Virtual Machine Memory Isolation Using Hypervisor IMDI Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems face security risks due to inadequate data isolation, making them vulnerable to malicious attacks, particularly when kernel level tasks in virtual machines are compromised.
Innovation Solution
A memory management system with a hypervisor and an IMDI circuit that manages access to memory regions using IMDI tables, ensuring secure isolation by controlling access rights at both kernel and user levels, and employing a para-virtualized hypervisor to manage virtual machines and their tasks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If memory is shared between different users or processes, then memory utilization efficiency is improved, but security reliability deteriorates due to risk of data modulation by malicious attackers
Solution Approach 1:
The patent segments the hypervisor into multiple portions (first portion at first exception level, second portion at second exception level) and segments memory into distinct regions (first region, second region, shared region). This segmentation allows different security levels for different functions while maintaining memory sharing, thus resolving the contradiction between memory utilization efficiency and security reliability.
Solution Approach 2:
The patent applies local quality by assigning different access permissions and security characteristics to different memory regions. The first region is accessible only by the first virtual machine, the second region only by the second virtual machine, while the shared region is accessible by both. This localized differentiation of security properties enables secure memory sharing.
2Adaptability or versatility
If kernel level tasks are permitted to access memory regions, then task functionality is improved, but security reliability deteriorates when kernel tasks are compromised
Solution Approach 1:
The patent segments kernel level tasks into different portions associated with different virtual machines, and assigns each portion access rights only to specific memory regions. This segmentation ensures that even if one kernel task is compromised, the attacker cannot access memory regions belonging to other virtual machines, thus maintaining security while preserving task functionality.
Solution Approach 2:
The hypervisor acts as an intermediary between kernel level tasks and memory regions. It mediates access requests by verifying whether the task portion has permission to access the requested memory region, thereby enabling task functionality while preventing unauthorized access even when tasks are compromised.
3Measurement precision
If exception levels are used to control hypervisor portions, then access control precision is improved, but device complexity increases
Solution Approach 1:
The patent changes the parameter of exception levels to control access precision. By assigning different exception levels (first exception level for first portion, second exception level for second portion), the system achieves precise access control. This parameter-based approach is more efficient than adding complex control logic, thus improving access control precision while minimizing the increase in system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A memory management system includes a first virtual machine, a second virtual machine, and a hypervisor configured to manage a region to which the first virtual machine and the second virtual machine access in a memory, control the first virtual machine to access a first region and a shared region in the memory, control the second virtual machine to access the shared region and a second region different from the first region in the memory, and in response to a request of the first virtual machine, store an in-memory data isolation (IMDI) table that indicates an IMDI region that a task of the first virtual machine accesses and a task of the second virtual machine does not access, in the memory.