Unused Memory Regions for Secure Hypervisor Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualized computing environments are vulnerable to malware and malicious code, which can access confidential information and prevent security mechanisms like antivirus software from executing due to memory resource starvation.
Innovation Solution
Identifying and utilizing unused memory regions as secure storage for confidential information and executable code, making them invisible to malicious applications and providing necessary memory resources to security programs to enable their execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If memory resources are allocated to run applications in a virtual machine, then the virtual machine can execute applications, but malicious code can access confidential information stored in memory
Solution Approach 1:
The patent segments memory into different types (committed vs. uncommitted memory) and uses separate data structures (page tables, memory descriptors) to manage them. Confidential information is stored in uncommitted memory regions that are segmented off from the application's accessible memory space, allowing applications to run in committed memory while security mechanisms protect data in uncommitted memory.
Solution Approach 2:
The patent introduces an intermediary security mechanism (hypervisor or security module) that acts as a mediator between applications and memory. This intermediary monitors and controls access to memory regions, allowing legitimate application execution while blocking malicious code from accessing confidential information stored in protected uncommitted memory regions.
2Productivity
If memory resources are consumed by malicious code, then malicious applications can operate, but security mechanisms like antivirus software cannot execute due to memory starvation
Solution Approach 1:
The patent enables security mechanisms to self-serve by directly accessing uncommitted memory regions without requiring allocation from the application's memory pool. The hypervisor allocates uncommitted memory specifically for security mechanisms, allowing them to operate independently of application memory consumption and ensuring they can execute even when malicious code occupies available memory.
3Ease of operation
If confidential information is stored in memory for application access, then applications can use the information, but security mechanisms cannot protect it from malicious code
Solution Approach 1:
The patent adds a new dimension to memory organization by introducing uncommitted memory regions that exist alongside committed memory. Confidential information is placed in this additional memory dimension (uncommitted region) that is invisible and inaccessible to applications, while security mechanisms can access it. This dimensional separation provides security without affecting application operation.
Data Source
AI summary
Example methods are provided to identify unused memory regions in pages that are allocated for storing executable code. One or more of the unused memory regions are usable as a secure location to store confidential information shared between a hypervisor on the host and a guest (such as a guest virtual computing instance) that runs on the host. The one or more unused memory regions may also be used to store executable code (such as valid executable code of antivirus software or other security program) that has been prevented/delayed in its execution by malicious code that has occupied the pages, thereby providing the executable code with sufficient memory resources to enable the executable code to at least partially complete execution.