Table Walker Memory Access Control via Reverse Map Table
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices with virtual machines face security issues due to hypervisors not properly enforcing access controls, leading to potential data breaches where virtual machines can access incorrect or unwanted memory areas, compromising data integrity and security.
Innovation Solution
Implementing a pair of tables, a reverse map table and a guest accessed pages table, to ensure that system physical addresses are correctly mapped to guest physical addresses, preventing malicious or erroneous modifications of the nested page table, thereby enforcing strict access controls and improving security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a hypervisor enforces access controls for virtual machines, then security and access control are improved, but the hypervisor may be corrupted or replaced with malicious code, leading to incorrect address information and unauthorized memory access
Solution Approach 1:
The patent introduces a table walker as an intermediary component between the hypervisor and the memory access translation process. The table walker independently verifies address translations by checking both the nested page table and the reverse map table, preventing malicious or corrupted hypervisor code from directing virtual machines to unauthorized memory areas. This intermediary mechanism ensures that even if the hypervisor is compromised, the actual memory access control remains secure through independent verification.
2Ease of operation
If the hypervisor provides address translations between local addresses and physical addresses, then virtual machine access to memory is enabled, but incorrect address information may be provided, directing virtual machines to unexpected or unwanted areas of memory
Solution Approach 1:
The patent implements a feedback mechanism where the table walker verifies address translations by cross-checking the nested page table against the reverse map table. The reverse map table stores the expected physical address for each virtual address, and the table walker compares the translated address against this expected value. If the translation is incorrect, the system detects the discrepancy and prevents the unauthorized access, providing feedback that ensures address translation accuracy.
Solution Approach 2:
The system performs preliminary verification of address translations before actual memory access occurs. The table walker checks the translated physical address against the reverse map table in advance, validating the address translation before the virtual machine can access the memory. This preliminary check prevents incorrect address information from leading to unauthorized memory access.
3Productivity
If multiple virtual machines share a common memory with allocated regions, then resource utilization is improved, but a virtual machine may access regions allocated to other virtual machines if access controls fail
Solution Approach 1:
The table walker serves as an intermediary that enforces memory region isolation by independently verifying that each virtual machine can only access its allocated memory regions. By cross-checking address translations against the reverse map table, the table walker ensures that even if one virtual machine attempts to access another's allocated region, the unauthorized access is blocked. This maintains reliable isolation while allowing multiple virtual machines to share the common memory resource.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A table walker receives, from a requesting entity, a request to translate a first address into a second address associated with a page of memory. During a corresponding table walk, when a lock indicator in an entry in a reverse map table (RMT) for the page is set to mark the entry in the RMT as locked, the table walker halts processing the request and performs a remedial action. In addition, when the request is associated with a write access of the page and an immutable indicator in the entry in the RMT is set to mark the page as immutable, the table walker halts processing the request and performs the remedial action. Otherwise, when the entry in the RMT is not locked and the page is not marked as immutable for a write access, the table walker continues processing the request.