Operating system kernel security protection system based on hardware virtualization

Abstract

The invention relates to the technical field of computer security, in particular to an operating system kernel security protection system based on hardware virtualization, which comprises a hardware virtualization module, a kernel isolation module, a security monitoring module and a data protection module. And the system security is obviously improved. Traditional software protection depends on authority management and access control mechanisms of an operating system and is easily subjected to bypassing attacks of malicious programs, for example, protection is broken through by modifying a system call table, utilizing memory vulnerabilities and the like. According to the system, privilege level isolation of hardware virtualization is utilized, a kernel runs in an independent virtual machine with the highest privilege level, a user application program runs in a virtual machine with the low privilege level, and hardware directly prevents unauthorized access of the application program, so that direct attack of malicious codes of an application layer to the kernel is eradicated fundamentally.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to an operating system kernel security protection system based on hardware virtualization. Background Art

[0002] With the rapid development of computer information technology, computer applications have seen unprecedented growth. However, while computers have made life and work more convenient, security issues associated with computer operations have also become increasingly serious. As a crucial component of information technology, the security of all computer software plays a crucial role in information security. The security of the operating system, the platform on which computer software runs, is a top priority in information security defense. Conventional operating system protection measures, such as antivirus software, data encryption, and access control, fall short of meeting security requirements. When a vulnerability in an operating system component leads to an attack and compromise, the operating system cannot guarantee that other components remain unaffected. Patching discovered vulnerabilities only protects against publicly available attacks, but remains ineffective against some undisclosed attack methods.

[0003] In the existing technology, the operating system kernel faces attacks from malicious programs, especially kernel-level rootkits attacks, which can tamper with kernel code or data, thereby controlling the entire operating system and threatening system security; Although virtualization technology provides an isolated environment for the operating system, it also has security vulnerabilities. For example, the virtualization layer may be exploited by malicious code, thus affecting the security of the entire system. Although hardware virtualization technology provides inherent security advantages, its protection capabilities in practical applications still need to be further improved, such as by enhancing security through hardware-assisted memory protection and register protection. Summary of the Invention

[0004] In response to the deficiencies in the prior art, the present invention provides an operating system kernel security protection system based on hardware virtualization, thereby solving the technical problems mentioned in the background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: An operating system kernel security protection system based on hardware virtualization, including a hardware virtualization module, a kernel isolation module, a security monitoring module, and a data protection module; The hardware virtualization module has sub-units including: a virtual CPU resource allocation unit, which virtualizes the physical CPU resources into multiple virtual CPUs for use by different virtual machines through hardware virtualization operations, and allocates dedicated virtual CPU resources to the virtual machine where the kernel is located; The kernel isolation module consists of subunits including the privileged isolation and security protection unit. Using the VMX or SVM mode provided by the hardware, the kernel runs in an independent virtual machine with the highest privilege level, while user applications run in low-privilege virtual machines. This prevents unauthorized access by applications directly through hardware. The security monitoring module has sub-units including: privileged level positioning unit, which is based on the hardware virtualization module and has a higher authority level than the operating system kernel; Interception rule unit: When a user-mode program or kernel module initiates resource access, such as reading kernel memory or calling privileged instructions, the hardware automatically triggers a VMExit exception and transfers control to the security monitoring module. The event detection classification unit,baseline anomaly detection requires first determining the key monitoring indicators of kernel operation,such as system call frequency and memory allocation rate, and collecting data during the period of stable system operation; The historical record unit needs to be calibrated regularly to recalculate parameters and adaptive learning using the latest 7 days of data; The data protection module has sub-units including: key and certificate management unit, which adopts a three-level key architecture: root key, master key, and data encryption key. The root key is stored through a hardware security module and physical unclonable technology; The encryption processing and hardware acceleration unit uses AES-NI hardware encryption, XTS-AES-256 disk volume encryption, and the national secret algorithm suite SM2+SM4+SM3 strategy for memory, storage, and transmission scenarios respectively, supporting encryption on write, decryption on read, and dynamic encryption of streaming media; The access control and privilege management unit sets the memory access mask through the EPT page table and AMD-VSVM mode to achieve hard isolation of the kernel data address space.

[0006] In one possible implementation, in the hardware virtualization module, the virtual CPU resource allocation unit avoids preemption and performance fluctuations caused by sharing resources with other applications, ensures the efficiency and stability of kernel operation, prevents the kernel performance degradation caused by resource preemption caused by traditional software protection, and uses hardware virtualization technology to quickly complete the conversion of virtual addresses to physical addresses. Compared with the memory mapping method simulated by software, it reduces the address conversion time, improves the overall operation efficiency of the system, and reduces performance loss.

[0007] In one possible implementation, in the kernel isolation module, the privilege isolation and security protection unit implements security protection from the underlying architecture, prevents direct attacks on the kernel by malicious code at the application layer, enhances system security, solves the problem of insufficient kernel integrity protection, and realizes rapid switching and control of the running status of the kernel virtual machine. When a potential security threat is detected, the kernel virtual machine can be quickly isolated or protected, the malicious process will be terminated, the system status will be restored, the hardware-assisted protection capability will be improved, and security vulnerabilities that may be exploited in the virtualization layer will be dealt with.

[0008] In a possible implementation, in the security monitoring module, the privileged level positioning unit ensures that all resource access requests from the kernel and application layers can be intercepted, and relies on hardware virtualization technology to achieve complete control over the running status of the virtual machine.

[0009] In a possible implementation, in the security monitoring module, the interception rule unit utilizes the I / O interception and memory access control functions of hardware virtualization, and the formula is: IF (access type == memory read / write ∧ target address ∈ kernel protected area) OR (operation type == privileged instruction execution) THEN triggers VMExit and enters the security monitoring module processing flow.

[0010] In a possible implementation, in the security monitoring module, the event detection and classification unit establishes a normal behavior baseline through a statistical model: calculates the mean of the indicators and standard deviation ,by Define the range of allowed fluctuations. When real-time monitoring is performed, when the current indicator exceeds the range of allowed fluctuations, an abnormal warning will be triggered: according to the deviation multiple = It will be warned or intercepted in a graded manner. When the absolute value of the deviation multiple is less than or equal to 1, it is within the normal range and monitoring will continue without warning. When the absolute value of the deviation multiple is greater than 1 and less than or equal to 2, a warning will be issued, a log will be recorded, and the administrator will be notified. A lightweight scan will be automatically started. When the absolute value of the deviation multiple is greater than 2 and less than or equal to 3, a full system virus scan will be performed, suspicious processes will be isolated, an abnormality report will be generated, and historical records will be kept. When the absolute value of the deviation multiple is greater than 3, the operation will be intercepted immediately, the relevant processes will be terminated, and the kernel virtual machine will be isolated.

[0011] In a possible implementation, in the security monitoring module, the history record unit is further calculated by a weighted formula Fusion of new and old data to adapt to changes in system load.

[0012] In one possible implementation, the data protection module and the key and certificate management unit utilize the Shamir secret sharing algorithm to implement key sharding storage; support a mixed mode of self-signed certificates and CA certificates, implement efficient key negotiation based on the ECC-256 algorithm, integrate OCSP stapling and certificate timestamp verification, build a dynamic trust chain, implement real-time verification of certificate status and device identity binding, implement full life cycle security management of keys and certificates, and ensure the security of data encryption, identity authentication, and key negotiation.

[0013] In one possible implementation, the data protection module, encryption processing and hardware acceleration unit deeply integrate x86VT-x / ARMTrustZone hardware virtualization technology to build a heterogeneous computing architecture. Through an intelligent load scheduling mechanism, CPU / FPGA encryption tasks are dynamically allocated to ensure encryption and decryption performance and system response efficiency, and kernel key data is encrypted for storage and transmission, and encryption and decryption efficiency is improved through hardware acceleration.

[0014] In one possible implementation, the data protection module, access control and privilege management unit constructs three levels of privilege domains: security domain, kernel domain, and user domain. It adopts an attribute-based access control model, dynamically generates access decisions based on attributes such as process signature status and data sensitivity level, supports temporary promotion and demotion of privilege levels and hardware-level address filtering, prevents user-state unauthorized access to kernel data, and implements fine-grained access control and privilege management of kernel data based on hardware virtualization privilege level isolation.

[0015] Beneficial effects compared with existing technologies: 1. In this solution, security protection is implemented from the underlying architecture with the help of hardware virtualization technology, which significantly improves system security. Traditional software protection relies on the operating system's own permission management and access control mechanisms, and is vulnerable to bypass attacks by malicious programs, such as breaking through protection by modifying the system call table, exploiting memory vulnerabilities, etc. However, this system uses hardware virtualization's privileged level isolation to run the kernel in an independent virtual machine with the highest privilege level, and user applications run in low-privilege virtual machines. The hardware directly blocks unauthorized access by applications, eliminating direct attacks on the kernel by malicious code at the application layer from the root; 2. In this solution, based on hardware virtualization technology, most security control operations are performed directly by hardware. The efficient processing capabilities minimize the impact of these security operations on system performance and enable rapid conversion of virtual addresses to physical addresses. Compared to software-emulated memory mapping, this significantly reduces address conversion time and improves overall system efficiency. Furthermore, hardware virtualization technology allocates independent virtual CPU resources to the kernel, ensuring efficient and stable kernel operation and avoiding the kernel performance degradation caused by resource preemption in traditional software protection. 3. This solution uses a data protection module combined with hardware virtualization technology to encrypt and control access to critical kernel data. For data encryption, the use of hardware-accelerated encryption algorithms, such as the AES hardware encryption engine, not only improves encryption and decryption speeds but also reduces the risk of encryption being cracked. For access control, a stricter role-based access control model is established based on the privilege levels and resource isolation mechanisms of hardware virtualization. This hardware-level guarantee ensures that only authorized kernel modules and users can access specific data. This significantly improves data protection reliability compared to traditional software-based access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, the following is a detailed description of the preferred embodiments of the present invention with reference to the accompanying drawings.

[0017] Figure 1 It is a schematic diagram of the overall structure of the present invention. DETAILED DESCRIPTION

[0018] Preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention can be implemented in various forms, so the present invention is not limited to the embodiments described below. The technical solution in the embodiments of the present application is to solve the problems of the above-mentioned background technology, and the overall idea is as follows: Example: Please refer to Figure 1 As shown, this embodiment introduces an operating system kernel security protection system based on hardware virtualization, including a hardware virtualization module, a kernel isolation module, a security monitoring module and a data protection module; The hardware virtualization module has sub-units including: virtual CPU resource allocation unit; Virtual CPU resource allocation unit: Through hardware virtualization operations, the physical CPU resources are virtualized into multiple virtual CPUs for use by different virtual machines. Dedicated virtual CPU resources are allocated to the virtual machine where the kernel resides, avoiding preemption and performance fluctuations caused by sharing resources with other applications. This ensures the efficiency and stability of kernel operation and prevents the kernel performance degradation caused by resource preemption that occurs with traditional software protection. Hardware virtualization technology is used to quickly complete the conversion of virtual addresses to physical addresses. Compared with the software-simulated memory mapping method, this reduces address conversion time, improves overall system efficiency, and reduces performance loss. The sub-units under the kernel isolation module include: privilege isolation and security protection unit; Privileged Isolation and Security Protection Unit: Leveraging the VMX or SVM modes provided by the hardware, the kernel runs in an independent virtual machine at the highest privilege level, while user applications run in low-privilege virtual machines. This hardware directly blocks unauthorized access by applications, implementing security protection from the underlying architecture and preventing direct attacks on the kernel from malicious code at the application layer. This enhances system security, addresses the issue of insufficient kernel integrity protection, and enables rapid switching and control of the kernel virtual machine's operating state. When a potential security threat is detected, the kernel virtual machine can be quickly isolated or protected, terminating the malicious process and restoring the system state. This enhances hardware-assisted protection capabilities and addresses security vulnerabilities that may be exploited at the virtualization layer. The security monitoring module has sub-units including: privilege level positioning unit, interception rule unit, event detection classification unit and history recording unit; Privileged Level Positioning Unit: Based on the hardware virtualization module, the privilege level is higher than that of the operating system kernel, ensuring that all resource access requests from the kernel and application layers can be intercepted. Relying on hardware virtualization technology, it can achieve complete control over the running status of the virtual machine. Interception rule unit: Utilizing the I / O interception and memory access control functions of hardware virtualization, when a user-mode program or kernel module initiates resource access, such as reading kernel memory or calling privileged instructions, the hardware automatically triggers a VMExit exception and transfers control to the security monitoring module. The formula is: IF (access type == memory read / write ∧ target address ∈ kernel protected area) OR (operation type == privileged instruction execution) THEN triggers VMExit and enters the security monitoring module processing flow; Event detection classification unit: Baseline-based anomaly detection requires first determining the key monitoring indicators of kernel operation, such as system call frequency and memory allocation rate, collecting data during the stable operation period of the system, and establishing a normal behavior baseline through statistical models: calculating the mean of the indicators and standard deviation ,by Define the range of allowed fluctuations. When real-time monitoring is performed, when the current indicator exceeds the range of allowed fluctuations, an abnormal warning will be triggered: according to the deviation multiple = Issue graded warnings or interceptions. When the absolute value of the deviation multiple is less than or equal to 1, it is within the normal range and monitoring continues without warning. When the absolute value of the deviation multiple is greater than 1 and less than or equal to 2, a warning will be issued, a log will be recorded, and the administrator will be notified. A lightweight scan will be automatically started. When the absolute value of the deviation multiple is greater than 2 and less than or equal to 3, a full system virus scan will be performed, suspicious processes will be isolated, an abnormality report will be generated, and a historical record will be kept. When the absolute value of the deviation multiple is greater than 3, the operation will be intercepted immediately, the relevant process will be terminated, and the kernel virtual machine will be isolated. Historical record unit: The baseline needs to be calibrated regularly with the latest 7 days of data to recalculate parameters and adaptive learning, and then use the weighted formula Fusion of new and old data to adapt to changes in system load.

[0019] The data protection module has sub-units including: key and certificate management unit, encryption processing and hardware acceleration unit and access control and privilege management unit.

[0020] Key and Certificate Management Unit: This unit adopts a three-level key architecture: root key, master key, and data encryption key. The root key is stored through a hardware security module and physically unclonable technology, and key sharding storage is implemented using the Shamir secret sharing algorithm. It supports a hybrid mode of self-signed certificates and CA certificates, and implements efficient key negotiation based on the ECC-256 algorithm. It integrates OCSP stapling and certificate timestamp verification to build a dynamic trust chain, implement real-time certificate status verification and device identity binding, and achieve full lifecycle security management of keys and certificates, ensuring the security of data encryption, identity authentication, and key negotiation. Encryption Processing and Hardware Acceleration Unit: This unit utilizes AES-NI hardware encryption, XTS-AES-256 disk volume encryption, and the National Cryptography Algorithm Suite (SM2+SM4+SM3) for memory, storage, and transmission scenarios, respectively, supporting encryption-on-write, decryption-on-read, and dynamic encryption of streaming media. It also deeply integrates x86VT-x / ARMTrustZone hardware virtualization technology to build a heterogeneous computing architecture. It dynamically allocates CPU / FPGA encryption tasks through an intelligent load scheduling mechanism to ensure encryption and decryption performance and system response efficiency. It implements encrypted storage and transmission of critical kernel data, and improves encryption and decryption efficiency through hardware acceleration. Access control and privilege management unit: Constructs three levels of privileged domains: security domain, kernel domain, and user domain. Memory access masks are set through EPT page tables and AMD-VSVM mode to achieve hard isolation of kernel data address space. Adopts an attribute-based access control model, dynamically generates access decisions based on attributes such as process signature status and data sensitivity level, supports temporary promotion and demotion of privilege levels and hardware-level address filtering, prevents user-mode unauthorized access to kernel data, and implements fine-grained access control and privilege management of kernel data based on hardware virtualization privilege level isolation.

[0021] Finally, it should be noted that the above embodiments are merely examples for the purpose of illustrating the present invention and are not intended to limit the embodiments. Those skilled in the art will readily appreciate that other variations or modifications based on the above description are possible. It is not necessary and impossible to provide an exhaustive list of all embodiments. However, obvious variations or modifications arising therefrom remain within the scope of protection of the present invention.

Claims

1. An operating system kernel security protection system based on hardware virtualization, characterized in that: Includes hardware virtualization module, kernel isolation module, security monitoring module and data protection module; The hardware virtualization module has sub-units including: a virtual CPU resource allocation unit, which virtualizes the physical CPU resources into multiple virtual CPUs for use by different virtual machines through hardware virtualization operations, and allocates dedicated virtual CPU resources to the virtual machine where the kernel is located; The kernel isolation module consists of subunits including the privileged isolation and security protection unit. Using the VMX or SVM mode provided by the hardware, the kernel runs in an independent virtual machine with the highest privilege level, while user applications run in low-privilege virtual machines. This prevents unauthorized access by applications directly through hardware. The security monitoring module has sub-units including: privileged level positioning unit, which is based on the hardware virtualization module and has a higher authority level than the operating system kernel; Interception rule unit: When a user-mode program or kernel module initiates resource access, such as reading kernel memory or calling privileged instructions, the hardware automatically triggers a VMExit exception and transfers control to the security monitoring module. The event detection classification unit,baseline anomaly detection requires first determining the key monitoring indicators of kernel operation,such as system call frequency and memory allocation rate, and collecting data during the period of stable system operation; The historical record unit needs to be calibrated regularly to recalculate parameters and adaptive learning using the latest 7 days of data; The data protection module has sub-units including: key and certificate management unit, which adopts a three-level key architecture: root key, master key, and data encryption key. The root key is stored through a hardware security module and physical unclonable technology; The encryption processing and hardware acceleration unit uses AES-NI hardware encryption, XTS-AES-256 disk volume encryption, and the national secret algorithm suite SM2+SM4+SM3 strategy for memory, storage, and transmission scenarios respectively, supporting encryption on write, decryption on read, and dynamic encryption of streaming media; The access control and privilege management unit sets the memory access mask through the EPT page table and AMD-VSVM mode to achieve hard isolation of the kernel data address space.

2. The hardware virtualization-based operating system kernel security protection system according to claim 1, characterized in that: In the hardware virtualization module, the virtual CPU resource allocation unit avoids preemption and performance fluctuations caused by sharing resources with other applications, ensures the efficiency and stability of kernel operation, prevents the kernel performance degradation caused by resource preemption caused by traditional software protection, and uses hardware virtualization technology to quickly complete the conversion of virtual addresses to physical addresses. Compared with the memory mapping method simulated by software, it reduces the address conversion time, improves the overall system operation efficiency, and reduces performance loss.

3. The hardware virtualization-based operating system kernel security protection system according to claim 1, characterized in that: In the kernel isolation module, the privilege isolation and security protection unit implements security protection from the underlying architecture, prevents direct attacks on the kernel by malicious code at the application layer, enhances system security, solves the problem of insufficient kernel integrity protection, and realizes rapid switching and control of the running status of the kernel virtual machine. When a potential security threat is detected, the kernel virtual machine can be quickly isolated or protected, the malicious process will be terminated, the system status will be restored, the hardware-assisted protection capability will be improved, and security vulnerabilities that may be exploited in the virtualization layer will be dealt with.

4. The hardware virtualization-based operating system kernel security protection system according to claim 1, characterized in that: In the security monitoring module, the privileged level positioning unit ensures that all resource access requests from the kernel and application layers can be intercepted, and relies on hardware virtualization technology to achieve complete control over the running status of the virtual machine.

5. The hardware virtualization-based operating system kernel security protection system according to claim 4, characterized in that: In the security monitoring module, the interception rule unit uses the I / O interception and memory access control functions of hardware virtualization. The formula is: IF (access type == memory read / write ∧ target address ∈ kernel protected area) OR (operation type == privileged instruction execution) THEN triggers VMExit and enters the security monitoring module processing flow.

6. The operating system kernel security protection system based on hardware virtualization according to claim 5, characterized in that: In the security monitoring module, the event detection and classification unit establishes a normal behavior baseline through a statistical model: calculates the mean of the indicators and standard deviation ,by Define the range of allowed fluctuations. When real-time monitoring is performed, when the current indicator exceeds the range of allowed fluctuations, an abnormal warning will be triggered: according to the deviation multiple = It will be warned or intercepted in a graded manner. When the absolute value of the deviation multiple is less than or equal to 1, it is within the normal range and monitoring will continue without warning. When the absolute value of the deviation multiple is greater than 1 and less than or equal to 2, a warning will be issued, a log will be recorded, and the administrator will be notified. A lightweight scan will be automatically started. When the absolute value of the deviation multiple is greater than 2 and less than or equal to 3, a full system virus scan will be performed, suspicious processes will be isolated, an abnormality report will be generated, and historical records will be kept. When the absolute value of the deviation multiple is greater than 3, the operation will be intercepted immediately, the relevant processes will be terminated, and the kernel virtual machine will be isolated.

7. The operating system kernel security protection system based on hardware virtualization according to claim 6, characterized in that: In the security monitoring module, the historical record unit is then calculated by the weighted formula Fusion of new and old data to adapt to changes in system load.

8. The hardware virtualization-based operating system kernel security protection system according to claim 1, characterized in that: The data protection module and key and certificate management unit use the Shamir secret sharing algorithm to implement key sharding storage; support a mixed mode of self-signed certificates and CA certificates, implement efficient key negotiation based on the ECC-256 algorithm, integrate OCSP stapling and certificate timestamp verification, build a dynamic trust chain, implement real-time verification of certificate status and device identity binding, realize full life cycle security management of keys and certificates, and ensure the security of data encryption, identity authentication and key negotiation.

9. The hardware virtualization-based operating system kernel security protection system according to claim 8, characterized in that: The data protection module, encryption processing and hardware acceleration unit are deeply integrated with x86VT-x / ARMTrustZone hardware virtualization technology to build a heterogeneous computing architecture. Through an intelligent load scheduling mechanism, CPU / FPGA encryption tasks are dynamically allocated to ensure encryption and decryption performance and system response efficiency. The kernel's key data is encrypted for storage and transmission, and encryption and decryption efficiency is improved through hardware acceleration.

10. The operating system kernel security protection system based on hardware virtualization according to claim 9, characterized in that: The data protection module, access control and privilege management unit, constructs three levels of privilege domains: security domain, kernel domain, and user domain. It adopts an attribute-based access control model, dynamically generates access decisions based on attributes such as process signature status and data sensitivity level, supports temporary promotion and demotion of privilege levels and hardware-level address filtering, prevents user-state unauthorized access to kernel data, and implements fine-grained access control and privilege management of kernel data based on hardware virtualization privilege level isolation.

Images