VM Exit Delay for Memory Access Security

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional trap-and-emulate methods for protecting virtual machines from malware impose a substantial computational burden on host computer systems, impacting user experience and productivity.

Innovation Solution

A host system with a hardware processor configured to determine if executing a guest instruction causes a memory access violation, suspends the instruction's execution and switches to a computer security program to assess the violation, eliminating the need for disassembly and emulation by delaying the VM suspend event until the instruction's execution stage is complete.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional trap-and-emulate methods are used to protect virtual machines from malware, then security detection capability is improved, but computational burden on host system increases substantially

Engineering Contradiction:
Improvesecurity detection capabilityVSAvoidcomputational efficiency
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent applies preliminary action by pre-configuring memory access permissions and setting up trap mechanisms before malware execution occurs. The host system pre-establishes protected memory regions and configures the processor to generate events on specific access violations, allowing security monitoring to be ready and waiting without requiring intensive computation during normal VM operation.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent extracts the security analysis function from the instruction emulation process. Instead of emulating entire instructions to analyze malware behavior, the system extracts only the critical memory access events from the instruction execution flow. The processor generates events only on specific memory access violations, and the security program analyzes only these extracted events rather than reconstructing full instruction semantics through emulation.

Inventive Principle:
Principle #2Taking out (Extraction)

2Measurement precision

If trap-and-emulate methods suspend execution early to analyze instructions, then security analysis accuracy is improved, but performance overhead increases due to disassembly and emulation requirements

Engineering Contradiction:
Improvesecurity analysis accuracyVSAvoidinstruction execution time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies self-service by leveraging the processor's built-in memory management and permission checking mechanisms to generate security events. The processor itself performs the initial filtering and event generation based on pre-configured permissions, serving the security monitoring function without requiring external disassembly or emulation infrastructure. This reduces the time loss by using the processor's native capabilities rather than adding software-based analysis layers.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3183682B1Systems and methods for outputting a result of a current processor instruction upon exiting a virtual machine
Publication Date: 2019.04.03 BITDEFENDER IPR MANAGEMENT
  • EP3183682B1 patent drawingFigure 1
  • EP3183682B1 patent drawingFigure 2-A~2-B
  • EP3183682B1 patent drawingFigure 2-C~3

AI summary

Described systems and methods enable a host system to efficiently perform computer security activities, when operating in a hardware virtualization configuration. A processor is configured to generate a VM suspend event (e.g., a VM exit or a virtualization exception) when a guest instruction executing within a guest VM. performs a memory access violation. In some embodiments, the processor is further configured to delay generating the VM suspend event until the execution stage of the pipeline for the guest instruction is complete, and to save results of the execution stage to a specific location (e.g. a specific processor register readable by security-software) before generating the event.