초록 ▼

Methods, apparatuses, articles, and systems for comparing a first security domain of a first memory page of a physical device to a second security domain of a second memory page of the physical device, the security domains being stored in one or more registers of a processor of the physical device,

Methods, apparatuses, articles, and systems for comparing a first security domain of a first memory page of a physical device to a second security domain of a second memory page of the physical device, the security domains being stored in one or more registers of a processor of the physical device, are described herein. Based on the comparison, the processor disallows an instruction from the first memory page to access the second memory page if the first security domain is different from the second security domain. Resultantly, software agents, in particular, critical software agents, may be protected in a virtual technology (VT) environment more efficiently and effectively.

대표청구항 ▼

What is claimed is: 1. A method comprising:assigning by a virtual machine manager disposed in a memory of a computing device and operated by a processor of the computing device, a first security domain to a first memory page of the memory of the computing device, and a second security domain to a se

What is claimed is: 1. A method comprising:assigning by a virtual machine manager disposed in a memory of a computing device and operated by a processor of the computing device, a first security domain to a first memory page of the memory of the computing device, and a second security domain to a second memory page of the memory of the computing device, wherein the virtual machine manager manages a plurality of virtual machines disposed in the memory and operated by the processor, wherein the virtual machines include a plurality of programs, and the processor is enhanced with a previous security domain register and a current security domain register;storing by the virtual machine manager information indicative of the first security domain in a first extended page table entry structure that references the first memory page, and information indicative of the second security domain in a second extended page table entry structure that references the second memory page, the first and second extended page table entry structures being part of a page table structure managed by and disposed within the virtual machine manager;copying by the processor, the information indicative of the first security domain and the information indicative of the second security domain to the previous security domain register and the current security domain register, respectively, if an instruction residing in the first memory page attempts to reference or access the second memory page, wherein the instruction belongs to one of the plurality of programs of the plurality of virtual machines;comparing by the processor, using the previous security domain register and the current security domain register, the first and second security domains of the first and second memory pages; anddetermining by the processor, whether to allow or to disallow the instruction from the first memory page to reference or access the second memory page based at least in part on said comparing.