Virtualized Process Isolation via vShim Layer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualization environments, the hypervisor has complete access to guest memory, posing security risks as it can compromise user data if flawed, and there is a need to restrict its access to prevent unauthorized memory access.
Innovation Solution
Implementing a virtual shim (vShim) layer that intercepts kernel requests to user space, encrypts data, and uses permission checks to prevent unauthorized access, maintaining separate page tables to map guest virtual addresses to physical addresses and ensuring only trusted code is executed by verifying hash values against a whitelist.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the hypervisor has complete access to guest memory for virtualization control, then virtualization functionality is achieved, but security risks increase as the hypervisor can compromise user data
Solution Approach 1:
The patent introduces a virtual shim layer as an intermediary between the hypervisor and user processes. This shim layer intercepts memory access requests from the hypervisor to guest virtual memory, translating them into requests for host physical memory. The shim layer maintains separate page tables and permission checks, allowing it to filter and control what the hypervisor can access, thus protecting user data while maintaining virtualization functionality.
2Ease of operation
If the kernel has full access to process memory for resource management, then resource management capability is improved, but security decreases as malicious users can access other processes' memory through kernel compromise
Solution Approach 1:
The patent segments the memory address space into distinct regions: guest virtual memory, guest physical memory, and host physical memory. It introduces separate page tables for each segment and implements a virtual shim layer that enforces access permissions between segments. This segmentation allows the kernel to manage resources while preventing unauthorized cross-process memory access through structured memory isolation.
3Object-affected harmful factors
If a virtual shim layer is introduced to intercept kernel requests and enhance security, then security is improved, but device complexity increases
Solution Approach 1:
The virtual shim layer is designed to perform multiple functions within a single component: it intercepts memory access requests, translates virtual addresses to physical addresses, enforces permission checks, and manages page table mappings. By consolidating these functions in one layer, the patent enhances security without proportionally increasing system complexity compared to having separate components for each function.
Data Source
AI summary
Systems, apparatuses, and methods for implementing virtualized process isolation are disclosed. A system includes a kernel and multiple guest virtual machines (VMs) executing on the system's processing hardware. Each guest VM includes a vShim layer for managing kernel accesses to user space and guest accesses to kernel space. The vShim layer also maintains a set of page tables separate from the kernel page tables. In one embodiment, data in the user space is encrypted and the kernel goes through the vShim layer to access user space data. When the kernel attempts to access a user space address, the kernel exits and the vShim layer is launched to process the request. If the kernel has permission to access the user space address, the vShim layer copies the data to a region in kernel space and then returns execution to the kernel. The vShim layer prevents the kernel from accessing the user space address if the kernel does not have permission to access the user space address. In one embodiment, the kernel space is unencrypted and the user space is encrypted. A state of a guest VM and the vShim layer may be stored in virtual machine control blocks (VMCBs) when exiting the guest VM or vShim layer.