Protecting guest virtual machine memory
AssigneeSafeNet, Inc.
InventorLaszlo Elteto
Life of this patent
Estimating the term…
Abstract
A hypervisor runs on a host computer system and defines at least one virtual machine. An address space of the virtual machine resides on physical memory of the host computer system under control of the hypervisor. A guest operating system runs in the virtual machine. At least one of a host operating system and the hypervisor sets parts of the address space of the host computer system corresponding to parts of the address space of the virtual machine to a locked state in which those parts can be read but not written to.
Claims17
A host computer system comprising a processor and program code operative on said processor, said program code comprising program code of:
- a hypervisor defining at least one virtual machine, wherein an address space of said at least one virtual machine resides on physical memory of said host computer system under control of said hypervisor;
- and
- a guest operating system of said at least one virtual machine;
- wherein at least one of said hypervisor and a host operating system of said host computer system is operative to set parts of an address space of said host computer system corresponding to part of the address space of said at least one virtual machine to a locked state in which said parts of the address space of said host computer system can be read but not written to;
- wherein said guest operating system comprises a component operative to signal to said hypervisor after other components of said guest operating system or of a program running under said guest operating system are loaded into working memory of said at least one virtual machine and before said other components start running, and wherein said hypervisor is responsive to said signaling to set to said locked state parts of the address space of said host computer system containing program code of said other components.
3-5. (canceled)
A method of protecting a computer system, comprising:
- running a hypervisor on said computer system, said hypervisor defining at least one virtual machine, wherein an address space of said at least one virtual machine resides on physical memory of said computer system under control of said hypervisor;
- running a guest operating system on said at least one virtual machine;
- and
- setting parts of an address space of said computer system corresponding to parts of the address space of said at least one virtual machine to a locked state in which they can be read but not written to;
- further comprising said guest operating system signaling to said hypervisor after other components of said guest operating system or of a program running under said guest operating system are loaded into working memory of said at least one virtual machine and before said other components start running, and said hypervisor in response to said signaling setting to said locked state parts of the address space of said computer system containing program code of said other components.
(canceled)
A non-transitory storage medium containing computer program code operative, when run on an appropriate computer having a hypervisor in a host operating system and defining at least one virtual machine, wherein an address space of said at least one virtual machine resides on physical memory of said computer under control of said hypervisor and a guest operating system of said at least one virtual machine, to cause at least one of said host operating system and said hypervisor to set parts of an address space of said computer corresponding to parts of the address space of said at least one virtual machine to a locked state in which said parts can be read but not written to;
- code operative to signal from said guest operating system to said hypervisor after other components of said guest operating system or of a program running under said guest operating system are loaded into working memory of said at least one virtual machine and before said other components start running;
- and
- code operative to cause said hypervisor in response to said signaling to set to said locked state parts of the address space of said computer containing program code of said other components.
17-18. (canceled)
Dependencies are inferred from the claim text.