Virtual computer system having a first virtual computer that executes a protected process, a second virtual computer that executes an unprotected process, and a hypervisor that controls the first and second virtual computers

摘要

When a process judging unit judges that a target process is a protected process, a key judging unit judges whether a target key that is a key generated by a key generating unit is a first key or a second key. When the key judging unit judges that the target key is the first key, a VM communication managing unit notifies the target process of a memory ID of a protected memory region corresponding to the first key. When the process judging unit judges that the target process is an unprotected process, a key transforming unit transforms the target key from the first key to the second key based on the key transformation rule. An HV communication managing unit notifies the target process of a memory ID of an unprotected memory region corresponding to the second key.

主权项

1. A virtual computer system comprising a processor, a first virtual computer that executes a protected process using the processor, a second virtual computer that executes an unprotected process, and a hypervisor that controls the first and second virtual computers, wherein
the first and second virtual computers have: a key generating unit which generates a second key that has been transformed from a first key according to a predetermined key transformation rule when a communication request is issued by the protected process that communicates with the unprotected process and which generates the first key when a communication request is issued by another process; a process judging unit which judges whether a target process that is a process having issued the communication request is the protected process or the unprotected process; a key judging unit which judges whether a target key that is a key generated by the key generating unit is the first key or the second key when the process judging unit judges that the target process is the protected process; and a virtual machine communication managing unit which notifies the target process of a memory identification of a protected memory region corresponding to the first key when the key judging unit judges that the target key is the first key, the hypervisor comprises: a hypervisor communication managing unit which notifies the target process of a memory identification of an unprotected memory region corresponding to the second key when the key judging unit judges that the target key is the second key, the first and second virtual computers further comprise: a key transforming unit which transforms the target key from the first key to the second key based on the key transformation rule when the process judging unit judges that the target process is the unprotected process, and the hypervisor communication managing unit notifies the target process of a memory identification of an unprotected memory region corresponding to the second key transformed by the key transforming unit.