Thin Hypervisor for Sandboxed Virtualization Without Root Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization technologies face limitations in using hardware virtualization capabilities due to restrictions on root privileges and kernel modules, particularly in sandboxed environments like those found in Mac App Store, App Store, and Google Play, which prevent the execution of multiple guest OSs in parallel on a host computer.
Innovation Solution
A thin hypervisor is implemented that operates in a non-root mode, allowing unsafe code execution in an isolated environment by creating a Virtual Execution Environment (VEE) that isolates guest code from the host OS, using processor virtualization technologies like Intel VT-X and AMD-V, and providing a user space application with kernel-level access through a standardized API, ensuring safe execution without compromising the host OS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a full hypervisor with kernel modules is used to enable hardware virtualization, then processor virtualization capabilities can be accessed, but root privileges and kernel module restrictions prevent usage in sandboxed environments
Solution Approach 1:
The patent extracts only the essential virtualization functionality from a full hypervisor, creating a thin hypervisor that provides VM creation and management capabilities without requiring complete kernel module access or root privileges. This selective extraction enables virtualization in sandboxed environments while maintaining security constraints.
Solution Approach 2:
The thin hypervisor acts as an intermediary layer between user-space applications and hardware virtualization capabilities. It provides a standardized API that mediates access to processor virtualization features, allowing sandboxed applications to utilize hardware-assisted virtualization without directly requiring kernel-level privileges.
2Reliability
If sandboxed environment restrictions are enforced to maintain security, then host OS integrity is protected, but access to processor virtualization capabilities is blocked
Solution Approach 1:
The thin hypervisor serves as a trusted intermediary that operates within the sandboxed environment's security constraints while providing controlled access to virtualization capabilities. It translates high-level virtualization requests into hardware-specific instructions, maintaining security boundaries while enabling functional access.
Solution Approach 2:
The thin hypervisor provides universal access to processor virtualization capabilities across different sandboxed applications through a standardized API. This multi-functional interface allows various user-space applications to create and manage virtual machines without each application needing direct hardware access or elevated privileges.
3Ease of operation
If a thin hypervisor is implemented in user space to allow sandboxed application access, then virtualization is enabled without root privileges, but kernel space functions remain inaccessible
Solution Approach 1:
The patent extracts the minimal necessary hypervisor functionality required for virtual machine creation and management, implementing only these essential functions in user space. This selective implementation provides sufficient virtualization capability for sandboxed applications without requiring access to the full kernel space API surface.
Data Source
AI summary
A system, method and computer program product for implementing a thin hypervisor. The thin hypervisor does not have any direct association with a VM. The thin hypervisor serves as a wrapper over hardware capabilities of a processor. The processor has privileged low-level capabilities EPT VTX, AMD V and the ARM has virtualization technology. In order to use processor hardware capabilities and receiving root privileges, the system operates in a “super user” mode. The VM operates in a VM environment with kernel privileges in a user mode. A super user space is created in a safe mode. A user space application (or a process) is created. A user space virtualization framework library is used. These entities may be separated by a user space and a kernel (OS) space. A thin hypervisor is implemented in the user space.