Virtual Machine Translator for Rule Infused Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualization technologies increase security risks due to lack of effective isolation between virtual machines and limited hardware support for complex rule enforcement, leading to performance issues when enforcing complex execution policies.
Innovation Solution
A virtual machine with a translator that receives program code and rules to create 'rule infused machine code' by inserting instructions, allowing for enforcement of complex policies without significant performance impact, using a private memory area and optimized execution to manage rules dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware traps are used to enforce simple isolation rules, then security isolation between VMs is improved, but performance deteriorates significantly due to trapping every instruction
Solution Approach 1:
The patent replaces the mechanical hardware trap system with a software-based rule enforcement mechanism. Instead of using CPU hardware traps that slow down execution, the system uses a translator to insert software rules into the machine code that enforce security policies without requiring hardware intervention for every instruction.
Solution Approach 2:
The patent changes the enforcement mechanism from hardware-based trapping to software-based rule insertion. The translator modifies the machine code parameters by inserting rule instructions that check security conditions at appropriate points in the execution flow, rather than trapping every instruction through hardware.
2Reliability
If complex rules are enforced using hardware traps on each memory location, then policy compliance is improved, but performance deteriorates due to excessive triggering and instruction trapping
Solution Approach 1:
The patent segments complex policies into individual rule elements that can be independently inserted into the machine code. Each rule element handles a specific aspect of policy enforcement, allowing the system to enforce complex rules without trapping every instruction related to those rules.
Solution Approach 2:
The translator performs preliminary action by inserting rule instructions into the machine code during the translation phase, before execution. This allows the rules to be enforced as part of the normal execution flow without requiring dynamic trapping or interruption during runtime.
3Adaptability or versatility
If the VMM scans and replaces insufficiently handled functions, then virtualization support is improved, but device complexity and processing overhead increase
Solution Approach 1:
The translator serves multiple functions: it translates machine code, inserts security rules, and enforces policies all in one pass. This multi-functionality reduces the need for separate VMM scanning and replacement operations, simplifying the overall system architecture.
4Reliability
If service providers supervise client code execution, then security and trust are improved, but system complexity and processing overhead increase
Solution Approach 1:
The translator acts as an intermediary between the service provider's security requirements and the client's code execution. It inserts rule instructions that embody security policies directly into the machine code, allowing supervision without requiring a complex runtime monitoring system.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An arrangement in a virtual machine for virtual machine supervision is provided. The arrangement comprises a translator (1) operable in the virtual machine (10). The translator (1) comprises a receiving unit (2) adapted to receive program code to be executed on the virtual machine (10) and a rule referring to the execution of the program code. The arrangement further comprises a code unit (3) adapted to create rule infused machine code based on the program code and the rule, such that the rule is enforced when the machine code is executed on the virtual machine (10).