KR102257320B1 - 하이퍼바이저 및 가상 머신 간 메모리 페이지 이행의 모니터링 - Google Patents

하이퍼바이저 및 가상 머신 간 메모리 페이지 이행의 모니터링 Download PDF

Info

Publication number
KR102257320B1
KR102257320B1 KR1020197026855A KR20197026855A KR102257320B1 KR 102257320 B1 KR102257320 B1 KR 102257320B1 KR 1020197026855 A KR1020197026855 A KR 1020197026855A KR 20197026855 A KR20197026855 A KR 20197026855A KR 102257320 B1 KR102257320 B1 KR 102257320B1
Authority
KR
South Korea
Prior art keywords
memory
hypervisor
virtual machine
memory page
subset
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
KR1020197026855A
Other languages
English (en)
Korean (ko)
Other versions
KR20190125985A (ko
Inventor
데이비드 카플란
제레미 더블유. 포웰
리차드 렐프
Original Assignee
어드밴스드 마이크로 디바이시즈, 인코포레이티드
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 어드밴스드 마이크로 디바이시즈, 인코포레이티드 filed Critical 어드밴스드 마이크로 디바이시즈, 인코포레이티드
Publication of KR20190125985A publication Critical patent/KR20190125985A/ko
Application granted granted Critical
Publication of KR102257320B1 publication Critical patent/KR102257320B1/ko
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/4557—Distribution of virtual machine instances; Migration and load balancing
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45583—Memory management, e.g. access or allocation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
KR1020197026855A 2017-03-29 2017-08-24 하이퍼바이저 및 가상 머신 간 메모리 페이지 이행의 모니터링 Active KR102257320B1 (ko)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US201762478148P 2017-03-29 2017-03-29
US62/478,148 2017-03-29
PCT/US2017/048471 WO2018182772A1 (en) 2017-03-29 2017-08-24 Monitoring of memory page transitions between a hypervisor and a virtual machine

Publications (2)

Publication Number Publication Date
KR20190125985A KR20190125985A (ko) 2019-11-07
KR102257320B1 true KR102257320B1 (ko) 2021-05-27

Family

ID=63669410

Family Applications (1)

Application Number Title Priority Date Filing Date
KR1020197026855A Active KR102257320B1 (ko) 2017-03-29 2017-08-24 하이퍼바이저 및 가상 머신 간 메모리 페이지 이행의 모니터링

Country Status (6)

Country Link
US (1) US10671422B2 (enExample)
EP (1) EP3602376B1 (enExample)
JP (1) JP6804665B2 (enExample)
KR (1) KR102257320B1 (enExample)
CN (1) CN110447032B (enExample)
WO (1) WO2018182772A1 (enExample)

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10579439B2 (en) * 2017-08-29 2020-03-03 Red Hat, Inc. Batched storage hinting with fast guest storage allocation
US10686605B2 (en) * 2017-09-29 2020-06-16 Intel Corporation Technologies for implementing mutually distrusting domains
US11126553B2 (en) * 2019-01-31 2021-09-21 EMC IP Holding Company LLC Dynamic allocation of memory between containers
US11283800B2 (en) * 2019-03-08 2022-03-22 International Business Machines Corporation Secure interface control secure storage hardware tagging
US11068310B2 (en) 2019-03-08 2021-07-20 International Business Machines Corporation Secure storage query and donation
US11206128B2 (en) 2019-03-08 2021-12-21 International Business Machines Corporation Secure paging with page change detection
US11176054B2 (en) 2019-03-08 2021-11-16 International Business Machines Corporation Host virtual address space for secure interface control storage
US11182192B2 (en) 2019-03-08 2021-11-23 International Business Machines Corporation Controlling access to secure storage of a virtual machine
US11347869B2 (en) * 2019-03-08 2022-05-31 International Business Machines Corporation Secure interface control high-level page management
US11455398B2 (en) 2019-03-08 2022-09-27 International Business Machines Corporation Testing storage protection hardware in a secure virtual machine environment
US11403409B2 (en) 2019-03-08 2022-08-02 International Business Machines Corporation Program interruptions for page importing/exporting
US11061711B2 (en) 2019-09-23 2021-07-13 Red Hat, Inc. Storage deduplication for virtual machines with encrypted storage
US11656891B2 (en) 2019-09-27 2023-05-23 Red Hat, Inc. Copy-on-write for virtual machines with encrypted storage
US11232030B2 (en) 2019-09-27 2022-01-25 Red Hat Inc. Storage deduplication for virtual machines with encrypted storage
US11436141B2 (en) 2019-12-13 2022-09-06 Red Hat, Inc. Free memory page hinting by virtual machines
US11494219B2 (en) * 2020-02-26 2022-11-08 Red Hat, Inc. Encryption and remote attestation of containers
US11620149B2 (en) * 2020-06-25 2023-04-04 Red Hat, Inc. Safe entropy source for encrypted virtual machines
US11782744B2 (en) * 2020-10-08 2023-10-10 Nxp B.V. Data processing system and method for accessing data in the data processing system
CN113688407A (zh) * 2021-07-30 2021-11-23 山东云海国创云计算装备产业创新中心有限公司 一种数据管理方法及相关装置
US12353902B2 (en) * 2022-04-08 2025-07-08 Microsoft Technology Licensing, Llc Confidential compute architecture integrated with direct swap caching

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150199209A1 (en) 2014-01-13 2015-07-16 Red Hat Israel, Ltd. Hypervisor-Based Balloon Page Initialization
US20160232020A1 (en) 2015-02-10 2016-08-11 Red Hat Israel, Ltd. Providing mode-dependent virtual machine function code
US20170004001A1 (en) 2015-07-01 2017-01-05 International Business Machines Corporation Protected guests in a hypervisor controlled system

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9135038B1 (en) 2010-05-28 2015-09-15 Bromium, Inc. Mapping free memory pages maintained by a guest operating system to a shared zero page within a machine frame
US8631212B2 (en) * 2011-09-25 2014-01-14 Advanced Micro Devices, Inc. Input/output memory management unit with protection mode for preventing memory access by I/O devices
US9940228B2 (en) * 2012-06-14 2018-04-10 Vmware, Inc. Proactive memory reclamation for java virtual machines
CN103257929B (zh) * 2013-04-18 2016-03-16 中国科学院计算技术研究所 一种虚拟机内存映射方法及系统
US9507727B2 (en) * 2013-07-17 2016-11-29 Bitdefender IPR Management Ltd. Page fault injection in virtual machines
US9792448B2 (en) * 2014-02-28 2017-10-17 Advanced Micro Devices, Inc. Cryptographic protection of information in a processing system
WO2015132753A1 (en) * 2014-03-07 2015-09-11 Eco4Cloud S.R.L. Method for memory management in virtual machines, and corresponding system and computer program product
KR102584506B1 (ko) * 2015-06-24 2023-10-04 어드밴스드 마이크로 디바이시즈, 인코포레이티드 가상 기계들을 위한 상태 정보 보호
US9536088B1 (en) * 2015-11-09 2017-01-03 AO Kaspersky Lab System and method for protection of memory in a hypervisor
US20170357592A1 (en) * 2016-06-09 2017-12-14 Vmware, Inc. Enhanced-security page sharing in a virtualized computer system

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150199209A1 (en) 2014-01-13 2015-07-16 Red Hat Israel, Ltd. Hypervisor-Based Balloon Page Initialization
US20160232020A1 (en) 2015-02-10 2016-08-11 Red Hat Israel, Ltd. Providing mode-dependent virtual machine function code
US20170004001A1 (en) 2015-07-01 2017-01-05 International Business Machines Corporation Protected guests in a hypervisor controlled system

Also Published As

Publication number Publication date
EP3602376A1 (en) 2020-02-05
KR20190125985A (ko) 2019-11-07
EP3602376A4 (en) 2021-01-06
CN110447032B (zh) 2024-04-16
JP6804665B2 (ja) 2020-12-23
JP2020515969A (ja) 2020-05-28
CN110447032A (zh) 2019-11-12
US20180285140A1 (en) 2018-10-04
US10671422B2 (en) 2020-06-02
EP3602376B1 (en) 2022-03-30
WO2018182772A1 (en) 2018-10-04

Similar Documents

Publication Publication Date Title
KR102257320B1 (ko) 하이퍼바이저 및 가상 머신 간 메모리 페이지 이행의 모니터링
KR102107711B1 (ko) 처리 시스템에서의 직접 메모리 액세스 인가
US11088846B2 (en) Key rotating trees with split counters for efficient hardware replay protection
US10372628B2 (en) Cross-domain security in cryptographically partitioned cloud
US8689212B2 (en) Information processing device for controlling an application able to access a predetermined device, and control method using an information processing device for controlling an application able to access a predetermined device
CN106062768B (zh) 处理系统中信息的密码保护
US10536274B2 (en) Cryptographic protection for trusted operating systems
WO2017164930A1 (en) Key management for secure memory address spaces
KR101323858B1 (ko) 가상화 시스템에서 메모리 접근을 제어하는 장치 및 방법
US10938559B2 (en) Security key identifier remapping
CN107729758B (zh) 用于多租户云工作量的安全处理器
US20170270058A1 (en) Maintaining a secure processing environment across power cycles
CN111566650A (zh) 管理加密系统中的密码术密钥集合
CN106716435B (zh) 设备与安全处理环境之间的接口
EP2889794B1 (en) Offloading functionality from a secure processing environment
JP6672341B2 (ja) 仮想マシンの状態情報の保護

Legal Events

Date Code Title Description
PA0105 International application

Patent event date: 20190911

Patent event code: PA01051R01D

Comment text: International Patent Application

PG1501 Laying open of application
PA0201 Request for examination

Patent event code: PA02012R01D

Patent event date: 20200820

Comment text: Request for Examination of Application

PA0302 Request for accelerated examination

Patent event date: 20200820

Patent event code: PA03022R01D

Comment text: Request for Accelerated Examination

E902 Notification of reason for refusal
PE0902 Notice of grounds for rejection

Comment text: Notification of reason for refusal

Patent event date: 20201127

Patent event code: PE09021S01D

E701 Decision to grant or registration of patent right
PE0701 Decision of registration

Patent event code: PE07011S01D

Comment text: Decision to Grant Registration

Patent event date: 20210303

PR0701 Registration of establishment

Comment text: Registration of Establishment

Patent event date: 20210521

Patent event code: PR07011E01D

PR1002 Payment of registration fee

Payment date: 20210524

End annual number: 3

Start annual number: 1

PG1601 Publication of registration
PR1001 Payment of annual fee

Payment date: 20240521

Start annual number: 4

End annual number: 4