented methods, computer program products, and computer systems include computer operations that include executing, in a trusted computing environment, a call from a host in an untrusted computing environment, where the call is to determine a status of a large page of memory for use by a secure guest, where the secure guest is managed by the host in the untrusted computing environment. The executing includes determining that all small pages comprising the large page and the large page meet pre-defined security requirements. The executing also includes, based on the determining, setting security properties of the large page and the small pages comprising the large page to enable translation for the large page for a given block of memory of the secure guest. The executing also includes storing in a computing element, a designation identifying the large page as belonging to the secure guest.