US 10,095,538 B2Granted

Systems and methods involving features of hardware virtualization, hypervisor, pages of interest, and/or other features

AssigneeLynx Software Technologies, Inc.

InventorsEdward T. Mooring, Phillip Yankovsky

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems, methods, computer readable media and articles of manufacture consistent with innovations herein are directed to computer virtualization, computer security and/or memory access. According to some illustrative implementations, innovations herein may utilize and/or involve a separation kernel hypervisor which may include the use of a guest operating system virtual machine protection domain, a virtualization assistance layer, and/or a detection mechanism (which may be proximate in temporal and/or spatial locality to malicious code, but isolated from it), inter alia, for detection and/or notification of, and action by a monitoring guest upon access by a monitored guest to predetermined physical memory locations.

Claims41

Dependent claims

A method for processing information securely, the method comprising:

partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains;
isolating the domains in time and space from each other;
providing a list of memory locations of an authorized guest to another guest;
providing a message of the authorized guest to the another guest;
providing a virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the guest operating system virtual machine protection domains such that the VAL is not directly accessible by the authorized guest;
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping the previously unmapped page;
sending a notification of memory access and associated context information to a requesting guest, wherein the virtual machine comprises a virtual motherboard including a virtual CPU and memory by the VAL;
allowing the virtual machine to execute a single instruction;
returning control to the VAL;
mapping the page as inaccessible again;
and
returning control to the virtual machine.

11 more elements

A method for processing information securely, the method comprising:

partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains;
isolating the domains in time and space from each other;
providing a list of memory locations of an authorized guest to another guest;
providing a message of the authorized guest to the another guest;
providing a virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the guest operating system virtual machine protection domains such that the VAL is not directly accessible by the authorized guest;
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping the previously unmapped page;
sending a notification of memory access and associated context information to a requesting guest, wherein the virtual machine comprises a virtual motherboard including a virtual CPU and memory by the VAL;
allowing the virtual machine to execute a single instruction;
returning control to the VAL;
mapping the page as inaccessible again;
returning control to the virtual machine;
and
configuring a memory management unit such that software in the virtual machine cannot undo the mapping.

12 more elements

A method for processing information securely, the method comprising:

partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains;
isolating the domains in time and space from each other;
providing a list of memory locations of an authorized guest to another guest;
providing a message of the authorized guest to the another guest;
providing a virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the guest operating system virtual machine protection domains such that the VAL is not directly accessible by the authorized guest;
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping the previously unmapped page;
and
sending a notification of memory access and associated context information to a requesting guest;
wherein the virtual machine comprises a virtual motherboard including a virtual CPU and memory by the VAL.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/207,252Filed 11 Jul 2016 · continuation
Priority: 15 May 2014
Published: US 2017/0068560 A19 Mar 2017
Granted: 9 Oct 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification17 codes

G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
G06F 9/455
Arrangements for executing specific programs: emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or…
G06F 9/45545
Hypervisors; Virtual machine monitors: guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
G06F 9/50
Multiprogramming arrangements: allocation of resources, e.g. of the central processing unit [CPU]

Family

Application61/993,290Us provisional application · filed 15 May 2014
Application61/993,296Us provisional application · filed 15 May 2014
Application14/714,125Parent of this continuation · filed 15 May 2015
Application14/714,241Parent of this continuation · filed 15 May 2015
Application14/955,018Parent of this continuation-in-part · filed 30 Nov 2015
US 2017/0068560 A1Pre-grant publication · published 9 Mar 2017
US 9,390,267 B2Parent of this continuation
US 9,648,045 B2Parent of this continuation-in-part
Application14/714,125Parent of this continuation-in-part
US 9,203,855 B1Parent of this continuation
Application14/955,018Parent of this continuation
US 2015/0334126 A1Published application
US 2015/0371042 A1Published application
US 2016/0156665 A1Published application
US 10,095,538 B2This patent

From the US filing history. Foreign family members aren’t listed.