Patent ID: 8555081

Claim:
In a computer system comprising a virtual machine monitor (VMM) running on system hardware and supporting a virtual machine (VM), a method of controlling access to a cloaked data page stored in a system memory, the method comprising: the VMM receiving a request for access to the cloaked data page; the VMM determining whether the cloaked data page is plaintext or encrypted; the VMM determining whether or not the request corresponds to a first execution context associated with the cloaked data page; if the VMM determines that the cloaked data page is plaintext and that the request does correspond to the first execution context, then: the VMM mapping the location of the cloaked data page into a shadow mapping of the first execution context; if the VMM determines that the cloaked data page is plaintext and that the request does not correspond to the first execution context, then: the VMM unmapping the cloaked data page from any mapped references to the cloaked data page not corresponding to the first execution context; the VMM encrypting the data in the cloaked data page; and the VMM mapping the location of the cloaked data page into a shadow mapping of an execution context to which the request corresponds; if the VMM determines that the cloaked data page is encrypted and that the request does correspond to the first execution context, then: the VMM verifying the integrity of the encrypted data in the cloaked data page; if the integrity of the encrypted data in the cloaked data page is verified, the VMM decrypting the encrypted data in the cloaked data page and storing the decrypted data; and the VMM mapping the location of the decrypted cloaked data page into a shadow mapping of the first execution context; and if the VMM determines that the cloaked data page is encrypted and that the request does not correspond to the first execution context, then: the VMM mapping the location of the cloaked data page into a shadow mapping of the execution context to which the request corresponds.