Trusted Virtual Machine Isolation via Segmented Memory Mapping

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The existing trusted execution environment in mobile terminals does not adapt to advanced virtualization systems, leading to shared security environments for multiple virtual machines, which compromises data security as malicious users can steal private data from other users.

Innovation Solution

Creating separate trusted and ordinary virtual machines with distinct memory mapping tables and access permissions, allowing each user to have an isolated execution environment, ensuring that security applications run in a secure environment without interference from other virtual machines.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If a single trusted execution environment is provided by hardware for multiple virtual machines, then device complexity is reduced, but data security deteriorates as malicious users can steal private data from other users

Engineering Contradiction:

Improvetrusted execution environment structureVSAvoiddata security

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent divides the single trusted execution environment into multiple isolated trusted execution environments, one for each virtual machine user. Each user obtains a dedicated trusted execution environment that is isolated from other users, preventing data theft while maintaining manageable system complexity through structured allocation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent assigns different security properties to different parts of the system by providing each virtual machine user with a dedicated trusted execution environment that has unique access permissions and isolation characteristics, rather than using a uniform shared environment.

Inventive Principle:

Principle #3Local quality

2Reliability

If separate trusted execution environments are provided for each virtual machine user, then data security is improved, but device complexity increases

Engineering Contradiction:

Improvedata securityVSAvoidtrusted execution environment structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system segments the trusted execution environment resources and allocates dedicated environments to each virtual machine user. This segmentation approach enhances data security through isolation while managing complexity by organizing resources in a structured, user-specific manner.

Inventive Principle:

Principle #1Segmentation

3Ease of operation

If all virtual machine users share a same trusted execution environment, then ease of operation is improved, but harmful factors increase as malicious users can interfere with other users

Engineering Contradiction:

Improveenvironment managementVSAvoiddata theft risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent segments the shared trusted execution environment into user-specific isolated environments, eliminating the security vulnerabilities of sharing while maintaining ease of operation through automated allocation and management of these segmented environments.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system introduces a virtual machine monitor as an intermediary that manages the allocation and isolation of trusted execution environments for each virtual machine user. This intermediary ensures secure isolation while simplifying user operation through automated environment management.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Device complexity

If memory mapping tables are shared among virtual machines, then device complexity is reduced, but security deteriorates as isolation between virtual machines is compromised

Engineering Contradiction:

Improvememory management structureVSAvoidvirtual machine isolation

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent divides the shared memory mapping table into separate, isolated memory mapping tables for each virtual machine user. This segmentation provides the necessary isolation between virtual machines to prevent unauthorized access while managing complexity through structured memory allocation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Each virtual machine user is assigned a dedicated memory mapping table with specific access permissions tailored to that user's needs, providing localized security properties rather than a uniform shared access model.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS11321452B2Execution environment virtualization method and apparatus and virtual execution environment access method and apparatus

Publication Date: 2022.05.03 HUAWEI TECH CO LTD

AI summary

The present disclosure provides an execution environment virtualization method. The method includes: creating an ordinary virtual machine and a trusted virtual machine for a user in the ordinary execution environment, where the ordinary virtual machine executes an ordinary application of the user, and the trusted virtual machine executes a security application of the user; allocating memories to the ordinary virtual machine and the trusted virtual machine; establishing a mapping relationship between an ordinary memory of the ordinary virtual machine and a physical memory, to obtain a first memory mapping table; and establishing a mapping relationship between a virtual physical memory of the trusted virtual machine and a physical memory, to obtain a second memory mapping table. Therefore, the ordinary application and the security application run in execution environments independent of each other, thereby ensuring data security of the user.