VM Page Mapping Security via Cryptographic Token Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual machine (VM) environments, there is a need to ensure secure memory page mapping while supporting legacy software that may modify page tables, to prevent security attacks such as remapping attacks that compromise software at any privilege level by altering code or data page selections.
Innovation Solution
A system that includes a processor executing a virtual machine monitor (VMM) to manage VM guests and a page walk processor that inserts cryptographic tokens in physical pages to authorize mappings, using cryptographic keys to validate these tokens before performing memory page mappings from guest linear addresses to guest physical addresses, thereby preventing unauthorized access and attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic validation is implemented for page mappings, then security against remapping attacks is improved, but device complexity increases due to token insertion and validation mechanisms
Solution Approach 1:
The VMM inserts cryptographic tokens into physical pages during page allocation or before mapping, performing the security preparation in advance. This preliminary action ensures that when page mappings occur, the cryptographic validation is already in place, preventing remapping attacks without requiring complex real-time validation logic during every mapping operation.
Solution Approach 2:
Cryptographic tokens act as intermediaries between the VMM and the page walk processor. These tokens contain embedded cryptographic credentials that mediate the trust relationship, allowing the page walk processor to validate mappings independently without requiring constant VMM intervention, thus reducing the complexity of the overall validation mechanism.
2Reliability
If token validation is performed for each mapping operation, then security is improved, but processing time increases
Solution Approach 1:
The cryptographic validation logic is extracted from the main page mapping path and implemented as a separate, optimized validation routine in the page walk processor. This extraction allows the validation to be performed efficiently in hardware or dedicated logic, minimizing the time penalty compared to general-purpose software validation.
Solution Approach 2:
The VMM maintains copies of cryptographic keys and token validation state in accessible memory locations that the page walk processor can quickly reference. By pre-positioning these validation resources, the system avoids time-consuming key retrieval and validation setup during each mapping operation.
3Reliability
If cryptographic keys are secured for VMM and page walk processor access, then security is improved, but ease of operation decreases due to key management requirements
Solution Approach 1:
The VMM and page walk processor share a common cryptographic key management mechanism, where the VMM distributes necessary key materials to the page walk processor through secure channels. This merging of key management responsibilities reduces the operational burden compared to completely separate key management systems while maintaining security boundaries.
Solution Approach 2:
The page walk processor is designed to autonomously validate cryptographic tokens using keys it receives from the VMM, without requiring manual key management or frequent VMM intervention. This self-service capability simplifies operations by making the security mechanism automatic and hands-off after initial setup.
Data Source
AI summary
Generally, this disclosure provides systems, devices, methods and computer readable media for secure memory page mapping in a virtual machine (VM) environment. The system may include a processor configured to execute a virtual machine monitor (VMM). The VMM may be configured to maintain a table of cryptographic keys and associate a token with one of the memory pages to be mapped from a guest linear address (GLA) to a guest physical address (GPA). The token may include a key identifier (key ID) associated with one of the cryptographic keys, and an authentication code based on the GLA, the GPA, and one of the cryptographic keys. The system may also include a page walk processor configured to validate the token to indicate that the memory page associated with the token is authorized to be mapped from the GLA to the GPA.