# US 8,788,763 B2 · Protecting memory of a virtual guest

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,788,763 B2
- Document ID: US8788763B2
- Status: Granted
- Kind: B2
- Application number: 13/482,782
- Filed: 2012-05-29
- Published: 2013-04-18
- Granted: 2014-07-22
- Earliest claimed: 2011-10-13
- Assignees: International Business Machines Corporation
- Applicants: Christopher J. Arges; Nathan D. Fontenot; Ryan P. Grimm; Joel H. Schopp; Michael T. Strosaker
- Inventors: Christopher J. Arges; Nathan D. Fontenot; Ryan P. Grimm; Joel H. Schopp; Michael T. Strosaker
- Web page: https://patentgrep.com/patent/US8788763B2

## CPC

- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 9/468: {Specific access rights for resources, e.g. using capability register}
- G06F 12/14: Protection against unauthorised use of memory {or access to memory}
- G06F 12/1433: {for a module or a part of a module}
- G06F 12/1458: {by checking the subject access rights}
- G06F 12/1491: {in a hierarchical protection system, e.g. privilege levels, memory rings}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06F 21/6281: {at program execution time, where the protection is within the operating system}
- G06F 2009/45583: {Memory management, e.g. access or allocation}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2212/151: Emulated environment, e.g. virtual machine
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F 2221/2149: Restricted operating environment
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An apparatus and system for protecting memory of a virtual guest includes initializing a virtual guest on a host computing system. The host computing system includes a virtual machine manager that manages operation of the virtual guest. The virtual guest includes a distinct operating environment executing in a virtual operation platform provided by the virtual machine manager. The method includes receiving an allocation of run-time memory for the virtual guest, the allocation of run-time memory comprising a portion of run-time memory of the host computing system. The method includes setting, by the virtual guest, at least a portion of the allocation of run-time memory to be inaccessible by the virtual machine manager.

## Claims

### Claim 1

An apparatus comprising:
an initialization module that initializes a virtual guest on a host computing system, the host computing system comprising a virtual machine manager, the virtual machine manager managing operation of the virtual guest, the virtual guest comprising a distinct operating environment executing in a virtual operation platform provided by the virtual machine manager;
a receiving module that receives an allocation of run-time memory for the virtual guest, the allocation of run-time memory comprising a portion of run-time memory of the host computing system; and
a protection module that sets, by the virtual guest, at least a portion of the allocation of run-time memory to be inaccessible by the virtual machine manager,
wherein the initiation module, the receiving module, and the protection module comprise one or more of hardware and executable code, the executable code stored on one or more computer readable storage media.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the protection module further establishes a shared memory portion for access by the virtual machine manager, the shared memory portion comprising a portion of the allocation of run-time memory of the virtual guest.

### Claim 3 (depends on 1)

The apparatus of claim 1, further comprising a verification module that verifies that the virtual guest is in direct communication with a processor of the host computing system independent of the virtual machine manager.

### Claim 4 (depends on 1)

The apparatus of claim 1, further comprising:
a request receiving module that receives a request, from the virtual machine manager, to access at least a portion of the inaccessible run-time memory;
a determination module determining that the request meets one or more predetermined criteria; and
an access module that grants access of the at least a portion of the inaccessible run-time memory to the virtual machine manager in response to determining that the request meets the one or more predetermined criteria.

### Claim 5 (depends on 4)

The apparatus of claim 4, further comprising a destroying command module that calls a predetermined command to destroy the allocation of run-time memory for the virtual guest without the virtual machine manager accessing the allocation of run-time memory, the host computing system destroying the allocation of run-time memory in response to the destroying module calling the predetermined command.

### Claim 6

A system comprising:
a virtual machine manager that provides a virtual operation platform for a host computing system;
a processor;
a memory storing modules for execution by the processor, the memory comprising:
an initialization module that initializes a virtual guest on the host computing system, the host computing system comprising the virtual machine manager, the virtual machine manager managing operation of the virtual guest, the virtual guest comprising a distinct operating environment executing in the virtual operation platform provided by the virtual machine manager;
a receiving module that receives an allocation of run-time memory for the virtual guest, the allocation of run-time memory comprising a portion of run-time memory of the host computing system; and
a protection module that sets, by the virtual guest, at least a portion of the allocation of run-time memory to be inaccessible by the virtual machine manager.

### Claim 7 (depends on 6)

The system of claim 6, further comprising:
a detection module that detects that the virtual guest is unresponsive; and
a destroying command module that calls a predetermined command to destroy the allocation of run-time memory for the virtual guest, without the virtual machine manager accessing the allocation of run-time memory, in response to the detection module detecting that the virtual guest is unresponsive, the host computing system destroying the allocation of run-time memory in response to the destroying module calling the predetermined command.

### Claim 8 (depends on 6)

The system of claim 6, further comprising:
an association module that associates one or more virtual guest identifiers with a particular run-time memory page of the allocation of run-time memory, at least one of the virtual guest identifiers identifying the virtual guest; and
an access request module that grants an access request to the particular run-time memory page from a requester in response to the requester having a corresponding virtual guest identifier for the particular run-time memory page.

### Claim 9 (depends on 6)

The system of claim 6, further comprising:
a destroying module that receives a call, from the virtual machine manager, to a predetermined command to destroy the allocation of run-time memory for the virtual guest and destroys the allocation of run-time memory in response to receiving call to the predetermined command.