Memory Isolation and Privilege Restriction-Based Virtual Machine Protection Method

Data in multi-tenant cloud environments is increasingly shared across organizations, making strong in-memory isolation a critical requirement. Existing confidential computing mechanisms such as AMD SEV provide hardware-enforced protection, but they require specialized processors and incur non-trivial performance overhead, which limits their deployment in heterogeneous clouds. This paper presents DASPRI, a software-based approach that constructs an isolated execution environment for trusted virtual machines by combining dual address spaces with privilege restriction. DASPRI partitions physical memory into a normal region and an isolated region on NUMA systems, and steers all memory allocations of trusted VMs into the isolated region by monitoring page faults and kernel allocation paths. It further hardens the isolated region by mediating direct and dynamic kernel mappings and by maintaining separate page caches for trusted and normal VMs. Remote attestation is integrated to protect the integrity of metadata used to identify trusted VMs. We implement DASPRI on a HUAWEI Kunpeng AArch64 server running OpenEuler and evaluate it using microbenchmarks and UnixBench. Experimental results show that DASPRI enforces strong memory isolation with less than 5% overhead on basic system operations and only 1.3% degradation in overall host performance.