Secure cross-process memory sharing
AssigneeVMware, Inc.
InventorsAdrian Drzewiecki, Christoph Klee, Mounesh Badiger
Life of this patent
Estimating the term…
Abstract
Techniques for enabling secure cross-process memory sharing are provided. In one set of embodiments, a first user process executing on a computer system can create a memory handle representing a memory space of the first user process. The first user process can further define one or more access restrictions with respect to the memory handle. The first user process can then transmit the memory handle to a second user process executing on the computer system, the memory handle enabling the second user process to access at least a portion of the first process' memory space, subject to the one or more access restrictions.
Claims21
A method for enabling secure cross-process memory sharing, the method comprising:
- creating, by a first user process executing on a computer system, a memory handle representing a memory space of the first user process;
- defining, by the first user process, one or more access restrictions with respect to the memory handle;
- transmitting, by the first user process, the memory handle to a second user process executing on the computer system, the memory handle enabling the second user process to access at least a portion of the first process' memory space through the memory handle, subject to the one or more access restrictions, without extending the memory address space of the first process or the memory space of the second process to include shared memory;
- transmitting, the by the first process, an input/output (I/O) request, directed to a storage volume;
- intercepting the I/O request by the second user process before the request reaches the storage volume;
- and
- performing, by the second user process, the I/O request on behalf of the first user process wherein the data that is associated with the I/O operation is transmitted through the memory handle directly between the storage volume and the first process' memory space.
A non-transitory computer readable storage medium having stored thereon program code executable by computer system, the program code embodying a method for enabling secure cross-process memory sharing, the method comprising:
- creating, by a first user process executing on the computer system, a memory handle representing a memory space of the first user process;
- defining, by the first user process, one or more access restrictions with respect to the memory handle;
- and
- transmitting, by the first user process, the memory handle to a second user process executing on the computer system, the memory handle enabling the second user process to access at least a portion of the first process' memory space through the memory handle, subject to the one or more access restrictions, without extending the memory address space of the first process or the memory space of the second process to include shared memory;
- transmitting, the by the first process, an input/output (I/O) request, directed to a storage volume;
- intercepting the I/O request by the second user process before the request reaches the storage volume;
- and
- performing, by the second user process, the I/O request on behalf of the first user process wherein the data that is associated with the I/O operation is transmitted through the memory handle directly between the storage volume and the first process' memory space.
A computer system comprising:
- a processor;
- and
- first and second user processes running on the processor,
- wherein the first and second user processes are configured to:
- create a memory handle representing a memory space of the first user process;
- define one or more access restrictions with respect to the memory handle;
- transmit the memory handle to the second user process, the memory handle enabling the second user process to access at least a portion of the first process' space through the memory handle, subject to the one or more access restrictions, without extending the memory address space of the first process or the memory space of the second process to include shared memory
- transmit, the by the first process, an input/output (I/O) request, directed to a storage volume;
- intercept the I/O request by the second user process before the request reaches the storage volume;
- and
- perform, by the second user process, the I/O request on behalf of the first user process wherein the data that is associated with the I/O operation is transmitted through the memory handle directly between the storage volume and the first process' memory space.
Dependencies are inferred from the claim text.