VM Exit Delay for Memory Access Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional trap-and-emulate methods for protecting virtual machines from malware impose a substantial computational burden on host computer systems, impacting user experience and productivity.
Innovation Solution
A host system with a hardware processor configured to determine if executing a guest instruction causes a memory access violation, suspends the instruction's execution and switches to a computer security program to assess the violation, eliminating the need for disassembly and emulation by delaying the VM suspend event until the instruction's execution stage is complete.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional trap-and-emulate methods are used to protect virtual machines from malware, then security detection capability is improved, but computational burden on host system increases substantially
Solution Approach 1:
The patent applies preliminary action by pre-configuring memory access permissions and setting up trap mechanisms before malware execution occurs. The host system pre-establishes protected memory regions and configures the processor to generate events on specific access violations, allowing security monitoring to be ready and waiting without requiring intensive computation during normal VM operation.
Solution Approach 2:
The patent extracts the security analysis function from the instruction emulation process. Instead of emulating entire instructions to analyze malware behavior, the system extracts only the critical memory access events from the instruction execution flow. The processor generates events only on specific memory access violations, and the security program analyzes only these extracted events rather than reconstructing full instruction semantics through emulation.
2Measurement precision
If trap-and-emulate methods suspend execution early to analyze instructions, then security analysis accuracy is improved, but performance overhead increases due to disassembly and emulation requirements
Solution Approach 1:
The patent applies self-service by leveraging the processor's built-in memory management and permission checking mechanisms to generate security events. The processor itself performs the initial filtering and event generation based on pre-configured permissions, serving the security monitoring function without requiring external disassembly or emulation infrastructure. This reduces the time loss by using the processor's native capabilities rather than adding software-based analysis layers.
Data Source
Figure 1
Figure 2-A~2-B
Figure 2-C~3
AI summary
Described systems and methods enable a host system to efficiently perform computer security activities, when operating in a hardware virtualization configuration. A processor is configured to generate a VM suspend event (e.g., a VM exit or a virtualization exception) when a guest instruction executing within a guest VM. performs a memory access violation. In some embodiments, the processor is further configured to delay generating the VM suspend event until the execution stage of the pipeline for the guest instruction is complete, and to save results of the execution stage to a specific location (e.g. a specific processor register readable by security-software) before generating the event.