Shared Memory Mediation for Secure Isolated Process Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing shared memory communication methods in virtual machines lead to security vulnerabilities and inefficiencies due to uncontrolled access, preventing same-page merging and increasing memory usage, which can interfere with other beneficial technologies.
Innovation Solution
Implement a messenger process, such as a virtual machine monitor, to manage memory access and communication between isolated memory spaces, allowing partial or complete isolation of memory areas while enabling shared memory communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If processes use shared memory for communication, then communication efficiency is improved, but security vulnerabilities increase due to uncontrolled access
Solution Approach 1:
The patent introduces a memory management unit (MMU) as an intermediary between processes and physical memory. The MMU translates virtual memory addresses to physical addresses and enforces access control policies, allowing processes to communicate efficiently through shared memory while the MMU ensures security by controlling and monitoring all memory access operations.
Solution Approach 2:
The patent divides the memory address space into separate virtual memory spaces for different processes. Each process operates within its own isolated virtual memory space, and the MMU manages the segmentation by translating virtual addresses to physical addresses according to defined access rights, enabling both isolation for security and controlled sharing for communication.
2Speed
If processes have direct access to shared memory, then communication speed is improved, but memory usage increases preventing same-page merging
Solution Approach 1:
The patent implements a copying mechanism where the MMU creates and maintains virtual copies of memory pages for different processes. When a process needs to access shared data, the MMU provides access to appropriate virtual copies without requiring direct physical memory sharing, enabling fast access while allowing the underlying physical memory to be consolidated and merged when not actively shared.
3Reliability
If memory isolation is implemented between processes, then security is improved, but communication complexity increases
Solution Approach 1:
The patent makes the MMU a universal component that handles multiple functions: address translation, access control enforcement, and communication facilitation. By consolidating these functions in a single hardware component, the system achieves strong memory isolation for security while the MMU automatically manages the complexity of inter-process communication through standardized virtual memory operations.
Data Source
AI summary
Systems and methods are provided. An example method can include receiving, from a first process, a first request for first data to be written to a first memory location by a second process. The example method can include providing a second request for the first process to write data to a second memory location, wherein the second process has write access to the second memory location and not the first memory location. The example method can include receiving a first notification indicating that the second process has written the first data to the second memory location. The example method can include transferring the first data from the second memory location to the first memory location. The example method can include providing a second notification to the first process indicating that the first data has been written to the first memory location.