Dynamic Partitioning of Physical Memory Among Virtual Machines, ASMI:Architectural Support for Memory Isolation

摘要

Cloud computing relies on secure and efficient virtualization. Software levelsecurity solutions compromise the performance of virtual machines (VMs), as alarge amount of computational power would be utilized for running the securitymodules. Moreover, software solutions are only as secure as the level that theywork on. For example a security module on a hypervisor cannot provide securityin the presence of an infected hypervisor. It is a challenge for virtualizationtechnology architects to enhance the security of VMs without degrading theirperformance. Currently available server machines are not fully equipped tosupport a secure VM environment without compromising on performance. A fewhardware modifications have been introduced by manufactures like Intel and AMDto provide a secure VM environment with low performance degradation. In thispaper we propose a novel memory architecture model named \textit{ ArchitecturalSupport for Memory Isolation(ASMI)}, that can achieve a true isolated physicalmemory region to each VM without degrading performance. Along with true memoryisolation, ASMI is designed to provide lower memory access times, betterutilization of available memory, support for DMA isolation and support forplatform independence for users of VMs.