System, method and computer program product for inviting other virtual machine to access a memory space allocated to a virtual machine

A computer program product comprising a non-transitory computer usable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to implement:

• a mapping module which stores credentials and corresponding unique identifiers of virtual machines, and is configured to receive a cryptographically signed credential, to store the credential and to forward a mapping of the credential to an other virtual machine, and to receive an access request from the other virtual machine, to add a corresponding cryptographically signed credential to the access request and to forward the request;
• and
• an intermediate module configured to:
• receive a request from a virtual machine to generate for a other virtual machine a memory credential associated with a certain memory space allocated to the virtual machine, the request indicating an address range of the certain memory space;
• generate, in response to access permissions defined by the virtual machine included in the request, a cryptographically signed credential;
• send the cryptographically signed credential to the mapping module for the other virtual machine;
• receive from the mapping module for the other virtual machine an access request to access at least one memory entry within the certain memory space, the access request including both indication of a memory entry address in the certain memory space and the cryptographically signed credential;
• and access the at least one memory entry, if the access request complies with the memory credential.

A system for accessing a memory space allocated to a virtual machine, the system is adapted to host the virtual machine;

• the system comprises:
• a memory unit;
• a mapping module which stores credentials and corresponding unique identifiers of virtual machines, and is configured to receive a cryptographically signed credential, to store the credential and to forward a mapping of the credential to an other virtual machine, and to receive an access request from the other virtual machine, to add a corresponding cryptographically signed credential to the access request and to forward the request;
• and
• an intermediate entity, comprising:
• a direct memory access controller;
• and
• a cryptography module;
• wherein the intermediate entity is adapted to:
• receive a request from the virtual machine to generate, for another virtual machine, a memory credential associated with a certain memory space allocated to the virtual machine;
• generate, in response to access permissions defined by the virtual machine included in the request, a cryptographically signed credential;
• send the cryptographically signed credential to the mapping module for the other virtual machine;
• receive from the mapping module for the other virtual machine an access request to access at least one memory entry within the certain memory space, the access request including both indication of a memory entry address in the certain memory space and the cryptographically signed credential;
• and
• access the at least one memory entry of the memory unit, if the access request complies with the memory credential.