Patent ID: 8352694

Claim:
A system including a first layer element executed in a privileged mode having a first permission to access an entire region of a memory and second and third layer elements executed in an unprivileged mode having a second permission to access a partial region of the memory, the system comprising: the memory; and a processor which determines whether the memory is accessible for each page that is an address space unit in the memory, based on which mode a layer element currently accessing the memory is executed in between the privileged mode and the unprivileged mode, which provides the memory comprising a plurality of domains, a first domain among the plurality of domains being allocated to the first layer element, a second domain being allocated to the second layer element, and a third domain being allocated to the third layer element, and which determines whether each of the plurality of domains of the memory is accessible based on which one of the first, second and third layer elements corresponds to a domain that is currently being accessed from among a plurality of domains of the memory, wherein at least the second domain is different from the third domain, wherein the first layer element is a virtual machine monitor (VMM) interfacing hardware of the system to at least one guest operating system kernel, the second layer element is the at least one guest operating system kernel, and the third layer element includes at least one application.