Transparent memory-mapped emulation of I/O calls

In a computer system comprising a virtual machine monitor (VMM) running on system hardware and supporting a virtual machine (VM) having a first application and a guest OS running therein, a method of accessing a first resource that comprises first encrypted resource data comprising:

• the first application issuing a first access request for access to the first resource;
• intercepting the first access request such that the guest OS does not receive the first access request;
• mapping the first resource to a first memory region;
• and
• the first application accessing unencrypted first resource data from the first memory region.

In a computer system comprising a virtual machine monitor (VMM) running on system hardware and supporting a virtual machine (VM) having a first application and a guest OS running therein, a method of the first application accessing a first file, wherein the first application accesses an unencrypted version of the first file, the method comprising:

• the first application issuing a first access request for access to the first file;
• intercepting the first access request such that the guest OS does not receive the first access request;
• mapping the first file to a first memory region;
• and
• the first application accessing the unencrypted version of the first file from the first memory region.

In a computer system comprising a virtual machine monitor (VMM) running on system hardware and supporting a virtual machine (VM) having a first application and a guest OS running therein, a method of accessing a first resource that comprises first encrypted resource data comprising:

• the first application issuing a first access request for access to the first resource;
• a first shim program intercepting the first access request, the first shim program running completely within the same VM as the first application and interfacing with the VMM using one or more hypercalls from the first shim program to the VMM;
• the first shim program mapping the first resource to a first memory region;
• and
• the first application accessing unencrypted first resource data from the first memory region using memory-mapped I/O.

In a computer system comprising a virtual machine monitor (VMM) running on system hardware and supporting a virtual machine (VM) having a first application and a guest OS running therein, a method of the first application accessing a first file, wherein the first application accesses an unencrypted version of the first file, the method comprising:

• the first application issuing a first access request for access to the first file;
• a first shim program intercepting the first access request, the first shim program running completely within the same VM as the first application and interfacing with the VMM using one or more hypercalls from the first shim program to the VMM;
• the first shim program mapping the first file to a first memory region;
• and
• the first application accessing the unencrypted version of the first file from the first memory region using memory-mapped I/O.

In a computer system comprising a virtual machine monitor (VMM) running on system hardware and supporting a virtual machine (VM) having a first cloaked application and a guest OS running therein, a method of processing file I/O operations for cloaked files, the method comprising:

• a first shim program intercepting cloaked file I/O calls from the first cloaked application, the first shim program running completely within the same VM as the first cloaked application and interfacing with the VMM using one or more hypercalls from the first shim program to the VMM;
• the first shim program emulating file I/O semantics of any intercepted cloaked file I/O call by mapping the cloaked file to a first memory region;
• and
• the first application accessing an unencrypted version of the cloaked file from the first memory region using memory-mapped I/O.

In a computer system comprising a virtual machine monitor (VMM) running on system hardware and supporting a virtual machine (VM) having a first application and a guest OS running therein, a method of processing file I/O operations for files, the method comprising:

• a first shim program intercepting file I/O calls from the first application, the first shim program running completely within the same VM as the first application and interfacing with the VMM using one or more hypercalls from the first shim program to the VMM;
• the first shim program emulating file I/O semantics of any intercepted file I/O call by mapping a target file, to which the intercepted file I/O call was directed, to a first memory region;
• and
• the first application accessing a version of the target file from the first memory region using memory-mapped I/O.

In a computer system comprising a virtual machine monitor (VMM) running on system hardware and supporting a virtual machine (VM) having a first cloaked application and a guest OS running therein, a method of processing I/O operations directed toward a cloaked file, wherein the guest OS only has access to an encrypted view of the cloaked file and the first cloaked application has access to an unencrypted view of the cloaked file, the method comprising:

• providing a unique identifier for the cloaked file;
• providing a metadata object for the cloaked file in a cache in the VMM, wherein the metadata object comprises metadata for decrypting and verifying integrity of the cloaked file;
• and
• providing a shim program to process an I/O call directed toward the cloaked file as a function of the metadata in the metadata object and the unique identifier,
• wherein the shim program maps the cloaked file to a first memory region when the I/O call is received from the first cloaked application and the first cloaked application accesses the unencrypted view of the cloaked file at the first memory region.