Selective Memory Deduplication for Virtualized Systems

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional memory deduplication in virtualized computer systems exposes systems to security vulnerabilities like side-channel attacks, as it shares physical memory across virtual machines, potentially allowing unauthorized access to sensitive data.

Innovation Solution

Implementing a guest mergeable memory manager and host mergeable memory manager to selectively enable deduplication for specific memory pages, allowing applications to determine which pages are mergeable, thereby reducing exposure to security vulnerabilities while maintaining resource efficiency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If memory deduplication is enabled to share physical memory across virtual machines, then resource efficiency is improved, but security vulnerabilities like side-channel attacks increase

Engineering Contradiction:

Improvememory resource efficiencyVSAvoidside-channel security vulnerabilities

Core Design Contradiction:

Quantity of substanceVSObject-affected harmful factors

Solution Approach 1:

The patent segments memory into different types: mergeable memory pages that can be shared across VMs for resource efficiency, and non-mergeable memory pages that remain private for security-critical data. This segmentation allows the system to achieve both resource efficiency and security by applying deduplication selectively rather than universally.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by making different memory regions have different deduplication properties. Certain memory pages are marked as mergeable while others are marked as non-mergeable based on their content and security requirements. This allows fine-grained control over which memory pages participate in deduplication, balancing resource efficiency with security needs.

Inventive Principle:

Principle #3Local quality

2Object-affected harmful factors

If selective memory deduplication is implemented to reduce security vulnerabilities, then security is improved, but device complexity increases

Engineering Contradiction:

Improvesecurity vulnerabilitiesVSAvoidmemory management complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent implements self-service by allowing the guest operating system to autonomously mark memory pages as mergeable or non-mergeable based on their content and security requirements. The hypervisor automatically respects these markings and applies deduplication accordingly, reducing the need for complex manual configuration and centralized control.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent introduces dynamic memory page markings that can be set or cleared based on runtime conditions. Memory pages can transition between mergeable and non-mergeable states, allowing the system to adapt its deduplication behavior dynamically based on security threats and resource needs without requiring system reconfiguration.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS20230205560A1Selective memory deduplication for virtualized computer systems

Publication Date: 2023.06.29 RED HAT INC

AI summary

A processing device executing a guest receives a request from an application to disable memory deduplication for a memory page associated with the application; identifies a non-mergeable memory range for memory space of the guest, where the non-mergeable memory range is associated with guest memory pages not to be deduplicated; maps, in a page table of the guest, an entry for the memory page to a memory address within the non-mergeable memory range; and causes a host to disable memory deduplication for the memory page responsive to detecting an access of the memory page by the application.